Significant incident (incidente significativo)

A significant incident is a cyber incident that has caused, or can cause, severe disruption of services or financial losses for the entity, or considerable losses for other people or companies: it is the incident that NIS2 requires you to notify.

What the law says

For Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, an incident is any event that compromises the availability, authenticity, integrity or confidentiality of data or services (Article 2(t)): a failure or a human error too, not just an attack. It becomes significant under the conditions of Article 25(4). For the current phase, ACN (Italy's National Cybersecurity Agency) has turned the general rule into basic incident types, where what counts is having *evidence* of the fact:

IS-1: a loss of confidentiality, towards the outside, of digital data that you own or control;
IS-2: a loss of integrity, with an impact towards the outside, of the same data;
IS-3: a breach of the expected service levels of your services or activities, as defined under measure DE.CM-01;
IS-4: for essential entities only: unauthorised access to that data, or access that abuses the privileges granted.

Important entities notify IS-1, IS-2 and IS-3.

In practice

IS-3 only works if you have written down your expected service levels beforehand. The example in ACN's guide: if a booking system must be available 99% of the time on a daily basis, more than 14 minutes and 24 seconds of downtime in a day is a breach. Without those numbers you do not know when the obligation is triggered, and the 24 hours of the pre-notification still run from the evidence.

Incidents that do not fall under these types, near misses and threats can be notified on a voluntary basis (Article 26).