Significant incident notification (notifica di incidente significativo)

Significant incident notification is the obligation on essential and important entities to report to CSIRT Italia (Italy's national CSIRT) every incident with a significant impact, in several stages with fixed deadlines: 24 hours, 72 hours, one month.

The stages

Article 25(5) of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, provides for:

[Pre-notification](/glossario/pre-notifica) within 24 hours of becoming aware of the incident;
notification within 72 hours, with an initial assessment of severity and impact and, where available, the indicators of compromise;
interim report, only if CSIRT Italia asks for one;
final report within one month of the notification: a detailed description, the root cause, the measures taken and any cross-border impact;
if the incident is still ongoing at that point: a monthly progress report, and the final report within one month of the end of the incident handling.

Trust service providers have 24 hours for the full notification too (Article 25(6)).

In practice

The clock starts from the evidence of the incident: when you have objective elements showing that it has occurred, not when it began. Notifications are sent on the segnalazioni.acn.gov.it portal, through the CSIRT liaison. Notifying does not increase your liability beyond what the incident itself entails (Article 25(3)). The management bodies must be informed of incidents and notifications.

From when: for entities added to the list in 2025, the obligation applies 9 months after the notice from ACN (Italy's National Cybersecurity Agency), so January 2026; for new 2026 entities, from 1 January 2027.