Pre-notification (pre-notifica)

The pre-notification (pre-notifica) is the first alert that a NIS2 entity sends to CSIRT Italia (Italy's national CSIRT) when it has evidence of a significant incident: it must be sent without undue delay and in any case within 24 hours.

What it contains

The decree asks for little, and asks for it "where possible": whether the incident may result from unlawful or malicious acts and whether it may have a cross-border impact. In the European directive the same step is called the *early warning*: it is the same obligation, and Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, calls it "pre-notifica".

In practice

Do not wait until you know everything. The incident management guidelines of ACN (Italy's National Cybersecurity Agency) say so explicitly: in the first hours the affected services or the exploited vulnerabilities are often unknown. You send the pre-notification with what you know, then investigate and complete it with the notification within 72 hours.
The 24 hours start from the evidence, that is from when you have objective elements showing the incident has occurred: a report from CSIRT Italia, a help desk ticket, a monitoring alert.
Who sends it: the CSIRT liaison, on the segnalazioni.acn.gov.it portal. Exceptionally, if the liaison and the deputies are unavailable, the point of contact.
What you receive: within 24 hours of the pre-notification, where possible, CSIRT Italia responds with initial feedback and, if you ask for it, guidance on mitigation.

The practical advice is to keep a template with the fixed parts already filled in (who you are, contacts, services) in the incident management plan required by measure RS.MA-01.