Sicurezza informatica: Italia (2026)
Italy operates a comprehensive, in-force cybersecurity regime. NIS2 was transposed through Legislative Decree 138/2024 (published 1 October 2024, entered into force 16 October 2024), making the National Cybersecurity Agency (ACN) the single competent authority and point of contact, with CSIRT Italia handling incident notifications. This is layered with Law 90/2024 on the National Cybersecurity Perimeter (public administrations and critical operators), sector regimes such as DORA for finance, and GDPR Article 33 breach notification duties.
Struttura primaria
Legislative Decree 138/2024 (transposing EU NIS2 Directive 2022/2555) and Law 90/2024 (national cybersecurity law), supervised by the Agenzia per la Cybersicurezza Nazionale (ACN) which also hosts CSIRT Italia; sectoral layers include DORA for financial entities (Banca d'Italia, CONSOB, IVASS) and GDPR enforcement by the Garante.
Punti chiave
NIS2 transposition in force
Legislative Decree 138/2024 transposes NIS2 and entered into force on 16 October 2024. It covers roughly 18 sectors and over 80 entity types, classified as 'essential' or 'important', with scaled security, governance and reporting duties.
Competent authority: ACN / CSIRT Italia
The Agenzia per la Cybersicurezza Nazionale (established by Decree-Law 82/2021) is the national NIS competent authority and single point of contact; CSIRT Italia, embedded in ACN, is the technical-operational hub for mandatory and voluntary incident notifications.
Incident reporting cadence
Essential and important entities under NIS2 must submit an early warning to CSIRT Italia within 24 hours of a significant incident, a full incident notification within 72 hours, and a final report within one month. Public bodies and perimeter entities under Law 90/2024 face parallel 24/72-hour duties.
Registration and phased obligations
In-scope entities had to register on the ACN national platform by 28 February 2025 (digital/cloud/MSSPs earlier, by 17 January 2025), update management-body information by 31 May 2025, implement baseline security measures by autumn 2026, with ACN inspections from October 2026.
Law 90/2024 — National Cybersecurity Perimeter
Law 90/2024 (in force July 2024) strengthens duties for public administrations and perimeter operators, expanding mandatory incident notifications. ACN's Determina of 9 February 2026 (Gazzetta Ufficiale, 17 February 2026) formalised the incident taxonomy that triggers reporting.
Sectoral layer: DORA for finance
Regulation (EU) 2022/2554 (DORA) applies to Italian financial entities since 17 January 2025. Banca d'Italia receives major ICT incident reports and significant cyber-threat notifications; Banca d'Italia, CONSOB and IVASS jointly supervise and run the TIBER-IT advanced testing framework.
Penalties
Under Legislative Decree 138/2024, essential entities face administrative fines up to €10 million or 2% of global annual turnover (whichever is higher); important entities up to €7 million or 1.4% of global turnover.
La presente pagina è una traduzione fornita a titolo informativo; la versione inglese è quella ufficiale e non costituisce un parere legale.