National Annex — Italy
Status as of October 2026: In force. Community-maintained orientation. This is not legal advice; verify against the official gazette and authority guidance before relying on it. Corrections welcome, see contributing.
| Review | Status |
|---|---|
| Confidence | Maintainer reviewed |
| Checked line by line against the legal text | No |
| Reviewed by a lawyer | No |
| Last reviewed | October 2026 |
| Reviewed by | Frederik B. Krogsgaard, maintainer |
| Second reviewer | Wanted, see CONTRIBUTING |
| Next review due | April 2027 |
NIS2 implementation
| Field | Value |
|---|---|
| Implementing law | Decreto legislativo 4 settembre 2024, n. 138, in force 16 October 2024 |
| Competent authority | ACN (Agenzia per la Cybersicurezza Nazionale) |
| National CSIRT / reporting | CSIRT Italia at ACN |
| Official starting point | https://www.acn.gov.it |
Country notes for your CDC
Registration via ACN portal; ACN determinations phase in minimum security requirements, with the baseline due by Oct 2026, built on the FNCS, Italy's national adaptation of the NIST CSF, so this framework maps naturally.
Standard checklist for all countries
- GOVERN: applicability determined per legal entity and sector, and recorded in the regulatory applicability register
- Entity registration completed with the national authority where required
- RESPOND: incident-reporting procedure drilled against the national channel and the 24 h early-warning clock
- Contact established with the national CSIRT before the first incident
- Data protection authority contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
- National guidance and frameworks mapped to your control evidence, per the note above
Selector tag
Tick "Italy" in tools/regulatory-profile.html to include this country's references under the it-nat tag.
Open CDC Framework, licensed CC BY 4.0.