Cybersecurity Database

Regulation

ACN Determination of 9 February 2026 – Incident taxonomy (Law 90/2024)

Determination of the Director General of the National Cybersecurity Agency of 9 February 2026 – Taxonomy of incidents under Article 1(1) of Law No. 90 of 28 June 2024

In force since 17 February 2026Record checked against the official source on 29 October 2026 · Methodology

Official source: https://www.gazzettaufficiale.it/eli/id/2026/02/17/26A00713/sg

Official source
Official number
GU n. 39 del 17.02.2026 (26A00713)
Date adopted
Entry into force

Summary

The determination adopts the taxonomy of incidents that public administrations and the other bodies covered by Law 90/2024 must report to ACN. Annex A classifies incidents as loss of confidentiality (digital data exposed externally), loss of integrity with external impact and breach of expected service levels. The taxonomy matches the NIS basic significant incidents: an entity that notifies an incident under Article 25 of Legislative Decree 138/2024 also meets the Law 90/2024 obligation.

Information

Jurisdiction
Italy
Issuing body
National Cybersecurity Agency (ACN) – Director General
Type
Regulation
Available languages
Italian
Topics
Notes
Adopted as a technical determination of ACN's Director General after Law 132/2025 on artificial intelligence amended Article 1 of Law 90/2024. It applies from its publication in the Official Gazette on 17 February 2026.
Obligations compared
Cyber incident reporting Italy

Record details

Original title
Determina del Direttore generale dell'Agenzia per la cybersicurezza nazionale 9 febbraio 2026 – Tassonomia degli incidenti di cui all'articolo 1, comma 1, della legge 28 giugno 2024, n. 90
Title in other languages
  • Décision du directeur général de l'Agence pour la cybersécurité nationale du 9 février 2026 – Taxonomie des incidents visés à l'article 1er, paragraphe 1, de la loi n° 90 du 28 juin 2024
  • Determinación del director general de la Agencia para la Ciberseguridad Nacional de 9 de febrero de 2026 – Taxonomía de los incidentes del artículo 1, apartado 1, de la Ley n.º 90, de 28 de junio de 2024
  • Verfügung des Generaldirektors der Nationalen Agentur für Cybersicherheit vom 9. Februar 2026 – Taxonomie der Vorfälle nach Artikel 1 Absatz 1 des Gesetzes Nr. 90 vom 28. Juni 2024
Licence / terms of use
Public domain / official act – Official act of a public administration excluded from copyright protection (Art. 5 of Law 633/1941).
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

National Cybersecurity Agency (ACN) – Director General. (2026). Determina del Direttore generale dell'Agenzia per la cybersicurezza nazionale 9 febbraio 2026 – Tassonomia degli incidenti di cui all'articolo 1, comma 1, della legge 28 giugno 2024, n. 90 (GU n. 39 del 17.02.2026 (26A00713)). https://www.gazzettaufficiale.it/eli/id/2026/02/17/26A00713/sg

Chicago

National Cybersecurity Agency (ACN) – Director General. "Determina del Direttore generale dell'Agenzia per la cybersicurezza nazionale 9 febbraio 2026 – Tassonomia degli incidenti di cui all'articolo 1, comma 1, della legge 28 giugno 2024, n. 90." 9 February 2026. https://www.gazzettaufficiale.it/eli/id/2026/02/17/26A00713/sg.

BibTeX

@misc{it_acn_determina_tassonomia_incidenti_2026,
  author       = {{National Cybersecurity Agency (ACN) – Director General}},
  title        = {{Determina del Direttore generale dell'Agenzia per la cybersicurezza nazionale 9 febbraio 2026 – Tassonomia degli incidenti di cui all'articolo 1, comma 1, della legge 28 giugno 2024, n. 90}},
  year         = {2026},
  note         = {GU n. 39 del 17.02.2026 (26A00713)},
  url          = {https://www.gazzettaufficiale.it/eli/id/2026/02/17/26A00713/sg},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON