Cybersecurity Database

Regulation

ACN Determination 379907/2025 – Basic NIS security measures and incident notification

Determination No. 379907/2025 of the Director General of the National Cybersecurity Agency – Basic specifications for the obligations under Articles 23, 24, 25, 29 and 32 of the NIS Decree

In force since 15 January 2026Record checked against the official source on 29 October 2026 · Methodology

Official source: https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed

Official sourceWayback Machine snapshot
Official number
ACN Determination No. 379907/2025
Date adopted
Entry into force

Summary

The determination sets the basic specifications through which NIS entities comply with Legislative Decree 138/2024: four annexes with the security measures (for important and essential entities) and the significant incidents to be notified to CSIRT Italia. Measures must be adopted within 18 months, and incident notification starts 9 months after the entity is told it is on the NIS list. It also lays down rules for domain name registries and registrars, and transitional arrangements for former operators of essential services and for telecoms, with the outage thresholds to be notified. It replaces Determination No. 164179 of 14 April 2025.

Who it applies to

Essential and important entities under Legislative Decree 138/2024, with specific rules for domain name registries and registrars, former operators of essential services and telecoms operators.

Key dates

  1. Entities added to the NIS list in 2026: deadline to adopt the basic security measures (ACN Determination 127434/2026)

Information

Jurisdiction
Italy
Issuing body
National Cybersecurity Agency (ACN) – Director General
Type
Regulation
Available languages
Italian
Topics
Notes
It applies from 15 January 2026. For entities added to the NIS list in 2026, ACN Determination No. 127434 of 13 April 2026 sets separate deadlines: incident notification from 1 January 2027 and security measures by 31 July 2027. The annexes are published on the NIS legislation page of ACN's website.
Obligations compared
Cyber incident reporting Italy

Record details

Original title
Determinazione del Direttore generale dell'Agenzia per la cybersicurezza nazionale n. 379907/2025 – Specifiche di base per l'adempimento agli obblighi di cui agli articoli 23, 24, 25, 29 e 32 del decreto NIS
Title in other languages
  • Décision n° 379907/2025 du directeur général de l'Agence pour la cybersécurité nationale – Spécifications de base pour les obligations des articles 23, 24, 25, 29 et 32 du décret NIS
  • Determinación n.º 379907/2025 del director general de la Agencia para la Ciberseguridad Nacional – Especificaciones básicas para las obligaciones de los artículos 23, 24, 25, 29 y 32 del Decreto NIS
  • Verfügung Nr. 379907/2025 des Generaldirektors der Nationalen Agentur für Cybersicherheit – Grundlegende Spezifikationen für die Pflichten nach den Artikeln 23, 24, 25, 29 und 32 des NIS-Dekrets
Licence / terms of use
Public domain / official act – Official act of a public administration excluded from copyright protection (Art. 5 of Law 633/1941).
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

National Cybersecurity Agency (ACN) – Director General. (2025). Determinazione del Direttore generale dell'Agenzia per la cybersicurezza nazionale n. 379907/2025 – Specifiche di base per l'adempimento agli obblighi di cui agli articoli 23, 24, 25, 29 e 32 del decreto NIS (ACN Determination No. 379907/2025). https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed

Chicago

National Cybersecurity Agency (ACN) – Director General. "Determinazione del Direttore generale dell'Agenzia per la cybersicurezza nazionale n. 379907/2025 – Specifiche di base per l'adempimento agli obblighi di cui agli articoli 23, 24, 25, 29 e 32 del decreto NIS." 19 December 2025. https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed.

BibTeX

@misc{it_acn_determinazione_379907_2025_specifiche_base,
  author       = {{National Cybersecurity Agency (ACN) – Director General}},
  title        = {{Determinazione del Direttore generale dell'Agenzia per la cybersicurezza nazionale n. 379907/2025 – Specifiche di base per l'adempimento agli obblighi di cui agli articoli 23, 24, 25, 29 e 32 del decreto NIS}},
  year         = {2025},
  note         = {ACN Determination No. 379907/2025},
  url          = {https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON