Cybersecurity Database

Guideline / framework / standard

National CVD Policy (ACN, 2026)

National Coordinated Vulnerability Disclosure (CVD) Policy

In force since 6 October 2026Record checked against the official source on 29 October 2026 · Methodology

Official source: https://www.acn.gov.it/portale/csirt-italia/cvd

Official sourceDownload PDF (official source)Wayback Machine snapshot
Official number
ACN Determination No. 301868/2026
Date adopted

Summary

Adopted by determination of ACN's Director General under Article 16(4) of Legislative Decree 138/2024, the policy sets out how to report and handle security vulnerabilities in ICT products and services that are not yet publicly known ("zero-days"). Anyone, whether a natural or legal person, can report them to CSIRT Italia, anonymously if they wish. CSIRT Italia, the national coordinator for coordinated disclosure, validates the report, involves the manufacturer or provider, agrees on the timing of the fix and of publication, requests a CVE identifier and updates the European vulnerability database. Researchers must stay within the law.

Who it applies to

Anyone who discovers a zero-day vulnerability in an ICT product or service, the manufacturers and providers concerned, and CSIRT Italia. It does not apply to vulnerabilities that are already public.

Information

Jurisdiction
Italy
Issuing body
National Cybersecurity Agency (ACN) – Director General, in agreement with the Ministry of Justice
Type
Guideline / framework / standard
Available languages
Italian
Topics
Notes
The determination was digitally signed on 6 October 2026, after the agreement of the Ministry of Justice (31 October 2025) and the opinion of the NIS Table (18 December 2025). Reports will go through a dedicated platform on ACN's website. The policy may be updated over time.

Record details

Original title
Politica nazionale di divulgazione coordinata delle vulnerabilità (CVD)
Title in other languages
  • Politique nationale de divulgation coordonnée des vulnérabilités (CVD)
  • Política nacional de divulgación coordinada de vulnerabilidades (CVD)
  • Nationale Politik für die koordinierte Offenlegung von Schwachstellen (CVD)
Licence / terms of use
Public domain / official act – Official act of a public administration excluded from copyright protection (Art. 5 of Law 633/1941).
Collected from
manual entry
Last verified
(verified via web)

How to cite

APA

National Cybersecurity Agency (ACN) – Director General, in agreement with the Ministry of Justice. (2026). Politica nazionale di divulgazione coordinata delle vulnerabilità (CVD) (ACN Determination No. 301868/2026). https://www.acn.gov.it/portale/csirt-italia/cvd

Chicago

National Cybersecurity Agency (ACN) – Director General, in agreement with the Ministry of Justice. "Politica nazionale di divulgazione coordinata delle vulnerabilità (CVD)." 6 October 2026. https://www.acn.gov.it/portale/csirt-italia/cvd.

BibTeX

@misc{it_acn_politica_cvd_2026,
  author       = {{National Cybersecurity Agency (ACN) – Director General, in agreement with the Ministry of Justice}},
  title        = {{Politica nazionale di divulgazione coordinata delle vulnerabilità (CVD)}},
  year         = {2026},
  note         = {ACN Determination No. 301868/2026},
  url          = {https://www.acn.gov.it/portale/csirt-italia/cvd},
  urldate      = {2026-10-29}
}

Metadata and summary: CC BY 4.0 · JSON