Glossary

The document that turns a national strategy into concrete measures, with owners, timelines and sometimes indicators and resources. In Italy it accompanies the 2022-2026 National Cybersecurity Strategy.

Learn more → · See also: National cybersecurity strategy

The mark by which a manufacturer declares that a product complies with the EU rules that apply to it. Under the Cyber Resilience Act, for products with digital elements CE marking also attests compliance with the cybersecurity requirements.

Reference acts: Cyber Resilience Act (Regulation (EU) 2024/2847) · See also: Products with digital elements, Notified body, Harmonised standard

The public body a country designates to supervise compliance with a law and impose penalties. Under NIS 2 it may be the national cybersecurity agency or a sectoral authority, for example for energy or communications.

See also: Single point of contact, CSIRT (or CERT)

Organisations providing services essential to society and the economy (energy, transport, health, water and other sectors), identified by each Member State under the CER Directive. They must assess risks and take resilience measures, including physical ones.

Learn more → · Reference acts: CER Directive (EU) 2022/2557 · See also: Critical infrastructure

Systems and services whose disruption would seriously affect a country's security, health or economy, such as power grids, water supply, transport, telecommunications and financial services. Many national strategies make them their first priority.

Learn more → · See also: Critical entities, OT and ICS/SCADA systems

Computer Security Incident Response Team. The national CSIRT receives incident notifications, helps affected organisations and coordinates the response with other countries through the EU CSIRTs network.

CSIRT · CERT · Computer Security Incident Response Team

Learn more → · See also: Competent authority, Early warning

Recognition, issued under a defined scheme and assurance level, that a product, service or process meets certain security requirements. The Cybersecurity Act provides for European schemes valid across the EU, such as EUCC for ICT products.

EUCC

Learn more → · Reference acts: Cybersecurity Act (Regulation (EU) 2019/881), EUCC certification scheme (Reg. 2024/482) · See also: ENISA

An EU act that binds Member States as to the result to be achieved but leaves each one to choose the law that achieves it. It takes effect through transposition. Examples are NIS 2 and the CER Directive.

Reference acts: NIS 2 Directive (EU) 2022/2555, CER Directive (EU) 2022/2557 · See also: Regulation (EU), Transposition

The first report of a significant incident required by NIS 2, to be sent to the CSIRT or competent authority within 24 hours of becoming aware of it. It is followed by an incident notification within 72 hours and a final report within one month.

Learn more → · See also: Significant incident, CSIRT (or CERT)

The European Union Agency for Cybersecurity, based in Athens. The Cybersecurity Act (Regulation (EU) 2019/881) gave it a permanent mandate. It supports Member States, runs the EU certification schemes and, under the CRA, the single reporting platform.

Reference acts: Cybersecurity Act (Regulation (EU) 2019/881) · See also: Cybersecurity certification, EU-CyCLONe

The two categories of organisations covered by NIS 2, determined by sector (Annexes I and II) and size. Essential entities face closer, including proactive, supervision and higher maximum fines (€10 million or 2% of turnover, against €7 million or 1.4%).

soggetti essenziali · soggetti importanti · essential entities · important entities

Reference acts: NIS 2 Directive (EU) 2022/2555 · See also: Competent authority, Significant incident

The European Cyber Crisis Liaison Organisation Network, established by NIS 2. It coordinates Member States during large-scale cybersecurity incidents and crises.

Reference acts: NIS 2 Directive (EU) 2022/2555 · See also: NIS Cooperation Group

A European standard drawn up by CEN, CENELEC or ETSI at the Commission's request to apply an EU product law. Once its reference is published in the Official Journal of the EU, products that comply with it are presumed to meet the legal requirements it covers (presumption of conformity), subject to any restrictions stated in the publication. For the Radio Equipment Directive the EN 18031 standards apply; those for the Cyber Resilience Act are in preparation.

norme armonizzate · harmonised standards · hEN · presunzione di conformità · presumption of conformity

Learn more → · Reference acts: Cyber Resilience Act (Regulation (EU) 2024/2847), RED Delegated Regulation (EU) 2022/30 · See also: CE marking, Notified body, Products with digital elements

Acts of the European Commission that complete a directive or regulation with technical or detailed rules. For example, Implementing Regulation (EU) 2024/2690 specifies the NIS 2 security measures for digital service providers.

Reference acts: NIS 2 Implementing Regulation (EU) 2024/2690

The procedure by which the European Commission takes action against a Member State for failing to apply EU law, for example for not transposing a directive on time. It starts with a letter of formal notice, continues with a reasoned opinion and may end before the Court of Justice of the EU.

Learn more → · See also: Transposition

The national authority that checks that products on the market comply with EU rules and can require them to be corrected, withdrawn or recalled. Under the Cyber Resilience Act each Member State must designate at least one.

Learn more → · See also: Notified body, Products with digital elements

The Italian regime introduced by Decree-Law 105/2019 for the networks and systems on which essential State functions depend. The entities included must report incidents, adopt security measures and have certain ICT supplies vetted.

Learn more → · Reference acts: DL 105/2019 – National cybersecurity perimeter

The document in which a government sets the country's cybersecurity objectives, priorities and responsibilities for several years. It usually creates no direct obligations for businesses and citizens, but guides laws, investment and organisation. NIS 2 requires every Member State to have one.

NCSS

Learn more → · See also: Action or implementation plan

The group that brings together representatives of the Member States, the Commission and ENISA to exchange information and prepare common guidance on applying NIS 2.

Reference acts: NIS 2 Directive (EU) 2022/2555 · See also: EU-CyCLONe, CSIRT (or CERT)

An independent body, authorised by a Member State and notified to the Commission, that assesses product conformity when the law does not allow the manufacturer's self-assessment. Under the Cyber Resilience Act it is needed for critical products and many important products.

Reference acts: Cyber Resilience Act (Regulation (EU) 2024/2847) · See also: Market surveillance authority, CE marking

Operational technology (OT) is the set of systems that control physical processes, such as industrial plants and power and water networks. ICS and SCADA are industrial control and supervisory systems. They have specific security needs, covered by standards such as the IEC 62443 series.

OT · ICS · SCADA · tecnologia operativa

Learn more → · See also: Critical infrastructure

Under the Cyber Resilience Act, any hardware or software product that connects, directly or indirectly, to a device or network, from connected toys to routers and software. To be sold in the EU they must meet security requirements and receive updates throughout the support period. The obligation to report actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; the other requirements apply from 11 December 2027.

Learn more → · Reference acts: Cyber Resilience Act (Regulation (EU) 2024/2847) · See also: CE marking, Market surveillance authority

An EU act that applies directly in all Member States, with no need for a transposing law. Member States must still adopt some implementing measures, such as designating authorities and setting penalties. Examples are the Cyber Resilience Act, DORA and the GDPR.

Learn more → · Reference acts: Cyber Resilience Act (Regulation (EU) 2024/2847), DORA (Regulation (EU) 2022/2554) · See also: Directive (EU), Implementing and delegated acts

Under NIS 2, an incident that has caused or can cause severe operational disruption or financial loss, or considerable damage to other persons. Only significant incidents must be reported; the precise thresholds are set by national laws and implementing acts.

Learn more → · Reference acts: NIS 2 Directive (EU) 2022/2555 · See also: Early warning

The authority in each Member State that liaises with the authorities of other Member States, the Commission and ENISA on the application of NIS 2. In Italy it is the National Cybersecurity Agency (ACN).

SPOC

See also: Competent authority, ENISA

Managing risks that come from suppliers and service providers, such as compromised software or a cloud provider hit by an attack. NIS 2, DORA and the Cyber Resilience Act require organisations to assess their suppliers' security and reflect it in contracts.

supply chain

Learn more →

The adoption by a Member State of the national law that gives effect to an EU directive. The directive sets a deadline; a Member State that misses it may face infringement proceedings.

Learn more → · See also: Directive (EU), Infringement procedure