Italy. Cybersecurity. Legislative Decree
D.Lgs. 138/2024 (Decreto NIS)Legislative Decree No. 138 of 4 September 2024 transposing Directive (EU) 2022/2555 (NIS2)
In force
§1Summary
- Synopsis
Italy's NIS decree transposes NIS2, requiring essential and important entities to register with ACN, implement security measures and report significant incidents.
- Key themes
- Unique features
Italy was among the first large member states to transpose NIS2 on time; ACN issues determinations specifying baseline measures.
- SaaS relevance
Cloud, SaaS and managed service providers established in Italy above size thresholds must register with ACN annually and comply with security and reporting duties.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- ACN CSIRT: 24h early warning, 72h notification, 1-month final report
- Cross-border transfers
- None
- Maximum penalty
- Essential: up to €10m or 2%; important: up to €7m or 1.4%
§3Dates
- Key dates
- Adopted
- In force
- Registration on ACN platform first due by 2025-02-28; baseline security obligations phased through 2026
§4Text and authority
- Text
- Authoritative text normattiva.it
- Authority
- Agenzia per la Cybersicurezza Nazionale (ACN)
§5Where it applies
- Domestic law of
- Italy
§6Sources and verification
- Sources consulted
- Verification
High confidence.