What is the ACN and what does it actually do?

The Agenzia per la Cybersicurezza Nazionale is the center of gravity. Created in 2021 by Decree-Law 82/2021, it concentrated functions that used to be scattered across ministries and agencies. Under the NIS2 decree as amended, ACN is simultaneously four things (D.lgs. 138/2024, art. 43, amending DL 82/2021): the…

Who do you notify about a cyber incident in Italy, and within how many hours?

This is the question that decides whether your bad week becomes a sanctionable one. The answer depends on which regime you are in, and many companies are in more than one at once.

Where does AgID end and where does ACN begin?

Before 2021, AgID, the Agency for Digital Italy, carried both digitalization and a chunk of security. The creation of ACN split the field, and the cleanest way to remember the split is: AgID makes the public administration digital, ACN keeps digital Italy secure.

What is the PSN, and does it concern private companies?

The Polo Strategico Nazionale is the third pole, and the most misunderstood, because it is not an authority at all. It is an industrial project: a company owned by TIM (45 percent), Leonardo (25 percent), Cassa Depositi e Prestiti through CDP Equity (20 percent) and Sogei (10 percent), operational since 21 December…

What happens when you write to CSIRT Italia?

The part nobody explains, and the reason companies over-fear the notification. CSIRT Italia is the operational arm: it receives your report through segnalazioni.acn.gov.it, triages it, and, per Article 25(7), gets back to you, where possible within 24 hours of the pre-notification, with follow-up and, on request,…

ACN, AgID, PSN...: who does what in Italian cybersecurity

ACN, AgID, PSN, CSIRT Italia, CVCN, Garante: the operational map of Italian cybersecurity. Who you notify, in how many hours, and who does what.

Italian cybersecurity governance is an alphabet soup: ACN, AgID, CSIRT, CVCN, PSN, plus the Garante and the postal police orbiting nearby. If you run IT or compliance in a company that just entered the NIS2 perimeter, or that supplies someone who did, you do not need the constitutional history of each acronym. You need to know exactly one thing per situation: who do I call, through which channel, within how many hours. This article is that map. I built it while doing compliance work for clients in Italy, and every deadline in it comes from the primary sources: Legislative Decree 138/2024 (the Italian NIS2 transposition, in force since 16 October 2024), the ACN implementing determinations, and the founding acts of each body. Skip to the table and the decision list at the end if you are in a hurry; the sections in between explain why the map looks the way…