INDUSTRIES, TECHNOLOGY | ACN Publishes new Determinations

On 24 December 2025, the National Cybersecurity Agency (ACN) published Determination No. 379887/2025, which updates and replaces Determination No. 333017/2025 concerning the ACN Portal and becomes effective as of 31 December 2025.

The main changes introduced are as follows:

• the introduction of a 10-day period during which declarations submitted via the ACN Portal may be amended; upon expiry of this period, the declaration becomes final;
• the availability of a pre-filled draft declaration on the ACN Portal for entities already classified as essential or important, to be confirmed no later than 28 February 2026;
• the inclusion of the CSIRT contact person’s details, as well as those of any designated alternates, among the information subject to verification as part of the annual update.

On the same date, the ACN also published Determination No. 379907/2025 which replaces Determination No. 164179/2025. Pursuant to this Determination, as of 15 January 2026, the incident notification obligation is aligned for all NIS entities. In addition, the Annexes to the Determination have been updated, introducing significant amendments to certain security measures, including those relating to the CSIRT contact person and alternates, cyber risk management, operational continuity and disaster recovery, backup restoration testing for essential entities, and software procurement.

Newsletter n. 114 – January 2026