Cybersecurity Policy Report, Italian Cyber Agency Publishes Breach Notification Guide, (Jul 29, 2024)

By Tony Foley

The Italian National Security Agency (ACN) has published a guide to assist data controllers in notifying security incidents to the country’s computer security incident response team (CSIRT Italia).

In a Friday news release, ACN said the correct adoption of the cyber incident notification procedure was a crucial element in guaranteeing the security and resilience of networks, information systems, and IT services. “The promptness and precision of the information provided during the notification process play a fundamental role in allowing CSIRT Italy to acquire complete and exhaustive knowledge of the incident that occurred for the purposes of the alert activity and to provide the affected parties with the necessary support with a view to restoring the services themselves,” the release said.

The guide, which may be downloaded from the press release but is available only in Italian, compiles the instructions applicable to the various public and private entities required by law to notify incidents. The guide divides the information flow to CSIRT Italia into phases, as follows:

1. A preparatory phase, with the aim of collecting the information suitable to guarantee sufficient knowledge of the event;

2. An incident reporting phase, which includes filling out appropriate forms within time frames specified in the guidelines;

3. A phase concerning the actual management of the notification, including incident handling operations by CSIRT Italia staff to provide support to the victim with effective containment and service restoration actions; and

4. A final incident closure phase.

ACN noted that the guide also was addressed to public and private entities that, though not legally required to notify, intend to do so voluntarily.

News: InternationalLegislation DataSecurity DataBreach