The institutionalization of the CSIRT Point of Contact, formalized by the National Cybersecurity Agency (ACN) through Determination no. 333017/2025, establishes a mandatory path and precise timelines for all entities included in the scope of the NIS2 Directive. The entire procedure takes place on the ACN Service Portal with defined phases, technical responsibilities, and verifications based on robust digital authentication.

Deadlines and schedule on the ACN portal

• November 20, 2025: The telematic procedure for designating the CSIRT Point of Contact and any substitutes opens on the ACN Portal.
• December 31, 2025: Final deadline to complete the appointment procedure. After this date, the NIS entity is considered non-compliant and is subject to sanctions under Article 38 of the NIS2 Decree.
• December 2025: Month of suspension for declaration submissions to allow for the transition to 2026 systems.
• January 1 – February 28, 2026: Opening of the 2026 Registration for the Annual Declaration. All entities must confirm or modify the data of the CSIRT Point of Contact and substitutes.
• April 15 – May 31: Annual window to update information and ensure constant availability.

Preliminary verification: role and data of the Point of Contact (PoC)

1. The Point of Contact is the only one authorized to initiate the designation procedure.
2. Verify that the PoC is registered on the NIS platform and that the data is up to date.
3. The PoC accesses the ACN Portal via digital identity (SPID or CIE).
4. The mapping of essential/important services must be completed, identifying the person appointed as the CSIRT Point of Contact.

Telematic designation procedure

• The PoC accesses the “Data Update” section within the ACN Portal.
• Must enter the tax code and email of the CSIRT Point of Contact.
• Can enter the data of one or more substitutes (tax code and email), which is strongly recommended to ensure 24/7 availability.
• The system generates an automatic notification to the interested parties after submission.

Completion of the appointment: actions of the Point of Contact and Substitutes

• The CSIRT Point of Contact (and each substitute) personally accesses the portal via personal SPID or CIE.
• Completes the personal profile by entering the required data.
• Confirms the registration as CSIRT Point of Contact or Substitute for the NIS entity.
• No document upload is required: the appointment is made via strong authentication.

Substitutes and operational continuity

• The designation of substitutes is not mandatory but avoids the risk of a “single point of failure.”
• Substitutes must possess the same skills as the primary contact and can operate in their absence.
• The designation procedure is identical to that of the primary contact.

Annual declaration and data update

• From January 1 to February 28, 2026, all entities must submit the 2026 Declaration, confirming or modifying the data of the CSIRT Point of Contact and substitutes.
• After December 31, 2025, in case of errors or emergencies, the PoC’s name can be entered temporarily, updating the contact later through a skills verification process.
• Ordinary update window from April 15 to May 31.

Technical requirements for portal access

• Access is permitted exclusively via personal SPID or CIE, without simple credentials.
• The roles of CSIRT Point of Contact and substitutes are registered in the “users” category with permissions linked to incident notification management.
• The portal supports interaction in English and does not impose citizenship restrictions if the authentication tools are available.

Sanctions and risks in case of non-compliance

• Failure to complete the procedure by December 31, 2025, entails administrative pecuniary sanctions as per Article 38 of Legislative Decree 138/2024.
• Without a registered contact, it is impossible to send pre-notifications within 24 hours or notifications within 72 hours via the portal, worsening the position in the event of a real incident.
• The absence of a contact signals deficiencies in cybersecurity governance and may lead to inspections by the ACN.

Operational checklist

1. By 11/20/2025: Identify the Point of Contact and Substitutes, verify technical requirements.
2. From 11/20 to 12/31/2025: The PoC enters data in the “Data Update” section of the portal.
3. Simultaneously: The Point of Contact and Substitutes access with SPID/CIE and complete the registration.
4. Verify the “completed” or “active” status of the designation.
5. January-February 2026: Submission of the annual declaration.

The procedure creates a functional and operational delegation: the Point of Contact acts on the portal, but the legal responsibility for the accuracy and timeliness of the information remains with the management bodies of the NIS entity.