Time is running out. By December 31, 2025, all essential organizations or providers of critical digital services must appoint a CSIRT Point of Contact. This is not just a formality, but a strategic pillar to ensure operational continuity, regulatory resilience, and readiness in managing cyber incidents.

For over 20 years, ISGroup has stood alongside the most exposed organizations, offering a complete solution to fulfill the obligation of appointing a CSIRT point of contact, with an operational, responsive service that is fully compliant with the NIS2 Directive.

What is a CSIRT and why is it mandatory from 2025

The NIS2 Directive, transposed at the European level, requires all essential and critical digital entities to appoint a CSIRT point of contact, to be registered through the ACN portal. This role is mandatory for public administration, healthcare, energy, transport, finance, and other strategic sectors.

Role and responsibilities

The CSIRT Point of Contact is the professional responsible for:

• Operationally managing cyber incidents
• Coordinating mandatory notifications to the ACN
• Maintaining a direct channel with CSIRT Italia
• Ensuring a timely and compliant response to significant events

“They are the person who transforms the chaos of an incident into a structured, effective, and fully regulatory-aligned management process.”

---

ISGroup’s CSIRT service: beyond compliance, real-world operations

Structured onboarding

Our service begins with a technical-operational onboarding phase:

• Analysis of IT infrastructure and known vulnerabilities
• Understanding processes and mapping critical workflows
• Defining response priorities in the event of an incident

Guaranteed availability

ISGroup ensures continuous coverage and guaranteed response times, with a team dedicated to crisis and incident management.

Operational intervention

During a security event:

• We intervene in coordination with your team
• We manage technical and regulatory communication with the ACN
• We provide continuous post-incident response support

Zero improvisation. Maximum responsiveness. Reduced risk.

---

Concrete benefits for your organization

Total compliance with the NIS2 Directive

By relying on ISGroup, you have the certainty of meeting all regulatory obligations and demonstrating the presence of an active and monitored incident management system.

Advanced security governance

The point of contact is not a symbolic figure: they are part of an active defense system, integrated with our services for:

• SOC-as-a-Service
• DFIR – Digital Forensics & Incident Response
• Attack simulations and tabletop exercises
• Vulnerability Management Service (VMS)

---

Real-world use cases

Activating a qualified CSIRT Point of Contact is not just a regulatory response, but an operational accelerator during the most critical phases of incident management. Here is how ISGroup supports organizations in high-exposure sectors.

Public Healthcare – Data breach & regulatory communications

In the healthcare sector, protecting sensitive patient data is an absolute priority. A data breach can have devastating impacts in terms of reputation, sanctions, and service disruption.

Scenario: A hospital facility suffered an exfiltration of clinical data due to a phishing compromise. Our CSIRT Point of Contact:

• Immediately initiated the technical response, activating the DFIR team
• Coordinated the collection of logs and Indicators of Compromise (IoC)
• Managed communication with the ACN and the Data Protection Authority within the timeframes required by GDPR
• Supported the DPO in drafting the formal notification

Result: no sanctions, credibility maintained, recovery time under 48 hours.

Energy & Utilities – ICS threats and OT incident response

Critical infrastructure in the energy sector is particularly vulnerable to ICS/SCADA attacks and Advanced Persistent Threats (APT) with direct impacts on service delivery and physical safety.

Scenario: A national electricity service provider detected anomalous traffic in OT network segments. Our team, coordinated by the CSIRT point of contact:

• Conducted a targeted forensic analysis on ICS systems
• Isolated the compromised area without interrupting service delivery
• Initiated proactive notification to the ACN, preventing escalation and extraordinary audits
• Activated threat intelligence services to prevent further attacks

Result: containment in the initial phase, no interruption, full traceability documented for NIS2 audits.

Finance – DORA compliance and business continuity

In the financial sector, compliance with the Digital Operational Resilience Act (DORA) and NIS2 regulations requires incident management that is documented, structured, and verifiable at all times.

Scenario: A fintech services company suffered a credential stuffing attack with impacts on user authentication.

The CSIRT point of contact:

• Interfaced with internal teams (IT, compliance, legal) to manage the decision-making flow
• Notified the incident to the ACN according to the standards required by NIS2 and DORA
• Coordinated the activation of the business continuity plan
• Validated the countermeasures adopted and documented the entire response cycle for regulatory review

Result: no operational downtime, complete mitigation, positive validation by internal auditors.