On April 15, 2025, the Italian National Cybersecurity Agency (“ACN”) published on its website three new determinations issued by the Director General of the ACN:
Determination 136117, which updates and replaces Determination ACN No. 38565 of November 26, 2024, governs access to the services portal and the procedures for registration and information updates, as well as the designation of the point of contact and other persons authorized to operate on the ACN services portal on behalf of NIS entities.
The main new features introduced by Determination 136117 concern:
The substitute point of contact is a natural person, different from the main point of contact, designated by the NIS entity pursuant to Article 7(4)(d) of Legislative Decree No. 138/2024, whose role is to support the point of contact in carrying out its functions (except for registration, which remains solely with the point of contact).
The secretariat, on the other hand, is the natural person who supports the point of contact and the substitute point of contact in interactions with ACN.
Finally, the operators are those who support the point of contact and the substitute point of contact in operating on the portal.
As with the point of contact, the functions of the substitute point of contact may only be carried out by the legal representative, a general attorney (registered in the business register), or an employee delegated by the legal representative. However, it is unclear whether this also applies to the secretariat and operators.
To operate on the portal, the substitute point of contact, the secretariat and the operators must be invited by the point of contact, complete registration and associate their user account with that of the NIS entity. However, the secretariat and operators may not use the portal to send communications to ACN regarding the fulfilment of obligations under Legislative Decree no. 138/2024. The role of secretariat may only be assigned to a single user.
It should be noted, in any case, that while the designation of the substitute point of contact is mandatory, the involvement of the secretariat and operators is purely optional.
With regard to the process of updating information, Determination 136117 requires that between April 15 and May 31 of each year, the information required by Article 7(4 and 5) of Legislative Decree no. 138/2024 be submitted via the portal section called "NIS Service/Annual Update".
In particular, all NIS entities must, as applicable, provide or verify the update of the following information:
Providers of domain name system services, top-level domain name registry operators, domain name registration service providers, cloud computing service providers, data center service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engine providers, and social network platform providers must also, where applicable, provide or verify the update of information relating to their EU establishments. Furthermore, if they are established outside the national territory and have appointed their representative in Italy, they must provide and verify the update of the personal and contact details of the representative in Italy.
Detailed analyses of Determination 136118 and Determination 164179 will be available shortly.
If you need assistance and support in fulfilling the obligations set out in the NIS legislation, please contact your professional advisers.
