As part of the conference “Corporate Governance and Appropriate Organisational Measures for Cyber Risk Management”, organised by Paradigma, Alessandro Del Ninno, Attorney-at-Law and Partner at FIVERS Law and Tax Firm, delivered a presentation entitled “Incident Management and Notification Obligations”, focusing on the legal framework and operational requirements governing the management and reporting of cybersecurity incidents.

The presentation examined the main notification obligations established by European and Italian legislation on cybersecurity and personal data protection, with particular emphasis on the coordination of different regulatory frameworks applicable to businesses and organisations operating in sectors exposed to significant cyber risks.

Specific attention was devoted to the reporting obligations for significant incidents under the NIS 2 regulatory framework, the incident taxonomy adopted by the Italian National Cybersecurity Agency (ACN), and the operational implications of ACN Determination No. 164179 of 14 April 2025, particularly regarding incident classification, the identification of notification triggers and compliance with applicable reporting requirements.

Further analysis addressed updates to the categories of incidents subject to mandatory notification by organisations falling within the Italian National Cybersecurity Perimeter, in light of Prime Ministerial Decree No. 111 of 4 June 2025, as well as the need to coordinate notification requirements arising under different sector-specific regulatory regimes and personal data protection legislation.

The presentation also explored the sanctions applicable to breaches of regulatory obligations and the importance of periodic testing activities in assessing the effectiveness of cybersecurity safeguards, incident management procedures and organisational capabilities to promptly identify, classify and respond to cybersecurity events.

The session provided a legal and operational overview of the principal responsibilities and challenges associated with cyber incident management, highlighting the importance of coordinated internal procedures, effective information flows and appropriate compliance documentation in ensuring regulatory compliance, timely incident reporting and organisational digital resilience.