Italian National Cybersecurity Agency: new taxonomy of cyber incidents published in Official Gazette.

The National Cybersecurity Agency ('ACN') announced, on 13 January 2023, that a new taxonomy of incidents that must be notified was published, on 10 January 2023, in the Official Gazette. In particular, the ACN reminded that Article 1(3-bis) of Decree Law No. 115 of 9 August 2022, as converted into law by Law No. 142 of 21 September 2022, imposes a new obligation to notify, within 72 hours, the ACN of all incidents affecting entities within the existing National Cybersecurity Perimeter, even if they do not directly affect assets specifically included in the same. Further to this, the ACN explained that it had developed a new taxonomy of said additional types of cyber incidents to facilitate the notification and impact assessment process.

Notably, the taxonomy is set to take effect on the 15th day following its publication in the Official Gazette, namely on 25 January 2023.