ACN Incident: 24-Hour Notification Checklist

A cybersecurity incident can quickly turn into a race against time, especially when regulatory obligations are involved. Italy’s National Cybersecurity Agency (ACN) imposes strict deadlines for notifying significant incidents, often within 24 hours of detection. This isn’t just a bureaucratic requirement; it’s a fundamental mechanism for national security and the protection of critical assets. Timeliness and completeness of the notification are crucial: an error or delay can lead to penalties, reputational damage, and the loss of support opportunities from authorities. I’ve personally witnessed situations where the lack of a clear plan exacerbated the impact of an attack, transforming a technical problem into a management crisis. Preparation means having not only the right technical tools but also clear procedures and trained personnel. Read also: Fortinet PSIRT: Segmented Network Exposure Assessment

Tested on: ACN Directives · ACN Notification Form v2.0 · July 2026

Prerequisites / Test Environment

To effectively handle an ACN incident notification, several organizational and technical prerequisites are essential:

• Incident Response Plan (IRP): A well-defined IRP that includes specific procedures for managing and notifying cybersecurity incidents.
• Designated Security Team: A team with clear roles and responsibilities for incident detection, analysis, containment, and notification.
• Monitoring and Logging Tools: SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response) systems that enable rapid collection and analysis of logs and system activities.
• Access to the ACN Form: Have the latest version of the ACN Incident Notification Form readily available, preferably pre-filled with the organization’s static data. Download the Official ACN Form
• Communication Channels: Secure and rapid communication channels for transmitting information to ACN and for internal communications.

1. Assess Notification Obligation

The first, and most critical, step is to determine if the incident falls within the notification criteria established by ACN. Not all security incidents require notification. The criteria are based on the potential or actual impact on essential services or critical organizational functions. It is essential to consult ACN guidelines and NIS2 regulations (Art. 21, paragraph 3) to understand the scope. An incident causing a significant disruption of an essential service or compromising large-scale sensitive data is almost certainly subject to notification. Read also: NIS2 Healthcare: Scope & Real Compliance

An example of a criterion might be:

incident_severity:
  - high: { impact: "service_disruption_critical", data_compromise: "sensitive_large_scale" }
  - medium: { impact: "service_degradation_major", data_compromise: "personal_moderate" }
  - low: { impact: "minor_inconvenience", data_compromise: "none" }
notification_threshold:
  - "if severity is high or medium, notify ACN within 24 hours"
  - "if data_compromise includes sensitive_large_scale, notify ACN within 24 hours regardless of service impact"

2. Gather Essential Information

Once the notification obligation is established, you must urgently collect all information required by the ACN form. This includes technical details about the incident, its nature, estimated impact, exploited vulnerabilities, containment and mitigation actions already taken, and detection and notification timelines.

Here is a list of key information to gather:

• Date and time of incident detection: YYYY-MM-DD HH:MM:SS
• Incident type: (e.g., ransomware attack, data breach, DDoS attack, system compromise)
• Detailed description: What happened, how it was detected, which systems were involved.
• Estimated impact: Number of affected users/services, duration of outage, extent of data loss.
• Exploited vulnerabilities: CVEs or other technical information if known.
• Containment actions: Immediate measures taken to limit damage.
• Mitigation measures: Long-term actions to restore and prevent future incidents.
• Organization contacts: Technical and legal points of contact.

# Example script to gather basic information (pseudocode)
# Replace with actual commands for your environment (e.g., SIEM queries, EDR reports)

# Get current timestamp for detection time
detection_time=$(date +"%Y-%m-%d %H:%M:%S")

# Query SIEM for incident type and affected systems
incident_type=$(siem_query "incident_type_latest")
affected_systems=$(siem_query "affected_systems_latest")

# Get details from EDR for exploited vulnerabilities
vulnerabilities=$(edr_report "vulnerabilities_exploited")

# Log initial containment actions
containment_actions="Isolated affected servers, blocked malicious IPs"

# Output gathered information (for ACN form)
echo "Date and Time of Detection: $detection_time"
echo "Incident Type: $incident_type"
echo "Affected Systems: $affected_systems"
echo "Exploited Vulnerabilities: $vulnerabilities"
echo "Containment Actions: $containment_actions"

Common Errors and Troubleshooting

Missing or Incomplete Information: The most frequent error is submitting a notification with insufficient details. ACN requires specific technical and operational data to assess the incident. Always cross-reference your collected data with the ACN form fields before submission.

Delayed Notification: Missing the 24-hour window is a critical compliance failure. Implement automated alerts and clear escalation paths in your IRP to ensure immediate awareness and action. Practice incident scenarios regularly to reduce response times.

Incorrect Incident Classification: Not all security events are ACN-notifiable incidents. Misclassifying an event can lead to unnecessary notifications or, worse, failing to notify a critical one. Refer strictly to ACN guidelines and NIS2 criteria for classification.

Lack of Preparedness: Relying on ad-hoc processes during a crisis. Ensure your team is trained, your IRP is up-to-date, and all necessary tools (SIEM, EDR, communication channels) are functional and accessible. Conduct tabletop exercises to simulate real-world scenarios.

Conclusions with Operational Takeaways

Complying with ACN’s 24-hour incident notification requirement is a significant challenge for any organization, but it is non-negotiable for critical infrastructure and essential service providers. My experience shows that proactive preparation is the only way to meet these stringent deadlines effectively. Operational takeaways:

1. Develop a Robust IRP: Your Incident Response Plan must explicitly detail ACN notification procedures, roles, and responsibilities. Test it frequently.
2. Automate Information Gathering: Leverage SIEM, EDR, and automation scripts to quickly collect the required technical data. Every minute counts.
3. Train Your Team: Ensure your security team understands the ACN criteria, the notification process, and how to fill out the form accurately under pressure.
4. Maintain Communication Channels: Establish secure, reliable communication paths with ACN and internal stakeholders well in advance.
5. Regularly Review Guidelines: ACN and NIS2 guidelines can evolve. Stay updated on the latest requirements to avoid compliance gaps.

By embedding these practices into your cybersecurity posture, you transform a daunting regulatory obligation into a streamlined, effective component of your overall incident response strategy, minimizing risks and potential penalties.