ACN Adopts Incident Taxonomy Under Law 90/2024: What Obligated Entities Must Do Now

ACN adopted the incident taxonomy under Law 90/2024 via the Determina of 9 February 2026. Obligated entities must now report incidents within 24 hour…

NIS2 Point of Contact and CSIRT Contact Role: Accountability and Operating Duties

NIS2 implementation guidance distinguishes the legal Point of Contact from the operational CSIRT contact role. Practical guide to role formalization,…

NIS2 Significant Incident IS-3: Violation of Expected Service Levels

IS-3 in the ACN baseline model covers service-level violation incidents affecting entity services and activities. Practical guide to qualification, s…

NIS2 Significant Incident IS-2: Integrity Loss Affecting Digital Data

IS-2 in the ACN baseline model covers integrity loss affecting digital data under entity ownership or control. Practical guide to qualification, evid…

NIS2 Significant Incident IS-1: Confidentiality Loss Affecting Digital Data

IS-1 in the ACN baseline model covers confidentiality loss affecting digital data under entity ownership or control. Practical guide to qualification…

NIS2 Incident Typology Model: Condition, Compromise, and Affected Object

ACN baseline guidance classifies significant incidents through condition, compromise, and object of compromise. Practical guide to using the typology…