ACN's Resolution No. 136118 of 10 April 2025 – Notification of agreements on the sharing of cybersecurity information pursuant to Article 17 of the NIS Decree (“Resolution 136118”) sets out the procedures whereby NIS entities that are a party to (cybersecurity information) sharing agreements must notify the ACN of their participation in such agreements.
Sharing agreements are governed by Article 17 of Legislative Decree No. 138/2024 and concern the (voluntary and optional) sharing between NIS entities or between NIS entities and other entities (e.g. suppliers of NIS entities) of information relating to cybersecurity, such as cyber threats, near misses, vulnerabilities, techniques and procedures, security alerts, etc. Such agreements are functional to the prevention of incidents as well as to the management, containment and mitigation of their consequences, and contribute to raising collective cybersecurity standards.
The participation of a NIS entity in one or more sharing agreements must be notified to the ACN via the service portal, providing the text of the agreement and indicating its name and the list of the entities that are a party to it.
As regards the notification deadlines, for agreements entered into after the entry into force of Legislative Decree 138/2024 (i.e. after 16 October 2024), notification must be made promptly and therefore at the same time or immediately after the conclusion of the agreement. In any event, sharing agreements signed before the entry into force of Legislative Decree 138/2024 (and still in force on 31 May 2026) must be notified by 31 May 2026.
The list of sharing agreements to which the NIS entity is a party notified to the ACN must always be checked and updated over time: in particular, pursuant to Resolution 136118, any changes (e.g., the signing of a new agreement, the termination of an agreement in place, or changes to the text or parties to the agreement) must be notified to the ACN within 14 days of the date of the change.
The list of sharing agreements must be updated at least once a year: between 15 April and 31 May of each year, NIS entities shall update, again via the portal, the list of sharing agreements to which they are a party.
Should you need any assistance and support in complying with the obligations under the NIS regulations, please contact your professional advisors.
