August 31, 2026
In recent years, Cyber Risk Management has undergone a profound transformation, driven by regulatory developments and steadily increasing technological complexity. Together, these forces have expanded organizations’ […]
For all NIS2 entities included in the 2025 list, the designation of the CSIRT Representative was completed on 31 December. In 2026, the focus shifted to ensuring that the role is fully operational within the incident management process. Meanwhile, the framework established by ACN has become more consolidated. For entities entering the NIS2 scope in 2026, the designation must be completed by 31 December 2026, while the notification obligation will apply from 1 January 2027.
With the implementation of the NIS2 Directive, cyber incident management requires a structured organisational approach, in which the CSIRT Representative acts as the operational point of contact for managing incident notifications.
During 2026, ACN further consolidated the operational framework through new guidance dedicated to incident management, formally integrating the CSIRT Representative into the cybersecurity organisation of NIS entities.
The role becomes particularly relevant when an event is detected and must be assessed, as the effectiveness of the notification process depends on the Representative’s ability to rapidly access the information produced during the incident analysis.
The CSIRT Representative is the person appointed to liaise with CSIRT Italia and manage the required notifications. The Point of Contact, on the other hand, manages the broader relationship with ACN in connection with NIS2 compliance requirements.
In smaller organisations, the two roles may be assigned to the same person, provided that the requirements established for the Point of Contact are met. Maintaining a clear distinction between the two functions remains useful for defining how information is managed during an incident and how communications with CSIRT Italia are handled.
Management bodies also retain the responsibilities established under the NIS framework and must receive appropriate information regarding relevant incidents.
The CSIRT Representative must combine advanced technical expertise with a strong understanding of the organisation.
Experience in incident response, digital forensics, threat intelligence and SOC management is required, together with knowledge of international standards and frameworks such as:
NIS2 establishes a three-stage procedure for the notification of significant incidents:
The CSIRT Representative coordinates this process: receiving and classifying the event, coordinating technical teams, communicating with the CISO, DPO and management, and overseeing containment activities.
The role operates in close coordination with the SOC, whether internal or external, and with telemetry and correlation platforms such as SIEM, SOAR and MISP, ensuring information consistency throughout the entire decision-making chain.
The organisational positioning of the CSIRT Representative depends on the organisation’s structure and its security management model. The role may be assigned to an internal resource or to an external party, provided that the person has sufficient knowledge of the organisational context and can access the information required during an incident.
It is essential to define how the Representative is integrated into incident management: when the role must be activated and how information is provided, so that notifications can be managed while technical activities are still ongoing.
This coordination becomes even more important when security activities are partially managed by external providers, as delays in transferring information may directly affect notification timelines.
In 2026, the role of the CSIRT Representative entered a different phase compared with the initial implementation period of NIS2. For many organisations, the designation process has already been completed, and attention is now shifting towards how effectively the role operates during an actual incident.
The Representative’s ability to meet the required timelines depends on the connection with the teams managing the event and on having access to relevant information while the technical investigation is still underway.
For organisations that have already completed the designation process, the key issue in 2026 is therefore the effective integration of the CSIRT Representative into the organisation’s incident management framework.
The quality of this integration directly affects the organisation’s ability to maintain timely communication with CSIRT Italia while it is still assessing the scope and impact of the incident.
ai.esra SpA – strada del Lionetto 6 Torino, Italy, 10146
Tel +39 011 234 4611
CAP. SOC. € 50.000,00 i.v. – REA TO1339590 CF e PI 13107650015
“This website is committed to ensuring digital accessibility in accordance with European regulations (EAA). To report accessibility issues, please write to: ai.esra@ai-esra.com”
ai.esra SpA – strada del Lionetto 6 Torino, Italy, 10146
Tel +39 011 234 4611
CAP. SOC. € 50.000,00 i.v. – REA TO1339590
CF e PI 13107650015
© 2024 Esra – All Rights Reserved
