Notify an incident to ACN

When something happens, the Cyber Console helps you decide whether it must be notified to CSIRT Italia, counts the legal deadlines and prepares each filing for the ACN portal. The filing itself is always yours: you send it from the ACN portal, the console never sends anything on your behalf. What you need: the NIS 2 incident notification licence on your organization, and the Security Officer or Owner role. The entity class (essential or important) comes from the NIS 2 section of your organization’s profile: it decides which significance criteria apply.

​

Where it is

Open vCISO → Incident Notifications in the side menu (app.aegister.com/V-Ciso/incidents/). Each incident is a card with its legal basis, its reference code (for example ACN-20261012-42), the next deadline and how ready the filing in progress is. How it works sums up the whole process; New incident opens a new one.

​

Create a new incident

A new incident takes three steps. Next stays disabled until the step is complete; the reason is shown beside it.

​

Step 1: What happened

• Start from a template (optional): pick a common case from Aegister’s catalogue (the templates are in Italian, like the portal). The template writes the description for you and highlights the parts you fill in: click one, or press Tab, and type. Delete the parts that do not apply.
• What happened: describe what you saw, when, and what is affected, in a few sentences. Aegister drafts the ACN form from this text.
• Detected at: when you became aware of the incident, with its Time zone (Europe/Rome by default). The legal clock starts here.
• When it happened (if known): leave it empty when it is not known yet.
• Evidence and indicators: add files (email headers, EDR reports, logs: PDF, Office documents or images, up to 10 MB each) and type the indicators you have, such as a domain, an IP address, a URL, a hash or an email address, then press Enter. Domains, addresses, URLs and hashes are checked against Threat Intelligence and show their risk level.

​

Step 2: Is it significant?

The console shows the significance criteria of ACN determination 379907/2025 for your entity class: Answer what you already know with Yes, No or Not sure. The AI reads your description and suggests an answer for each criterion with its reason; your answer always wins. If you change the description, Read it again asks the AI to read the new text.

​

Step 3: Notification

The verdict follows from the answers:

• At least one criterion is Yes: it is a significant incident and the notification is mandatory (art. 25 d.lgs. 138/2024). The console shows the dates of the pre-notification, the notification and the final report for this incident. Click Start the pre-notification.
• No criterion is Yes: notifying is not mandatory. Choose Voluntary notification (art. 26), with its ENISA type (Minaccia Cyber, Quasi incidente or Incidente), then Open the voluntary notification; or choose No notification: keep a record of the incident, then Record the incident.

If a criterion is still Not sure, the console warns you: if the answer turns out to be yes, the notification becomes mandatory with the 24-hour clock running from detection. The incident opens and, unless you only recorded it, the AI starts drafting the first filing at once.

​

The deadlines

For a mandatory notification the console counts the deadlines of art. 25 from the detection time you entered: The incident page shows the time left for the next filing, and says when it is overdue. A voluntary notification has no legal deadline.

​

The filings and their order

Each filing follows the ACN portal’s order:

1. Pre-notification: opens a mandatory case.
2. Notification (72 h): can start once the pre-notification is filed.
3. Interim report: can start once the notification is filed, as many times as CSIRT Italia asks.
4. Final report: can start once the notification is filed.

A voluntary case opens directly with the notification. Only one filing is in progress at a time: file it before starting the next. Each new filing starts from the last one you sent, so you only add what changed. The left column of the incident page lists the filings: the ones sent with their date and protocol number, the next ones with Start the notification, Start an interim report or Start the final report when they can start.

​

Complete the filing

The filing is shown field by field, section by section, as on the ACN portal (from C · Descrizione dell’incidente to N · Relazione finale, which appears in the final report only). The labels are the portal’s own Italian ones; with the console in English, an English line under each label explains it. Values save as you type. Each field carries a tag:

• AI draft: drafted by the AI. Check it.
• From the incident: comes from the incident itself, such as the reference code and the detection time. Change these in Incident details.
• You: your answer.
• Needs you: a required answer only you can give.

​

AI drafting

When a filing starts, the AI drafts every field it can know from the incident, in parts: Facts (services, impact, evidence, indicators), Classification (ACN taxonomy, IS codes, MITRE ATT&CK), Containment (actions taken and planned), Form text (sections C and E in Italian) and, for the final report, the final report’s texts. It runs in the background: you can keep working, and a value you type is never overwritten. When the description says nothing about a field, the AI leaves it empty rather than guess. Draft again with AI runs it again.

​

Readiness checks

The Before you transfer panel, on the right, lists what the filing still needs, and a click takes you to the field:

• the required answers still empty;
• the rules of the ACN taxonomy for this filing (for example at least one value, or one value for each predicate);
• IS-4 selected by an organization that is not an essential entity;
• a domain without its host part: the portal accepts a domain only with its host, such as www.example.com.

When nothing is missing, the panel says Ready for the portal.

​

Transfer the filing to the ACN portal

Click Transfer to ACN. The window explains each step with a short animation:

1. Install once: drag the Aegister → ACN button to your browser’s bookmarks bar. If you cannot see the bar, Can’t see your bookmarks bar? shows how to open it in your browser.
2. Copy the filing: click Copy for ACN. The whole filing goes to the clipboard as one block of text.
3. Open the portal and click the bookmark: click Open the ACN portal, sign in, and open the NIS report form (Apri segnalazione CSIRT → NIS → Nuova segnalazione; for a later filing, integrate the report already sent). Click Aegister → ACN in the bookmarks bar: a small panel opens on the portal. Press ⌘V or Ctrl+V there.

The bookmark types the filing into the portal’s fields. The fields it filled are outlined in blue, and the panel lists anything left for you to complete by hand.

​

Mark the filing as sent

Back in the console, click Mark as filed… (in the transfer window). Enter when you sent it on the ACN portal and the CSIRT protocol number the portal showed after sending: it ties the next filings to this one. Click Mark as filed. The filing then locks and becomes read only. Corrections go into the next filing, as on the portal. Once a filing has been sent, the detection time can no longer be changed.

​

Close the incident

When the incident is handled, click Close incident at the top of its page and enter when it was handled (between detection and now). A closed incident shows Closed on with the date, takes no new filings and its deadline reminders stop. Reopen brings back its deadlines and filings.

​

Exports and other views

• Export → PDF report or JSON: the filing on screen, in the portal’s order with the portal’s labels, to keep on file or share internally.
• Incident details: the description, the times and the significance answers.
• Evidence: the files attached to the incident; Add file adds more.
• History: when the incident was recorded and detected, when each filing started and was sent.

An incident that was never sent to ACN can be removed with Delete incident; its drafts and evidence are deleted too.