--- title: "ACN NIS Platform Roles & Access" description: "ACN NIS platform roles: point of contact, substitute, CSIRT contact, segreteria, operator. Access via CIE/SPID, user census, association workflow, designation deadlines." canonical: https://www.aegister.com/en/cms/insights/acn-nis-platform-roles-access-user-association/ url: /en/cms/insights/acn-nis-platform-roles-access-user-association/ lang: en --- ![](/static/images/header-contact.webp) # ACN NIS Platform Roles, Access, and User Association --- ![ACN NIS Platform Roles, Access, and User Association](/static/images/cms/nis2-piano-implementazione-18-mesi.webp) ## ACN NIS Platform Roles, Access, and User Association April 15, 2026 [Determinazione 127437/2026](/en/cms/keyword/determinazione-1274372026/) [ACN platform](/en/cms/keyword/acn-platform/) [digital domicile](/en/cms/keyword/digital-domicile/) [NIS compliance](/en/cms/keyword/nis-compliance/) +6 The ACN platform determination makes one point very clear: NIS compliance on the portal is not just about having credentials. It is a governed role model. The determination distinguishes between the **point of contact**, the **substitute point of contact**, **CSIRT contact**, **segreteria**, and **operator** roles, and it defines who can access, who can transmit, who must be validated by the subject, and which deadlines apply to role designation. In practice, this means that organizations should set up role ownership and association flows before they start treating the portal as a filing tool ([ACN platform determination](https://www.acn.gov.it/portale/documents/d/guest/detacn_piattaformanis_251218-v9_signed), [ACN news page](https://www.acn.gov.it/portale/w/nis-online-le-determine-sugli-adempimenti-per-i-nuovi-soggetti-e-sulle-modalita-di-accesso-alla-piattaforma-acn)). ## Key Takeaways - Users access the ACN portal through personal **CIE** or **SPID**, with a dedicated fallback procedure for cases where those credentials are not available under applicable rules. - The **point of contact** is the main accountable role for registration and interaction with the ACN NIS authority. - The **substitute point of contact** can perform the same platform actions as the point of contact, except the initial registration. - The **CSIRT contact** is designated through the portal and is the role responsible for interacting with CSIRT Italia and carrying out incident notifications. - Additional users can be invited as **operators**, and at most one user can be assigned as **segreteria**. - Association of the point of contact to the subject is validated through the subject's digital domicile. ## Scope of This Article This article covers: - who the core platform roles are, - how user census works, - how association to the subject is performed, - which roles can and cannot transmit official communications, - which role-specific deadlines matter for newly listed subjects. This article does not cover: - annual-update data sets in depth, - relevant-supplier filing logic, - categorizzazione workflow, - screenshots or click-by-click private account instructions. ## The Core Role Model Defined by ACN The determination defines a structured role model rather than a generic multi-user portal. | Role | Core function | What matters operationally | | --- | --- | --- | | Point of contact | Main role responsible for implementing NIS provisions for the subject and interacting with ACN | Handles portal access, registration, and official interaction with the NIS authority. | | Substitute point of contact | Support and backup role for the point of contact | Can perform the same platform actions as the point of contact, except the initial registration. | | CSIRT contact | Incident-interaction role designated by the point of contact | Interacts with CSIRT Italia and handles incident notifications under Articles 25 and 26. | | CSIRT substitutes | Backup support for the CSIRT contact | Can act in support of or in place of the CSIRT contact. | | Segreteria | Single support role that can be invited by the point of contact | Useful for coordination, but still distinct from the accountable transmission roles. | | Operator | Invited support user | Can operate in the portal but cannot trigger official transmissions reserved to the core accountable roles. | ## Point of Contact: Who Can Hold the Role ACN does not treat the point of contact as a generic mailbox owner. The determination describes it as a natural person designated by the NIS subject to oversee implementation of the NIS rules for that subject. The role can be held by: - the legal representative of the subject, - one of the general attorneys of the subject, - an employee delegated by the legal representative, - in group structures, an employee of another group company that falls within NIS scope and is delegated by the subject's legal representative, - in certain public-administration cases, authorized staff of another public administration within NIS scope, if delegated by the legal representative. The point of contact must report directly to the top hierarchical level and to the governing and management bodies of the NIS subject. ACN also states that the responsibilities of governing and management bodies remain in place under the NIS decree, so the point of contact does not replace board accountability ([ACN platform determination](https://www.acn.gov.it/portale/documents/d/guest/detacn_piattaformanis_251218-v9_signed), [Gazzetta Ufficiale - Legislative Decree 138/2024](https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG)). ## Substitute Point of Contact: Deadline and Function The substitute point of contact is distinct from the point of contact and is designated with the same eligibility logic. Its practical value is continuity: it supports the point of contact, may interact directly with the NIS authority, and may perform the same platform actions except the initial registration. The determination adds an explicit timing rule: - the substitute point of contact must be designated by **31 May** of the year in which the subject is inserted into the NIS list. For a subject first inserted into the NIS list during **2026**, this means the substitute role should be in place by **31 May 2026**. The only carve-out is material impossibility where the point of contact is the only natural person operating in the organization. ## CSIRT Contact and Substitutes The determination also separates the incident-notification chain from the general platform-access chain. | Role | Designation rule | Core responsibility | | --- | --- | --- | | CSIRT contact | Designated by the point of contact through the portal | Interacts with CSIRT Italia and performs incident notifications under Articles 25 and 26. | | CSIRT substitute(s) | Can be designated with the same portal procedure | Supports the CSIRT contact and can act on its behalf. | The relevant deadline is explicit: - the CSIRT contact must be designated by **31 December** of the year in which the subject is inserted into the NIS list. For newly listed **2026** subjects, that means **31 December 2026**. ACN also requires that the CSIRT contact and substitutes have at least basic cybersecurity and incident-management competence and a deep knowledge of the subject's information and network systems. ## User Census: How Access Starts Before any role can operate for a subject, ACN requires a census phase. ### Authentication method Users authenticate on the ACN portal through: - personal **CIE**, - personal **SPID**. Where a user cannot legally or materially have SPID or CIE under the applicable rules, ACN allows personal credentials through a dedicated procedure published on the site. ### User profile data During census, users complete their profile if the information is not already shared through CIE or SPID. The required data includes at least: - name and surname, - tax code or national identification code where applicable, - place and date of birth, - citizenship, - country of residence and, where required, domicile, - main service, company, or professional office address, - ordinary email, - PEC where available, - telephone number and, where available, an alternate number, - name and tax code of the main organization of affiliation. This is important from a governance standpoint because the ACN model treats users as identified natural persons acting for a subject, not anonymous shared credentials. ## How Association to the Subject Works After census, the role has to be associated with the subject. ### Point of contact association The point of contact associates its user account with the designated subject by entering: - the subject's tax code, or - the IPA code where relevant. During this process, the user: - verifies the subject denomination, registered-office address, digital domicile, and contact details shown by the portal, - indicates whether the user is the legal representative, a general attorney, or a delegate of the legal representative, - indicates the tax code of the employing organization if it differs from the associated subject, - states the role performed within the subject. If the user acts as a delegated person, the delegation must be uploaded to the portal and the user must declare that it authorizes access to the ACN portal and NIS services on behalf of the subject. ### Validation and completion The association of the point of contact is not final immediately. It is: - submitted for validation by the subject, - validated through the procedure indicated in the request sent to the subject's digital domicile, - followed by a completion communication sent to that digital domicile. The determination also states that validation of a new point-of-contact association causes dissociation of any previously associated point-of-contact account. ### Substitute association The substitute point of contact is associated on invitation by the point of contact and follows the same association mechanics. ## Operators and Segreteria: What They Can and Cannot Do The determination allows the point of contact to invite: - additional users as **operators**, - at most one user as **segreteria**. That invitation logic matters because it creates a controlled support layer without transferring full accountability. ACN says that users who are not designated and associated as point of contact or substitute: - are associated to the subject on indication and invitation of the point of contact, - cannot perform actions on the portal that send communications to the subject's digital domicile or to the NIS competent authority in order to finalize NIS obligations. All users can cancel their own association and disable their account. The point of contact, substitute point of contact, and segreteria can also reduce their role to operator. ## Governance Risks Organizations Should Avoid Most implementation friction does not come from the login itself. It comes from role design mistakes. ### Common setup failures - assigning the point of contact without a valid delegation chain, - delaying substitute designation beyond the applicable deadline, - treating CSIRT-contact designation as optional when the notification track is approaching activation, - using generic shared addresses without a clear natural-person ownership model, - forgetting that validation depends on the subject's digital domicile workflow. ### Practical control actions 1. Identify the natural person who will hold point-of-contact accountability and document the legal basis. 2. Prepare substitute designation in the same workstream instead of leaving it as a later administrative task. 3. Assign CSIRT-contact ownership before the notification track becomes active. 4. Reconcile email, PEC, phone, and organization-affiliation data before census starts. 5. Test digital-domicile validation readiness so the association process does not stall at approval time. This is the point where a structured implementation partner can add value: not by replacing the ACN process, but by ensuring that legal authority, governance accountability, and operational roles are aligned before the filing windows become active. ## FAQ ### Can the substitute point of contact perform the initial registration? No. ACN states that the substitute can perform the same platform actions as the point of contact except the registration under Article 7 of the NIS decree. ### By when must the substitute point of contact be designated? By **31 May** of the year in which the subject is inserted into the NIS list. ### By when must the CSIRT contact be designated? By **31 December** of the year in which the subject is inserted into the NIS list. ### Can operators finalize official NIS communications through the portal? No. Users associated only as operators or similar support users cannot finalize the transmissions that complete NIS obligations toward the authority or the subject's digital domicile. ### What identity methods does ACN require for portal access? The default methods are personal **CIE** and **SPID**, with a dedicated fallback procedure for users who cannot obtain those credentials under the applicable rules. ## Conclusion The ACN platform role model is a governance design, not just an access-control configuration. Organizations that set up the point of contact, substitute, CSIRT contact, and support users in a controlled way will move faster through registration and ongoing platform duties. Organizations that leave role design unresolved will usually discover the problem only when validation, delegation, or incident-readiness actions are already late. ## Official Sources - [ACN - Determinazione 127437/2026 sulle modalita di utilizzo e accesso alla piattaforma ACN](https://www.acn.gov.it/portale/documents/d/guest/detacn_piattaformanis_251218-v9_signed) - [ACN - NIS: online le determine sugli adempimenti per i nuovi soggetti e sulle modalita di accesso alla piattaforma ACN](https://www.acn.gov.it/portale/w/nis-online-le-determine-sugli-adempimenti-per-i-nuovi-soggetti-e-sulle-modalita-di-accesso-alla-piattaforma-acn) - [Gazzetta Ufficiale - Decreto Legislativo 138/2024](https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG) Share this post ## Related News [![ACN NIS Platform: Registration, Annual Update, and Continuous Update](/static/images/cms/nis-registrazione-2026-scadenza.webp)](/en/cms/insights/acn-nis-platform-registration-annual-continuous-update/) [ACN NIS Platform: Registration, Annual Update, and Continuous Update](/en/cms/insights/acn-nis-platform-registration-annual-continuous-update/) [The ACN NIS platform operates a recurring compliance cycle: registration (1 January-28 February), annual update (15 April-31 May), and continuous update until 14 April of the following year. Governing and management bodies remain responsible for supervision under Article 23 of Legislative Decree 138/2024.](/en/cms/insights/acn-nis-platform-registration-annual-continuous-update/) [Determinazione 127437/2026](/en/cms/keyword/determinazione-1274372026/) [ACN platform](/en/cms/keyword/acn-platform/) +8 [![NIS Representative in Italy: When It Is Needed and How the Designation Works](/static/images/cms/nis-2-compliance.webp)](/en/cms/insights/nis-representative-italy-designation-process/) [NIS Representative in Italy: When It Is Needed and How the Designation Works](/en/cms/insights/nis-representative-italy-designation-process/) [The Italy-based NIS representative is a specific cross-border compliance mechanism for legal persons with no EU establishment that perform the inherently cross-border activities listed in Article 7(5) of Legislative Decree 138/2024. Designation package is transmitted to ACN yearly from 1 September to 30 November.](/en/cms/insights/nis-representative-italy-designation-process/) [ACN](/en/cms/keyword/acn/) [Determinazione 127437/2026](/en/cms/keyword/determinazione-1274372026/) +8 [![ACN NIS Platform: Activity and Service Categorization](/static/images/cms/nis2-piano-implementazione-18-mesi.webp)](/en/cms/insights/acn-nis-platform-activity-service-categorization/) [ACN NIS Platform: Activity and Service Categorization](/en/cms/insights/acn-nis-platform-activity-service-categorization/) [Articles 20 and 21 of ACN Determinazione 127437/2026 define the procedural side of activity and service categorization on the NIS platform: window 1 May-30 June, submission by the point of contact, sample-based review by ACN within 90 days. The categorization-model determination was still pending as of 15 April 2026.](/en/cms/insights/acn-nis-platform-activity-service-categorization/) [Determinazione 127437/2026](/en/cms/keyword/determinazione-1274372026/) [ACN platform](/en/cms/keyword/acn-platform/) +8