In brief
The Ministry of Infrastructure and Transport (MIT) circular “Sicurezza della Navigazione” General Series no. 177/2025 of 16 December 2025 has been in force since 1 November 2026 and repeals SG 155/2019. It covers ships, companies and port facilities. For port facilities, it requires an annex on cyber risk assessment to be added to the PFSA and the resulting procedures to be included in the PFSP.
The ISPS Code already counted communication and IT systems among the vulnerabilities to be assessed in the PFSA (Part B, 15.3.5). What is new is that the circular now says how to do it, who is responsible for it and how it is verified.
What it requires of port facilities
| Paragraph | Requirement |
|---|---|
| §5.5 | Cyber annex to the PFSA: systems and networks linked to physical vulnerabilities, mitigation and recovery plan for each vulnerability, links with the PFSP, continual improvement |
| §5.4 | Appointment of the CyPFSO, responsible for the cyber protection of the facility |
| §7 | Basic cyber training for those who use critical systems, specific training for OT users |
| §8 | Testing of cyber knowledge in at least one of the scheduled drills or exercises, coordinated by the PFSO and the CyPFSO |
| §9 | Cyber aspects within ISPS audits |
| §10 | Reporting of the facility’s cyber incidents |
If the facility is already a NIS2 entity
For a facility subject to Legislative Decree 138/2024, the circular considers compliance with NIS2 legislation suitable to satisfy Regulation (EC) 725/2004 and the ISPS Code as well. A second risk assessment is therefore not needed: the PFSA and PFSP must, however, refer expressly to the NIS2 assessment and measures, and the content is consolidated at the next five-yearly review.
In the text, the 31 December 2026 deadline for addenda to the plans in force appears after the rules for facilities not subject to NIS2; for those subject to it, the NIS2 deadlines apply. For entities added to the list in 2025, the deadline for the basic measures is 18 months from the notice of inclusion (ACN Determination 379907/2025, confirmed by Determination 127434/2026), so in many cases it has already passed. The prudent advice is therefore to complete the reference by 31 December 2026 and to confirm the interpretation with the Designated Authority.
The new role: the CyPFSO
Together with the PFSO, the CyPFSO contributes to the cyber annex to the PFSA and to the cyber procedures of the PFSP, and delivers and updates the cyber training of personnel. The CyPFSO works with the PFSO, who remains the owner of the PFSP; the PFSA is approved by the Designated Authority. A facility subject to NIS2 must also appoint one, and may assign the role to a NIS2 figure already appointed. The CyPFSO must hold one of the qualifications listed in §7, point 3, of the circular (for example ISO/IEC 27001 Lead Auditor or Lead Implementer, IEC 62443, GICSP, CISA); if the CyPFSO is not the PFSO, they must also complete the “Duties” course (IMO Model Course 3.24).
Incident reporting
For the facility’s cyber incidents, from 1 January 2026 the circular no longer applies the previous security circular no. 45: Legislative Decree 138/2024 is followed, and MIT – Office 3 Maritime Security and the port’s Designated Authority are also informed without delay.
For a facility that is also included in the Perimeter, what matters is which system is involved. If the incident concerns an ICT asset of the Perimeter, it is notified under DPCM 81/2021, and this notification also fulfils the NIS2 obligation (Art. 33 of Legislative Decree 138/2024). For other systems, the NIS2 notification applies.
| Recipient | When | Deadline | Source |
|---|---|---|---|
| CSIRT Italia – PSNC | Incident on an ICT asset of the Perimeter | 6 hours or 1 hour, according to the table | DPCM 81/2021, Art. 3 |
| CSIRT Italia – NIS2 | Significant incident on other systems | early warning 24 hours, notification 72 hours, final report within one month | Leg. Decree 138/2024, Art. 25 |
| MIT Maritime Security and the port’s Designated Authority | Cyber incident at the facility | without delay | SG 177/2025, §10 |
In practice, a single internal report works best: staff immediately alert the PFSO and the CISO, and it is the CISO and the CSIRT contact person who decide which external notifications are needed and meet their deadlines.
Not theory: three cases
- 2017, NotPetya. Seventeen terminals of APM Terminals, a Maersk group company, including Rotterdam and Los Angeles, were closed or severely slowed down because the group’s IT systems were out of action.
- 2022, Oiltanking and Mabanaft. An attack took down the IT systems of Oiltanking Deutschland, whose 11 fuel terminals in Germany operated at reduced capacity.
- 2023, Port of Nagoya. Ransomware attributed to LockBit 3.0 halted the container terminal from Tuesday morning until the restart expected on Thursday.
Where to start
- Appoint the CyPFSO and name them in the PFSA.
- Identify the systems linked to physical vulnerabilities: access control, CCTV, intrusion detection, communications, process OT.
- Write the cyber annex to the PFSA, with a reference to the NIS2 assessment, and the cyber procedures of the PFSP.
- Train personnel with security duties before they take up their post.
- Dedicate one of the quarterly drills to a cyber scenario and record it like the others.
How we can help
We support port facilities with the cyber annex to the PFSA, the PFSP procedures, training for personnel with security duties and joint cyber exercises. From 26 November 2026 we can take on the CyPFSO role directly.
The service for port facilities →Sources
MIT circular “Sicurezza della Navigazione” SG no. 177/2025 of 16/12/2025 (full text); Legislative Decree 138/2024, Arts. 23, 24 and 25; DPCM 14 April 2021, no. 81, Art. 3 (text in force); ACN Determinations no. 379907 of 19/12/2025 and no. 127434 of 13/04/2026; IMO MSC-FAL.1/Circ.3/Rev.3; ISPS Code, Part B; for the cases: Maritime Executive (Maersk, 2017), CyberScoop (Oiltanking, 2022), Dark Reading (Nagoya, 2023). Legislative Decree 138/2024, Art. 33. Texts checked on 3 November 2026. This article is for information only and does not replace reading the circular or consulting the Designated Authority.