If your company has 50 or more staff and works in energy, health, transport, manufacturing, digital services or a dozen other sectors, the EU’s NIS2 Directive probably applies to you. In Italy, the deadline for first-wave entities to have their basic security measures in place falls this month.
This guide explains what NIS2 is, who it covers, what it requires and how it is enforced, with a closer look at Italy.
This is general guidance, not legal advice.
What is the NIS2 Directive?
NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaced the original NIS Directive (2016/1148), which had left too many gaps: different countries applied it to different organisations, and many critical sectors were outside it altogether.
Because it is a directive, NIS2 does not apply directly. Each member state had to write it into national law. Article 41 set the transposition deadline at 17 October 2024, with national measures applying from 18 October 2024. Member states also had to establish a list of essential and important entities by 17 April 2025 (Article 3(3)).
NIS2 rests on four pillars:
- Risk management: every in-scope entity must take appropriate and proportionate security measures (Article 21).
- Incident reporting: significant incidents must be reported on a fixed timeline (Article 23).
- Governance: management bodies approve the measures, oversee them, can be held liable and must be trained (Article 20).
- Supervision and enforcement: national authorities get real powers, including large fines (Articles 31–36).
Who is in scope: sectors and size
Two tests decide whether NIS2 applies to you: your sector and your size.
Annex I and Annex II sectors
The directive lists sectors in two annexes. Annex I covers “sectors of high criticality”; Annex II covers “other critical sectors”.
| Annex I: sectors of high criticality | Annex II: other critical sectors |
|---|---|
| Energy (electricity, district heating and cooling, oil, gas, hydrogen) | Postal and courier services |
| Transport (air, rail, water, road) | Waste management |
| Banking | Manufacture, production and distribution of chemicals |
| Financial market infrastructures | Production, processing and distribution of food |
| Health | Manufacturing (e.g. medical devices, electronics, machinery, motor vehicles) |
| Drinking water | Digital providers (online marketplaces, search engines, social networks) |
| Waste water | Research |
| Digital infrastructure (e.g. DNS, TLD registries, cloud, data centres, CDNs, trust services) | |
| ICT service management, business-to-business (managed service and managed security service providers) | |
| Public administration | |
| Space |
Banks and financial market infrastructures are listed in Annex I, but in practice most of their ICT risk obligations come from DORA, which is the more specific law for the financial sector. Our upcoming DORA explainer and NIS2 vs DORA vs GDPR comparison cover how the two interact.
The size-cap rule
Under Article 2(1), NIS2 applies to entities in an Annex I or II sector that qualify as medium-sized enterprises or larger under Commission Recommendation 2003/361/EC. In broad terms, that means at least 50 employees, or annual turnover or balance sheet total above EUR 10 million.
There are important exceptions. Article 2(2) brings in some entities regardless of size, including trust service providers, TLD name registries, DNS service providers, providers of public electronic communications networks or services, and entities that are the sole provider in a member state of a service essential to society or the economy. Member states can also designate smaller entities if a disruption would have a significant impact.
Essential vs important entities
Once you are in scope, you are either an essential or an important entity (Article 3). The obligations are the same. What differs is how you are supervised and the maximum fine.
| Essential entities | Important entities | |
|---|---|---|
| Typical profile | Annex I entities that exceed the medium-sized ceilings (large companies), plus specific categories such as qualified trust service providers, TLD registries, DNS providers and central government bodies | Annex I or II entities in scope that are not essential (typically medium-sized Annex I entities and all in-scope Annex II entities) |
| Security measures (Art. 21) and reporting (Art. 23) | Yes | Yes |
| Supervision | Proactive (ex ante): audits, on-site inspections, security scans, information requests (Art. 32) | Reactive (ex post): triggered by evidence or indications of non-compliance (Art. 33) |
| Maximum administrative fine (Art. 34) | At least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher | At least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher |
| Temporary ban on managers | Possible as a last resort (Art. 32(5)(b)) | Not provided for in Art. 33 |
Key obligations
Article 21: cybersecurity risk-management measures
Article 21(1) requires “appropriate and proportionate technical, operational and organisational measures” to manage risk and to limit the impact of incidents. Proportionality matters: the measures must reflect your exposure, size, and the likelihood and severity of incidents.
Article 21(2) then sets a minimum list, based on an “all-hazards” approach:
- Risk analysis and information system security policies
- Incident handling
- Business continuity, including backup management, disaster recovery and crisis management
- Supply chain security, including relationships with direct suppliers and service providers
- Security in acquisition, development and maintenance of systems, including vulnerability handling and disclosure
- Policies and procedures to assess the effectiveness of the measures
- Basic cyber hygiene practices and cybersecurity training
- Policies on cryptography and, where appropriate, encryption
- Human resources security, access control policies and asset management
- Multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency communications, where appropriate
For supply chain security, Article 21(3) adds that you must consider each direct supplier’s vulnerabilities, product quality and security practices, including secure development. If you find a gap, Article 21(4) requires corrective measures without undue delay.
For certain digital entities (cloud, data centres, managed service providers, DNS, online marketplaces and others), Commission Implementing Regulation (EU) 2024/2690 spells out the technical requirements in detail. ENISA’s technical implementation guidance (June 2025) maps those requirements to practical examples of evidence. Even if the regulation does not apply to you, it is a good benchmark. Our NIS2 compliance checklist walks through each measure and the evidence auditors expect.
Article 23: incident reporting
You must notify your national CSIRT or competent authority of any significant incident without undue delay. An incident is significant if it has caused, or can cause, severe operational disruption or financial loss to you, or if it has affected or can affect others by causing considerable material or non-material damage (Article 23(3)).
The reporting timeline in Article 23(4) runs in stages:
| Stage | Deadline | What it contains |
|---|---|---|
| Early warning | Within 24 hours of becoming aware | Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have cross-border impact |
| Incident notification | Within 72 hours of becoming aware | Update of the early warning and an initial assessment, including severity, impact and indicators of compromise where available |
| Intermediate report | On request of the CSIRT or authority | Relevant status updates |
| Final report | No later than one month after the incident notification | Detailed description, type of threat or root cause, mitigation applied, and any cross-border impact |
| Progress report | If the incident is still ongoing at the one-month mark | A progress report then, and a final report within one month of handling the incident |
Where relevant, you must also inform the recipients of your services about significant incidents and any measures they can take. A personal data breach may also trigger a separate GDPR notification to your data protection authority, see our upcoming GDPR 72-hour breach notification guide. A tested incident response plan is what makes these deadlines achievable; our guide on incident response phases covers the basics.
Article 20: management accountability
Article 20(1) requires management bodies to approve the risk-management measures, oversee their implementation, and makes them liable for infringements of Article 21. Article 20(2) requires members of management bodies to follow cybersecurity training, and encourages entities to offer similar training to employees on a regular basis.
For essential entities, Article 32(6) adds that natural persons responsible for or legally representing the entity must have the power to ensure compliance and can be held liable for breaching their duties. As a last resort, Article 32(5)(b) allows authorities to request a temporary ban on a person at chief executive or legal representative level from exercising managerial functions. We cover what this means for boards in our upcoming guide to NIS2 management training.
Supervision and penalties
National authorities can carry out inspections and audits, request information and evidence, issue binding instructions, and order you to fix deficiencies within a deadline. Article 34 sets the floor for maximum fines: member states must allow fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher in each case. Member states can also impose periodic penalty payments to force compliance.
The fines get the headlines, but the more likely risk is an inspection that finds no documented risk assessment, no board approval and no tested incident process.
NIS2 in Italy: Legislative Decree 138/2024
Italy transposed NIS2 with Legislative Decree 4 September 2024, n. 138, published in the Gazzetta Ufficiale (Serie Generale n. 230) on 1 October 2024 and in force since 16 October 2024. It repealed Legislative Decree 65/2018, which had transposed the first NIS Directive.
The Agenzia per la Cybersicurezza Nazionale (ACN) is the national competent authority and single point of contact, and CSIRT Italia, part of ACN, receives incident notifications. Sector authorities work with ACN through a NIS implementation table.
How the Italian process works
Italy built its implementation around the ACN service portal. Every organisation that believes it is in scope must register, designate a punto di contatto (point of contact), and then wait for ACN to confirm whether it is essential, important or out of scope.
- Registration: each year between 1 January and 28 February, new entities register and listed entities update their registration. The first window opened on 1 December 2024 and closed on 28 February 2025; ACN allowed entities that had started the process to complete it until 10 March 2025.
- Inclusion communications: ACN began notifying organisations of their inclusion in the national NIS list on 12 April 2025. It reported more than 20,000 organisations in the list, over 5,000 of them essential.
- Annual information update: between 15 April and 31 May each year, entities provide or update the required information on the portal.
- CSIRT contact: first-wave entities had to designate a Referente CSIRT by 31 December 2025.
Key deadlines for first-wave entities
ACN’s basic obligations are set out in Determination 379907/2025, with separate annexes for important and essential entities. The clock runs from receipt of the communication of inclusion in the NIS list:
| Obligation | Deadline | Status at 19 October 2026 |
|---|---|---|
| Notify basic significant incidents to CSIRT Italia | 9 months from inclusion (January 2026) | In force |
| Adopt basic security measures | 18 months from inclusion (October 2026) | Due now |
| Next registration and update window | 1 January – 28 February 2027 | Upcoming |
Entities included in the list for the first time in 2026 follow a later timetable under Determination 127434/2026: designate the CSIRT contact by the end of 2026, notify basic significant incidents from 1 January 2027, and adopt basic security measures by July 2027.
In September 2026, ACN updated the list (covering over 2,000 late registrations and about 2,000 reviews) and opened a consultation on enhanced security measures that will integrate and replace the basic ones. Expect the bar to rise again after the basic phase.
Italian practice also makes governance concrete. ACN’s FAQs state that management bodies’ training and approval duties cannot be delegated, and that the board must approve the training plan required under the basic measures.
Transposition in other member states
Most member states have now transposed NIS2, but not all. On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition, and asked the Court to impose a lump sum and daily penalties. The Commission had sent letters of formal notice on 28 November 2024 and reasoned opinions on 7 May 2025. If you operate in several countries, check each national law, because registration processes, authorities and deadlines differ.
What to do next
- Confirm your status: map your services to Annex I/II and check the size rule, including any national designation.
- Register with your national authority where required (in Italy, during the January–February window).
- Run a gap assessment against Article 21(2) and your national measures. An existing ISO 27001 programme gives you a strong base, see our ISO 27001:2022 implementation roadmap.
- Build reporting readiness: define who decides what is significant, and rehearse the 24-hour early warning in a tabletop exercise.
- Train and brief the board, and record their approval of the measures.
AceFortis runs practical NIS2 training for IT, compliance and management teams, from scoping and Article 21 gap reviews to incident reporting drills. Get in touch to plan a session.
FAQ
Does NIS2 apply to small businesses?
Usually not. The size-cap rule excludes micro and small enterprises unless they fall into a category covered regardless of size (such as DNS providers or trust service providers) or a member state designates them. However, small suppliers often feel NIS2 indirectly, because in-scope customers must manage supply-chain risk.
Are the obligations different for essential and important entities?
The security and reporting obligations are the same. Essential entities face proactive supervision and higher maximum fines; important entities are supervised after the fact, when there are indications of non-compliance.
When does the 24-hour clock start?
From the moment you become aware of a significant incident. That is why you need a clear internal process to assess incidents quickly and escalate them to the person who decides on notification.
We registered in Italy in 2025. Do we need to do anything in 2027?
Yes. Listed entities must update their registration each year between 1 January and 28 February, and update their information between 15 April and 31 May.
Sources
- Directive (EU) 2022/2555 (NIS2) – EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690 – EUR-Lex
- ACN – NIS (Network and Information Security)
- ACN – Basic obligations and specifications
- European Commission – Referral of four member states over NIS2 transposition (8 July 2026)
- ENISA – NIS2 Technical Implementation Guidance
