NIS2 Directive in Italy: obligations, deadlines, penalties

A practical guide to NIS2 compliance in Italy: who is affected, which obligations apply and which deadlines to meet in 2026 and 2027.

The NIS2 Directive (Directive (EU) 2022/2555) is the EU law that sets common cybersecurity obligations for organisations operating in critical and digital sectors. Italy transposed it through Legislative Decree 138/2024 (D.Lgs. 138/2024), in force since 16 October 2024, and supervision is entrusted to the Agenzia per la Cybersicurezza Nazionale (ACN, Italy’s National Cybersecurity Agency).

At a glance

• NIS2 broadens the range of organisations in scope compared with the original NIS Directive and strengthens obligations on risk management, governance and incident reporting.
• In Italy it was transposed by Legislative Decree 138/2024, in force since 16 October 2024; the competent authority is ACN, while incident notifications go to CSIRT Italia.
• Organisations are classified as essential or important entities: the classification changes the level of supervision and the penalty regime, not the existence of the obligations.
• For entities added to the national NIS list in 2025, incident reporting has been mandatory since January 2026 and basic security measures must be in place by October 2026; for entities added in 2026, the deadlines move to January and July 2027.
• Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month.
• Penalties can reach EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities.

Why NIS2 matters for Italian companies

The NIS2 Directive is a decisive step forward in the European cybersecurity framework. Together with the Cybersecurity Act, it redefines responsibilities, technical requirements and organisational obligations for companies operating in critical and digital sectors.

This is more than a regulatory update: NIS2 compliance requires a structured approach to cyber risk management, corporate governance and operational resilience. The obligations go beyond technical protection and call for an integrated governance model. Italian companies now need to combine:

• continuous monitoring systems;
• incident reporting procedures within 24 hours;
• business continuity and disaster recovery models;
• digital tools for traceability and evidence retention.

The goal is to strengthen cyber resilience across Europe, ensuring a secure digital supply chain and accountability at board level. For more on the European framework for ICT certification and security, see Intesa’s focus on the Cyber Security Act.

Transposition in Italy: Legislative Decree 138/2024

NIS2 was transposed into Italian law by Legislative Decree No. 138 of 4 September 2024, published in the Gazzetta Ufficiale on 1 October 2024 and in force since 16 October 2024. The decree confirms ACN as the national competent authority and single point of contact for NIS, and assigns CSIRT Italia to receive incident notifications.

Implementation is phased through ACN determinations. The most relevant for companies is ACN Determination 379907/2025, which sets out the basic security measures and the basic significant incidents to be reported.

Who falls under NIS2: essential and important entities

The NIS2 Directive significantly widens the scope of organisations subject to cybersecurity obligations compared with the original NIS Directive, introducing clearer criteria and two categories: essential entities and important entities. The classification determines the level of supervision by the national competent authority, the intensity of controls and the applicable penalty regime.

Size and sector criteria

NIS2 mainly applies to medium-sized and large companies operating in sectors considered strategic for Europe’s security and economic stability, including:

• energy;
• transport;
• banking and finance;
• digital infrastructure and cloud providers;
• healthcare;
• public administration;
• ICT service providers;
• digital services and online platforms.

In addition to the sector criterion, the directive sets size thresholds (number of employees and turnover), detailed in national transposition. As a general rule, companies with at least 50 employees, or with annual turnover and balance sheet total above EUR 10 million, are in scope. Some categories, such as qualified trust service providers, are essential entities regardless of their size.

In Italy, supervision is entrusted to ACN (Agenzia per la Cybersicurezza Nazionale), which identifies obliged entities, monitors compliance, receives and manages incident notifications, and exercises inspection and enforcement powers. For the European context of ICT certification and infrastructure security, see the focus on the Cyber Security Act.

Essential vs important entities: what changes in practice

Essential entities are typically operators in critical sectors with high systemic impact, cloud providers and core digital infrastructure, and organisations that are decisive for the continuity of essential services. They are subject to proactive ACN supervision, preventive inspections, stronger internal control obligations and a stricter penalty regime.

Important entities include companies with a significant but lower systemic impact. Supervision is mainly ex post: controls are triggered by incidents or reports, and penalties, while significant, are lower.

In both cases, appropriate technical and organisational measures, notification of significant incidents and documentation of the measures adopted remain mandatory. The difference lies not in whether the obligation exists, but in the level of regulatory exposure and the frequency of controls.

How to tell whether your company is in scope

For an initial self-assessment, check the following:

• ✔ Do you operate in one of the strategic sectors identified by the directive?
• ✔ Do you exceed the size thresholds (employees and turnover)?
• ✔ Do you provide ICT, cloud, digital infrastructure or online platform services?
• ✔ Are you a critical supplier to an essential entity?
• ✔ Does the continuity of your service affect security or economic stability?

If the answer to even one of these is yes, it is advisable to launch a structured gap analysis involving IT, compliance and governance. Entities that ACN has already included in the national NIS list have received a formal communication, and it is that communication that starts the clock on their deadlines.

NIS2 deadlines in Italy for 2026 and 2027

On 11 September 2026 ACN published the NIS Vademecum, which summarises obligations and deadlines. Timelines depend on the year in which an entity was added to the national NIS list.

For entities added in 2025, deadlines run from receipt of the inclusion notice: 9 months for incident reporting and 18 months for the adoption of security measures. For most organisations, the deadline for basic measures therefore falls in October 2026, but the exact date should be checked case by case.

Annual obligations on the ACN portal

In addition to the deadlines linked to the year of inclusion, all NIS entities must observe recurring windows:

• 1 January to 28 February: registration, or update of the registration, on the ACN services portal;
• 15 April to 31 May: update of the information required by the NIS decree;
• 1 May to 30 June: categorisation of activities and services, a simplified impact analysis that allows ACN to set proportionate obligations.

Basic and enhanced security measures

The basic security measures are set out in ACN Determination 379907/2025: Annex 1 for important entities (37 measures and 87 requirements) and Annex 2 for essential entities (43 measures and 116 requirements). On 18 September 2026 ACN opened a consultation with sector working groups on enhanced security measures, intended to complement and eventually replace the basic ones. Until an official act is adopted, the basic measures and the deadlines already assigned remain in force.

The role of the supply chain and the impact on SMEs

Even when they are not directly classified as essential or important entities, many SMEs can be indirectly affected through the supply chain. Organisations subject to NIS2 must check that their suppliers adopt adequate security measures, introducing periodic audits, contractual security clauses, partner risk assessments and continuous monitoring of the digital supply chain.

NIS2 is therefore not just a law for large companies: it is a framework that requires structured cyber risk management across the entire value chain.

Technical and organisational requirements: from theory to operational resilience

NIS2 introduces a security model based on structured risk management, management accountability and continuous operational resilience. Individual technical measures are not enough: an integrated cybersecurity system is needed, one that can be documented and verified by the competent authorities. Risk-proportionate measures must include:

• formalised risk management;
• network and information system security;
• access management and strong authentication;
• continuous monitoring and anomaly detection;
• structured incident response;
• business continuity and disaster recovery;
• traceability and evidence retention.

The required approach is risk-based and “all-hazards”, aimed at preventing, detecting and mitigating any event that could compromise the availability, integrity and confidentiality of systems.

Governance and board-level accountability

With NIS2, cybersecurity formally becomes part of corporate governance. Management must approve cybersecurity strategies, oversee their implementation, ensure specific training for executives and demonstrate effective control over cyber risks. Serious breaches can lead to personal liability and temporary disqualification measures.

Security decisions must therefore be formalised, traced and backed by verifiable documentation. In this context, integrating cybersecurity tools with document management and compliant digital archiving systems is key to ensuring accountability and demonstrating strategic choices.

Cyber risk management: concrete technical controls

The risk management required by NIS2 must translate into specific technical measures: multi-factor authentication (MFA), network segmentation and least privilege, encryption of data at rest and in transit, continuous vulnerability management, periodic penetration tests, centralised monitoring through a SIEM, and SOC or MDR services for detection and response.

Security should be designed around modern models such as Zero Trust Architecture, minimising the attack surface. Managing digital identities and privileged access is a critical point: integrated identification and access control solutions strengthen the overall security posture.

Incident reporting and structured digital workflows

One of the strictest obligations concerns the notification of significant incidents to CSIRT Italia:

• early warning within 24 hours of becoming aware of the incident;
• notification within 72 hours, with an initial assessment and, where available, indicators of compromise;
• final report within one month; if the incident is still ongoing, progress reports are required.

Meeting these timelines requires automated digital workflows, structured incident classification, centralised collection of technical evidence and a traceable reporting system. Handling reports manually by email or with unstructured documents creates operational and regulatory risk. An architecture that connects cybersecurity tools, document management and digital archiving helps guarantee evidence integrity, prove timely notification and reduce procedural errors.

Business continuity, disaster recovery and systemic resilience

NIS2 requires service continuity even in the event of an attack or critical incident. This calls for formal business continuity plans, documented periodic testing, infrastructure redundancy, encrypted and verified backups, and validated recovery procedures. Resilience is also organisational: roles, responsibilities and procedures must be clear and traceable.

Log management, audit trails and evidence retention

One of the most underestimated aspects is the ability to prove the measures adopted. Companies need centralised logging, tamper-proof audit trails, structured archiving and compliant digital preservation. Collecting logs is not enough: their integrity, immutability and long-term retrievability must be ensured.

In short, NIS2 does not require individual tools but a coordinated ecosystem combining technical cybersecurity, corporate governance, digital workflows, identification and access control, and evidence retention. This is how organisations move from reactive security to structured, demonstrable cyber resilience.

Cybersecurity Act: European certification and digital supply chain security

While NIS2 strengthens risk management and operational resilience obligations, the Cybersecurity Act adds a complementary element: European certification of ICT products, services and processes, to reduce the systemic risk arising from technological vulnerabilities and critical dependencies.

On 20 January 2026 the European Commission proposed the “Cybersecurity Act 2” (COM(2026) 11), intended to replace Regulation (EU) 2019/881. The proposal introduces an EU framework for ICT supply chain security, streamlines certification (with schemes to be developed within 12 months by default) and strengthens ENISA’s role, including a single entry point for incident reporting. It comes with a proposal for targeted amendments to NIS2 (COM(2026) 13) for simplification and alignment. As of September 2026 the text was still being examined by the Council of the EU: until it is adopted, the 2019 Cybersecurity Act remains in force.

European ICT certification schemes

The Cybersecurity Act establishes a European certification system based on common schemes that assess the security of ICT products, the robustness of digital services, the reliability of cloud infrastructure and the resilience of critical technology solutions. Schemes provide for different assurance levels (basic, substantial, high), with requirements proportionate to risk. Organisations subject to NIS2 must therefore also assess the security of the technologies they use, favouring solutions that meet European standards.

Impact on suppliers and the digital supply chain

Essential and important entities must assess the risk posed by ICT suppliers, introduce contractual security clauses, verify the protection level of the solutions they adopt and continuously monitor technology partners. This requires tools that centralise supplier information, track audits and checks, document controls and certifications, and retain evidence in a structured way.

Towards integrated resilience

NIS2 and the Cybersecurity Act are parts of a coordinated European strategy: NIS2 imposes risk management, incident reporting and accountability, while the Cybersecurity Act strengthens the reliability of technologies through common standards and certification. Organisations that combine technical security, documentary governance and continuous monitoring turn a regulatory obligation into a competitive and reputational advantage.

NIS2 and the Cybersecurity Act: differences and integration

Although often mentioned together, NIS2 and the Cybersecurity Act have distinct but complementary purposes.

Common NIS2 compliance mistakes

Many organisations approach NIS2 compliance in a fragmented way. The most frequent mistakes are:

• ❌ Treating NIS2 as an IT-only project: the law involves governance, risk management and senior management.
• ❌ Just buying technology: a SIEM or SOC is not enough without documented processes and structured workflows.
• ❌ Underestimating the digital supply chain: critical suppliers must be assessed, audited and monitored.
• ❌ Not formalising management decisions: board accountability requires traceability and documentation.
• ❌ Handling incident reporting manually: the 24- and 72-hour deadlines require automated workflows and evidence retention.
• ❌ Not testing business continuity and disaster recovery: plans must be updated, tested and documented.

NIS2 does not reward improvisation: it requires an integrated, verifiable system.

Digital tools to automate NIS2 compliance

Reporting deadlines, governance obligations and board accountability require an integrated digital ecosystem that can continuously monitor risk, automate incident management, trace management decisions, retain evidence and demonstrate compliance during inspections.

GRC (Governance, Risk & Compliance) platforms

GRC platforms centralise cyber risk management, formalise policies and controls, track responsibilities and approvals, and generate reports for management. Integrated with IT systems, they connect theoretical risk with real operational data; the documentation they produce must be archived and preserved in a compliant way.

SIEM, SOC and advanced detection

Tools such as SIEM (Security Information and Event Management), SOC (Security Operations Center) and EDR/MDR (Endpoint/Managed Detection & Response) collect and correlate logs, identify anomalies in real time, reduce response times and support mandatory notifications. Technical monitoring alone is not enough, however: evidence must be classified, organised and preserved in a structured way.

Digital workflows for incident reporting and audits

An advanced digital system should trigger automatic workflows when a critical event is detected, classify the incident against predefined criteria, involve internal owners, generate standardised reports for the authority and store communications in a tamper-proof way. Learn more in Everything you need to know about the NIS 2 regulation.

Integrating cybersecurity with document management and digital archiving platforms ensures evidence integrity, tamper-proof audit trails and traceable decisions.

Digital identity and access control

NIS2 places strong emphasis on identity protection. Organisations need multi-factor authentication (MFA), privileged access management (PAM), centralised management of digital identities and traceable access to critical systems. Integrated identification solutions reduce the risk of internal or external compromise.

Evidence retention and inspection readiness

During an ACN inspection, an organisation must be able to show up-to-date risk assessments, tested continuity plans, tamper-proof logs and notifications sent on time. Structured digital preservation of evidence guarantees immutability, immediate retrievability and evidential value.

Organisations that combine technical monitoring, document management, access control and structured preservation build solid, sustainable cyber resilience.

Penalties and supervision: what Italian companies risk

NIS2 introduces a much stricter penalty regime than the previous legislation. Penalties depend on the organisation’s classification and the seriousness of the breach.

Penalties for essential entities

Administrative fines of up to EUR 10 million or up to 2% of total worldwide annual turnover, whichever is higher. They apply, for example, to failure to implement security measures, failure or delay in reporting incidents, inadequate risk management and breaches of governance obligations.

Penalties for important entities

Fines of up to EUR 7 million or up to 1.4% of total worldwide annual turnover, whichever is higher, again proportionate to the seriousness and duration of the breach.

Executive liability and disqualification measures

Authorities can require immediate corrective measures, impose mandatory audits and temporarily suspend management functions in the event of serious breaches. Cybersecurity thus becomes a matter of direct management accountability.

ACN inspection and supervisory powers

ACN can carry out inspections and audits, request technical and organisational documentation, order corrective measures and impose proportionate penalties. This makes the ability to demonstrate up-to-date risk assessments, incident reporting workflows, structured audit trails and evidence retention central to protecting the company.

Glossary

• NIS2: Directive (EU) 2022/2555 on the security of network and information systems, repealing the 2016 NIS Directive.
• Legislative Decree 138/2024: the Italian decree transposing NIS2, in force since 16 October 2024.
• ACN: Agenzia per la Cybersicurezza Nazionale, Italy’s national competent authority for NIS.
• CSIRT Italia: the ACN unit that receives significant incident notifications.
• Essential entities: organisations with high systemic impact, subject to proactive supervision and the highest penalties.
• Important entities: organisations with significant but lower impact, subject mainly to ex post supervision.
• Basic security measures: minimum requirements set by ACN Determination 379907/2025, differentiated for important and essential entities.
• GRC: Governance, Risk & Compliance, platforms for managing risks, policies and controls.
• SIEM: Security Information and Event Management, a system that collects and correlates security logs.
• SOC: Security Operations Center, a team dedicated to monitoring and incident response.
• EDR/MDR: Endpoint/Managed Detection & Response, detection and response solutions on endpoints, also as a managed service.
• MFA: multi-factor authentication, requiring at least two verification factors.
• PAM: Privileged Access Management, control of privileged access.
• Zero Trust: a security model in which no user or device is trusted by default.
• Audit trail: a chronological, tamper-proof record of operations performed on a system.
• Cybersecurity Act: Regulation (EU) 2019/881 on ENISA and European ICT security certification.

Conclusions: towards integrated, sustainable digital security

The NIS2 Directive marks a turning point in European cybersecurity. In Italy, 2026 is the year obligations become fully operational: incident reporting is already in place, and entities added in 2025 must complete their basic security measures by October. It is not just about meeting new obligations, but about adopting a structured digital resilience model that integrates governance, risk management, technical security, continuous monitoring and evidence retention.

An integrated approach helps reduce exposure to penalties, strengthen stakeholder and investor trust, improve operational continuity and raise overall digital maturity. Discover the trends and investments in cybersecurity and data protection.

Approaching NIS2 with an integrated vision means not only being compliant, but building digital security that is solid, measurable and defensible over time.

Discover the solutions for your company’s digital transformation:

• Compliant Digital Archiving
• Customer Digital Onboarding
• EDI – Electronic Data Interchange
• E-Invoicing Platform
• International E-Invoicing
• Business Electronic Signature
• Document Management Software
• Supply Chain Management