{"id":10443,"date":"2026-03-12T14:24:13","date_gmt":"2026-03-12T13:24:13","guid":{"rendered":"https:\/\/www.intesa.it\/nis2-directive-in-italy-obligations-deadlines-penalties\/"},"modified":"2026-10-15T17:00:50","modified_gmt":"2026-10-15T15:00:50","slug":"nis2-directive-in-italy-obligations-deadlines-penalties","status":"publish","type":"post","link":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/","title":{"rendered":"NIS2 Directive in Italy: obligations, deadlines, penalties"},"content":{"rendered":"\n<p style=\"text-align: center;\"><em>A practical guide to NIS2 compliance in Italy: who is affected, which obligations apply and which deadlines to meet in 2026 and 2027.<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p style=\"text-align: center;\"><em>The <strong>NIS2 Directive<\/strong> (Directive (EU) 2022\/2555) is the EU law that sets common cybersecurity obligations for organisations operating in critical and digital sectors. Italy transposed it through Legislative Decree 138\/2024 (D.Lgs. 138\/2024), in force since 16 October 2024, and supervision is entrusted to the Agenzia per la Cybersicurezza Nazionale (ACN, Italy&#8217;s National Cybersecurity Agency).<\/em><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3>At a glance<\/h3>\n<ul>\n<li>NIS2 broadens the range of organisations in scope compared with the original NIS Directive and strengthens obligations on risk management, governance and incident reporting.<\/li>\n<li>In Italy it was transposed by Legislative Decree 138\/2024, in force since 16 October 2024; the competent authority is ACN, while incident notifications go to CSIRT Italia.<\/li>\n<li>Organisations are classified as essential or important entities: the classification changes the level of supervision and the penalty regime, not the existence of the obligations.<\/li>\n<li>For entities added to the national NIS list in 2025, incident reporting has been mandatory since January 2026 and basic security measures must be in place by October 2026; for entities added in 2026, the deadlines move to January and July 2027.<\/li>\n<li>Significant incidents require an early warning within 24 hours, a notification within 72 hours and a final report within one month.<\/li>\n<li>Penalties can reach EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities.<\/li>\n<\/ul>\n\n\n<div>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"freccia-interna alignright wp-image-45945\" src=\"https:\/\/www.intesa.it\/wp-content\/uploads\/2025\/10\/freccia-interna.png\" alt=\"\" width=\"31\" height=\"36\" \/><\/p>\n<p style=\"padding-left: 26px; padding-top: 26px;\"><strong>In this article you will learn:<\/strong><\/p>\n\n\t<div id=\"toc\">\t  \n\t<\/div>\n\n\t<script>\n\t\tvar c = function() {\n\t\t\treturn({\n\t\t\t\tlog: function(msg) {\n\t\t\t\t\tconsoleDiv = document.querySelector(\"main#single_news .contenuto_news\");\n\t\t\t\t\tpara = document.createElement('p');\n\t\t\t\t\ttext = document.createTextNode(msg);\n\t\t\t\t\tpara.appendChild(text);\n\t\t\t\t\tconsoleDiv.appendChild(para);\n\t\t\t\t}\n\t\t\t});\n\t\t}();\n\n\t\t\/*window.onload = function () {\n\t\t\tvar toc = \"\";\n\t\t\tvar level = 0;\n\t\t\tvar maxLevel = 3;\n\t\t\t\n\t\t\tconst reg = \/<h([\\d])>([^<]+)<\\\/h([\\d])>\/gi;\n\t\t\t\/\/const reg = \/<h([1-6])\\b[^>]*>([\\s\\S]*?)<\\\/h\\1>\/gi;\n\t\t\t\n\t\t\tdocument.querySelector(\"main#single_news .contenuto_news\").innerHTML =\n\t\t\t\tdocument.querySelector(\"main#single_news .contenuto_news\").innerHTML.replace( \/\/\n\t\t\t\t\treg,\n\t\t\t\t\tfunction (str, openLevel, titleText, closeLevel) {\n\t\t\t\t\t\tif (openLevel != closeLevel) {\n\t\t\t\t\t\t\tc.log(openLevel)\n\t\t\t\t\t\t\t\treturn str + ' - ' + openLevel;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (openLevel > level) {\n\t\t\t\t\t\t\ttoc += (new Array(openLevel - level + 1)).join(\"<ul>\");\n\t\t\t\t\t\t} else if (openLevel < level) {\n\t\t\t\t\t\t\ttoc += (new Array(level - openLevel + 1)).join(\"<\/ul>\");\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tlevel = parseInt(openLevel);\n\n\t\t\t\t\t\tvar anchor = titleText.replace(\/ \/g, \"_\");\n\t\t\t\t\t\ttoc += \"<li><a href=\\\"#\" + anchor + \"\\\">\" + titleText + \"<\/a><\/li>\";\n\n\t\t\t\t\t\treturn \"<h\" + openLevel + \"><a name=\\\"\" + anchor + \"\\\">\" + titleText + \"<\/a><\/h\" + closeLevel + \">\";\n\t\t\t\t\t}\n\t\t\t\t);\n\n\t\t\tif (level) {\n\t\t\t\ttoc += (new Array(level + 1)).join(\"<\/ol>\");\n\t\t\t}\n\n\t\t\tdocument.querySelector(\"main#single_news .contenuto_news #toc\").innerHTML += toc;\n\t\t};*\/\n\t\twindow.onload = function () {\n\t\t\tvar toc = \"\";\n\t\t\tvar currentLevel = 0;\n\t\t\tvar anchorsSeen = {};\n\n\t\t\tconst reg = \/(<h([1-6])\\b[^>]*>)([\\s\\S]*?)<\\\/h\\2>\/gi;\n\t\t\tconst container = document.querySelector(\"main#single_news .contenuto_news\");\n\n\t\t\tif (!container) return;\n\n\t\t\t\/\/ Rileva l\u2019eventuale h2.wp-block-heading primo figlio da escludere\n\t\t\tconst excludeHeading = container.querySelector(\":scope > h2.wp-block-heading:first-child\");\n\n\t\t\tcontainer.innerHTML = container.innerHTML.replace(\n\t\t\t\treg,\n\t\t\t\tfunction (fullMatch, openTag, levelStr, innerHTML, offset, fullString) {\n\t\t\t\t\t\/\/ Ignora se corrisponde all'h2.wp-block-heading:first-child\n\t\t\t\t\tif (excludeHeading && fullMatch.includes(excludeHeading.outerHTML)) {\n\t\t\t\t\t\treturn fullMatch;\n\t\t\t\t\t}\n\n\t\t\t\t\t\/\/ Esclude i titoli subito dopo <hr class=\"wp-block-separator\">\n\t\t\t\t\tconst prevChunk = fullString.slice(Math.max(0, offset - 100), offset);\n\t\t\t\t\tif (\/<hr[^>]*class=[\"']wp-block-separator[\"'][^>]*>\\s*$\/i.test(prevChunk)) {\n\t\t\t\t\t\treturn fullMatch;\n\t\t\t\t\t}\n\n\t\t\t\t\tvar level = parseInt(levelStr, 10);\n\t\t\t\t\tvar titleText = innerHTML.replace(\/<\\\/?[^>]+(>|$)\/g, \"\").trim();\n\t\t\t\t\tif (!titleText) return fullMatch;\n\n\t\t\t\t\tvar anchorBase = titleText.replace(\/\\s+\/g, \"_\").replace(\/[^\\w\\-_.]\/g, \"\");\n\t\t\t\t\tvar anchor = anchorBase || (\"heading_\" + Math.random().toString(36).slice(2, 8));\n\n\t\t\t\t\tif (anchorsSeen[anchor]) {\n\t\t\t\t\t\tanchorsSeen[anchor] += 1;\n\t\t\t\t\t\tanchor = anchor + \"_\" + anchorsSeen[anchor];\n\t\t\t\t\t} else {\n\t\t\t\t\t\tanchorsSeen[anchor] = 1;\n\t\t\t\t\t}\n\n\t\t\t\t\tif (level > currentLevel) toc += \"<ul>\".repeat(level - currentLevel);\n\t\t\t\t\telse if (level < currentLevel) toc += \"<\/ul>\".repeat(currentLevel - level);\n\t\t\t\t\tcurrentLevel = level;\n\n\t\t\t\t\ttoc += `<li><a href=\"#${anchor}\">${titleText}<\/a><\/li>`;\n\n\t\t\t\t\treturn `${openTag}<a name=\"${anchor}\"><\/a>${innerHTML}<\/h${level}>`;\n\t\t\t\t}\n\t\t\t);\n\n\t\t\tif (currentLevel) toc += \"<\/ul>\".repeat(currentLevel);\n\n\t\t\tvar tocContainer = container.querySelector(\"#toc\");\n\t\t\tif (tocContainer) tocContainer.innerHTML += toc;\n\t\t};\n\n\t<\/script>\n\t\n\t\n<\/div>\n\n\n<h2>Why NIS2 matters for Italian companies<\/h2>\n<p>The <strong>NIS2 Directive<\/strong> is a decisive step forward in the European cybersecurity framework. Together with the <strong>Cybersecurity Act<\/strong>, it redefines responsibilities, technical requirements and organisational obligations for companies operating in critical and digital sectors.<\/p>\n<p>This is more than a regulatory update: <strong>NIS2 compliance<\/strong> requires a structured approach to cyber risk management, corporate governance and operational resilience. The obligations go beyond technical protection and call for an integrated governance model. Italian companies now need to combine:<\/p>\n<ul>\n<li>continuous monitoring systems;<\/li>\n<li>incident reporting procedures within 24 hours;<\/li>\n<li>business continuity and disaster recovery models;<\/li>\n<li>digital tools for traceability and evidence retention.<\/li>\n<\/ul>\n<p>The goal is to strengthen <strong>cyber resilience<\/strong> across Europe, ensuring a secure digital supply chain and accountability at board level. For more on the European framework for ICT certification and security, see Intesa&#8217;s focus on the <span style=\"background-color: #ffff00;\"><a href=\"https:\/\/www.intesa.it\/cyber-security-act\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Cyber Security Act<\/strong><\/a><\/span>.<\/p>\n\n\n\n<h2>Transposition in Italy: Legislative Decree 138\/2024<\/h2>\n<p>NIS2 was transposed into Italian law by Legislative Decree No. 138 of 4 September 2024, published in the Gazzetta Ufficiale on 1 October 2024 and in force since 16 October 2024. The decree confirms ACN as the national competent authority and single point of contact for NIS, and assigns CSIRT Italia to receive incident notifications.<\/p>\n<p>Implementation is phased through ACN determinations. The most relevant for companies is ACN Determination 379907\/2025, which sets out the basic security measures and the basic significant incidents to be reported.<\/p>\n\n\n\n<h2>Who falls under NIS2: essential and important entities<\/h2>\n<p>The <strong>NIS2 Directive<\/strong> significantly widens the scope of organisations subject to cybersecurity obligations compared with the original NIS Directive, introducing clearer criteria and two categories: <strong>essential entities<\/strong> and <strong>important entities<\/strong>. The classification determines the level of supervision by the national competent authority, the intensity of controls and the applicable penalty regime.<\/p>\n<h3>Size and sector criteria<\/h3>\n<p>NIS2 mainly applies to medium-sized and large companies operating in sectors considered strategic for Europe&#8217;s security and economic stability, including:<\/p>\n<ul>\n<li>energy;<\/li>\n<li>transport;<\/li>\n<li>banking and finance;<\/li>\n<li>digital infrastructure and cloud providers;<\/li>\n<li>healthcare;<\/li>\n<li>public administration;<\/li>\n<li>ICT service providers;<\/li>\n<li>digital services and online platforms.<\/li>\n<\/ul>\n<p>In addition to the sector criterion, the directive sets size thresholds (number of employees and turnover), detailed in national transposition. As a general rule, companies with at least 50 employees, or with annual turnover and balance sheet total above EUR 10 million, are in scope. Some categories, such as qualified trust service providers, are essential entities regardless of their size.<\/p>\n<p>In Italy, supervision is entrusted to <strong>ACN (Agenzia per la Cybersicurezza Nazionale)<\/strong>, which identifies obliged entities, monitors compliance, receives and manages incident notifications, and exercises inspection and enforcement powers. For the European context of ICT certification and infrastructure security, see the focus on the <span style=\"background-color: #ffff00;\"><a href=\"https:\/\/www.intesa.it\/cyber-security-act\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>Cyber Security Act<\/strong><\/a><\/span>.<\/p>\n<h3>Essential vs important entities: what changes in practice<\/h3>\n<p><strong>Essential entities<\/strong> are typically operators in critical sectors with high systemic impact, cloud providers and core digital infrastructure, and organisations that are decisive for the continuity of essential services. They are subject to proactive ACN supervision, preventive inspections, stronger internal control obligations and a stricter penalty regime.<\/p>\n<p><strong>Important entities<\/strong> include companies with a significant but lower systemic impact. Supervision is mainly ex post: controls are triggered by incidents or reports, and penalties, while significant, are lower.<\/p>\n<p>In both cases, appropriate technical and organisational measures, notification of significant incidents and documentation of the measures adopted remain mandatory. The difference lies not in whether the obligation exists, but in the level of regulatory exposure and the frequency of controls.<\/p>\n<h3>How to tell whether your company is in scope<\/h3>\n<p>For an initial self-assessment, check the following:<\/p>\n<ul>\n<li>\u2714 Do you operate in one of the strategic sectors identified by the directive?<\/li>\n<li>\u2714 Do you exceed the size thresholds (employees and turnover)?<\/li>\n<li>\u2714 Do you provide ICT, cloud, digital infrastructure or online platform services?<\/li>\n<li>\u2714 Are you a critical supplier to an essential entity?<\/li>\n<li>\u2714 Does the continuity of your service affect security or economic stability?<\/li>\n<\/ul>\n<p>If the answer to even one of these is yes, it is advisable to launch a <strong>structured gap analysis<\/strong> involving IT, compliance and governance. Entities that ACN has already included in the national NIS list have received a formal communication, and it is that communication that starts the clock on their deadlines.<\/p>\n\n\n\n<h2>NIS2 deadlines in Italy for 2026 and 2027<\/h2>\n<p>On 11 September 2026 ACN published the NIS Vademecum, which summarises obligations and deadlines. Timelines depend on the year in which an entity was added to the national NIS list.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Obligation<\/th><th>Entities added in 2025<\/th><th>Entities added in 2026<\/th><\/tr><\/thead><tbody><tr><td>Reporting basic significant incidents to CSIRT Italia<\/td><td>From January 2026<\/td><td>From January 2027<\/td><\/tr><tr><td>Adoption of basic security measures<\/td><td>By October 2026 (18 months from the inclusion notice)<\/td><td>By July 2027<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>For entities added in 2025, deadlines run from receipt of the inclusion notice: 9 months for incident reporting and 18 months for the adoption of security measures. For most organisations, the deadline for basic measures therefore falls in October 2026, but the exact date should be checked case by case.<\/p>\n<h3>Annual obligations on the ACN portal<\/h3>\n<p>In addition to the deadlines linked to the year of inclusion, all NIS entities must observe recurring windows:<\/p>\n<ul>\n<li>1 January to 28 February: registration, or update of the registration, on the ACN services portal;<\/li>\n<li>15 April to 31 May: update of the information required by the NIS decree;<\/li>\n<li>1 May to 30 June: categorisation of activities and services, a simplified impact analysis that allows ACN to set proportionate obligations.<\/li>\n<\/ul>\n<h3>Basic and enhanced security measures<\/h3>\n<p>The basic security measures are set out in ACN Determination 379907\/2025: Annex 1 for important entities (37 measures and 87 requirements) and Annex 2 for essential entities (43 measures and 116 requirements). On 18 September 2026 ACN opened a consultation with sector working groups on enhanced security measures, intended to complement and eventually replace the basic ones. Until an official act is adopted, the basic measures and the deadlines already assigned remain in force.<\/p>\n\n\n\n<h2>The role of the supply chain and the impact on SMEs<\/h2>\n<p>Even when they are not directly classified as essential or important entities, many <strong>SMEs can be indirectly affected<\/strong> through the supply chain. Organisations subject to NIS2 must check that their suppliers adopt adequate security measures, introducing periodic audits, contractual security clauses, partner risk assessments and continuous monitoring of the digital supply chain.<\/p>\n<p>NIS2 is therefore not just a law for large companies: it is a framework that requires <strong>structured cyber risk management across the entire value chain<\/strong>.<\/p>\n\n\n\n<h2>Technical and organisational requirements: from theory to operational resilience<\/h2>\n<p>NIS2 introduces a security model based on structured risk management, management accountability and continuous operational resilience. Individual technical measures are not enough: an <strong>integrated cybersecurity system<\/strong> is needed, one that can be documented and verified by the competent authorities. Risk-proportionate measures must include:<\/p>\n<ul>\n<li>formalised risk management;<\/li>\n<li>network and information system security;<\/li>\n<li>access management and strong authentication;<\/li>\n<li>continuous monitoring and anomaly detection;<\/li>\n<li>structured incident response;<\/li>\n<li>business continuity and disaster recovery;<\/li>\n<li>traceability and evidence retention.<\/li>\n<\/ul>\n<p>The required approach is <strong>risk-based and &#8220;all-hazards&#8221;<\/strong>, aimed at preventing, detecting and mitigating any event that could compromise the availability, integrity and confidentiality of systems.<\/p>\n<h3>Governance and board-level accountability<\/h3>\n<p>With NIS2, cybersecurity formally becomes part of <strong>corporate governance<\/strong>. Management must approve cybersecurity strategies, oversee their implementation, ensure specific training for executives and demonstrate effective control over cyber risks. Serious breaches can lead to personal liability and temporary disqualification measures.<\/p>\n<p>Security decisions must therefore be formalised, traced and backed by verifiable documentation. In this context, integrating cybersecurity tools with <strong><a href=\"https:\/\/www.intesa.it\/en\/what-we-do\/document-management-software\/\" target=\"_blank\" rel=\"noopener noreferrer\">document management<\/a> and <a href=\"https:\/\/www.intesa.it\/en\/what-we-do\/electronic-archiving\/\" target=\"_blank\" rel=\"noopener noreferrer\">compliant digital archiving<\/a> systems<\/strong> is key to ensuring accountability and demonstrating strategic choices.<\/p>\n<h3>Cyber risk management: concrete technical controls<\/h3>\n<p>The risk management required by NIS2 must translate into specific technical measures: <strong>multi-factor authentication (MFA)<\/strong>, network segmentation and least privilege, encryption of data at rest and in transit, continuous vulnerability management, periodic penetration tests, centralised monitoring through a SIEM, and SOC or MDR services for detection and response.<\/p>\n<p>Security should be designed around modern models such as <strong>Zero Trust Architecture<\/strong>, minimising the attack surface. Managing digital identities and privileged access is a critical point: integrated identification and access control solutions strengthen the overall security posture.<\/p>\n<h3>Incident reporting and structured digital workflows<\/h3>\n<p>One of the strictest obligations concerns the notification of significant incidents to CSIRT Italia:<\/p>\n<ul>\n<li>early warning within 24 hours of becoming aware of the incident;<\/li>\n<li>notification within 72 hours, with an initial assessment and, where available, indicators of compromise;<\/li>\n<li>final report within one month; if the incident is still ongoing, progress reports are required.<\/li>\n<\/ul>\n<p>Meeting these timelines requires automated digital workflows, structured incident classification, centralised collection of technical evidence and a traceable reporting system. Handling reports manually by email or with unstructured documents creates operational and regulatory risk. An architecture that connects cybersecurity tools, document management and digital archiving helps guarantee evidence integrity, prove timely notification and reduce procedural errors.<\/p>\n<h3>Business continuity, disaster recovery and systemic resilience<\/h3>\n<p>NIS2 requires service continuity even in the event of an attack or critical incident. This calls for formal business continuity plans, documented periodic testing, infrastructure redundancy, encrypted and verified backups, and validated recovery procedures. Resilience is also organisational: roles, responsibilities and procedures must be clear and traceable.<\/p>\n<h3>Log management, audit trails and evidence retention<\/h3>\n<p>One of the most underestimated aspects is the ability to <strong>prove the measures adopted<\/strong>. Companies need centralised logging, tamper-proof audit trails, structured archiving and compliant digital preservation. Collecting logs is not enough: their integrity, immutability and long-term retrievability must be ensured.<\/p>\n<p>In short, NIS2 does not require individual tools but a <strong>coordinated ecosystem<\/strong> combining technical cybersecurity, corporate governance, digital workflows, identification and access control, and evidence retention. This is how organisations move from reactive security to structured, demonstrable cyber resilience.<\/p>\n\n\n\n<h2>Cybersecurity Act: European certification and digital supply chain security<\/h2>\n<p>While NIS2 strengthens risk management and operational resilience obligations, the <strong>Cybersecurity Act<\/strong> adds a complementary element: <strong>European certification of ICT products, services and processes<\/strong>, to reduce the systemic risk arising from technological vulnerabilities and critical dependencies.<\/p>\n<p>On 20 January 2026 the European Commission proposed the &#8220;Cybersecurity Act 2&#8221; (COM(2026) 11), intended to replace Regulation (EU) 2019\/881. The proposal introduces an EU framework for ICT supply chain security, streamlines certification (with schemes to be developed within 12 months by default) and strengthens ENISA&#8217;s role, including a single entry point for incident reporting. It comes with a proposal for targeted amendments to NIS2 (COM(2026) 13) for simplification and alignment. As of September 2026 the text was still being examined by the Council of the EU: until it is adopted, the 2019 Cybersecurity Act remains in force.<\/p>\n<h3>European ICT certification schemes<\/h3>\n<p>The Cybersecurity Act establishes a European certification system based on common schemes that assess the security of ICT products, the robustness of digital services, the reliability of cloud infrastructure and the resilience of critical technology solutions. Schemes provide for different assurance levels (basic, substantial, high), with requirements proportionate to risk. Organisations subject to NIS2 must therefore also assess the security of the technologies they use, favouring solutions that meet European standards.<\/p>\n<h3>Impact on suppliers and the digital supply chain<\/h3>\n<p>Essential and important entities must assess the risk posed by ICT suppliers, introduce contractual security clauses, verify the protection level of the solutions they adopt and continuously monitor technology partners. This requires tools that centralise supplier information, track audits and checks, document controls and certifications, and retain evidence in a structured way.<\/p>\n<h3>Towards integrated resilience<\/h3>\n<p>NIS2 and the Cybersecurity Act are parts of a coordinated European strategy: NIS2 imposes risk management, incident reporting and accountability, while the Cybersecurity Act strengthens the reliability of technologies through common standards and certification. Organisations that combine technical security, documentary governance and continuous monitoring turn a regulatory obligation into a competitive and reputational advantage.<\/p>\n\n\n\n<h2>NIS2 and the Cybersecurity Act: differences and integration<\/h2>\n<p>Although often mentioned together, <strong>NIS2<\/strong> and the <strong>Cybersecurity Act<\/strong> have distinct but complementary purposes.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Aspect<\/th><th>NIS2 Directive<\/th><th>Cybersecurity Act<\/th><\/tr><\/thead><tbody><tr><td>Legal nature<\/td><td>EU directive<\/td><td>EU regulation<\/td><\/tr><tr><td>Main objective<\/td><td>Strengthen cyber resilience and risk management<\/td><td>Introduce European ICT certification schemes<\/td><\/tr><tr><td>Scope<\/td><td>Essential and important entities in strategic sectors<\/td><td>ICT products, services and processes<\/td><\/tr><tr><td>Operational focus<\/td><td>Governance, incident reporting, risk management<\/td><td>Certification and security standards<\/td><\/tr><tr><td>Supervision<\/td><td>National authorities (in Italy: ACN)<\/td><td>ENISA and certification bodies<\/td><\/tr><tr><td>Supply chain impact<\/td><td>Mandatory supplier assessment<\/td><td>Validation of the security level of ICT solutions<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2>Common NIS2 compliance mistakes<\/h2>\n<p>Many organisations approach <strong>NIS2 compliance<\/strong> in a fragmented way. The most frequent mistakes are:<\/p>\n<ul>\n<li>\u274c <strong>Treating NIS2 as an IT-only project<\/strong>: the law involves governance, risk management and senior management.<\/li>\n<li>\u274c <strong>Just buying technology<\/strong>: a SIEM or SOC is not enough without documented processes and structured workflows.<\/li>\n<li>\u274c <strong>Underestimating the digital supply chain<\/strong>: critical suppliers must be assessed, audited and monitored.<\/li>\n<li>\u274c <strong>Not formalising management decisions<\/strong>: board accountability requires traceability and documentation.<\/li>\n<li>\u274c <strong>Handling incident reporting manually<\/strong>: the 24- and 72-hour deadlines require automated workflows and evidence retention.<\/li>\n<li>\u274c <strong>Not testing business continuity and disaster recovery<\/strong>: plans must be updated, tested and documented.<\/li>\n<\/ul>\n<p>NIS2 does not reward improvisation: it requires an integrated, verifiable system.<\/p>\n\n\n\n<h2>Digital tools to automate NIS2 compliance<\/h2>\n<p>Reporting deadlines, governance obligations and board accountability require an <strong>integrated digital ecosystem<\/strong> that can continuously monitor risk, automate incident management, trace management decisions, retain evidence and demonstrate compliance during inspections.<\/p>\n<h3>GRC (Governance, Risk &amp; Compliance) platforms<\/h3>\n<p><strong>GRC<\/strong> platforms centralise cyber risk management, formalise policies and controls, track responsibilities and approvals, and generate reports for management. Integrated with IT systems, they connect theoretical risk with real operational data; the documentation they produce must be archived and preserved in a compliant way.<\/p>\n<h3>SIEM, SOC and advanced detection<\/h3>\n<p>Tools such as <strong>SIEM<\/strong> (Security Information and Event Management), <strong>SOC<\/strong> (Security Operations Center) and <strong>EDR\/MDR<\/strong> (Endpoint\/Managed Detection &amp; Response) collect and correlate logs, identify anomalies in real time, reduce response times and support mandatory notifications. Technical monitoring alone is not enough, however: evidence must be classified, organised and preserved in a structured way.<\/p>\n<h3>Digital workflows for incident reporting and audits<\/h3>\n<p>An advanced digital system should trigger automatic workflows when a critical event is detected, classify the incident against predefined criteria, involve internal owners, generate standardised reports for the authority and store communications in a tamper-proof way. Learn more in <span style=\"background-color: #ffff00;\"><a href=\"https:\/\/www.intesa.it\/tutto-quello-che-devi-sapere-sulla-normativa-nis-2\/\" target=\"_blank\" rel=\"noopener noreferrer\">Everything you need to know about the NIS 2 regulation<\/a><\/span>.<\/p>\n<p>Integrating cybersecurity with <strong>document management and digital archiving<\/strong> platforms ensures evidence integrity, tamper-proof audit trails and traceable decisions.<\/p>\n<h3>Digital identity and access control<\/h3>\n<p>NIS2 places strong emphasis on identity protection. Organisations need multi-factor authentication (MFA), privileged access management (PAM), centralised management of <span style=\"background-color: #ffff00;\"><a href=\"https:\/\/www.intesa.it\/identita-digitale-spettatori-o-protagonisti\/\" target=\"_blank\" rel=\"noopener noreferrer\">digital identities<\/a><\/span> and traceable access to critical systems. Integrated identification solutions reduce the risk of internal or external compromise.<\/p>\n<h3>Evidence retention and inspection readiness<\/h3>\n<p>During an ACN inspection, an organisation must be able to show up-to-date risk assessments, tested continuity plans, tamper-proof logs and notifications sent on time. <strong>Structured digital preservation of evidence<\/strong> guarantees immutability, immediate retrievability and evidential value.<\/p>\n<p>Organisations that combine technical monitoring, <a href=\"https:\/\/www.intesa.it\/en\/what-we-do\/document-management-software\/\" target=\"_blank\" rel=\"noopener noreferrer\">document management<\/a>, access control and structured preservation build solid, sustainable cyber resilience.<\/p>\n\n\n\n<h2>Penalties and supervision: what Italian companies risk<\/h2>\n<p>NIS2 introduces a much stricter penalty regime than the previous legislation. Penalties depend on the organisation&#8217;s classification and the seriousness of the breach.<\/p>\n<h3>Penalties for essential entities<\/h3>\n<p>Administrative fines of up to <strong>EUR 10 million<\/strong> or up to <strong>2% of total worldwide annual turnover<\/strong>, whichever is higher. They apply, for example, to failure to implement security measures, failure or delay in reporting incidents, inadequate risk management and breaches of governance obligations.<\/p>\n<h3>Penalties for important entities<\/h3>\n<p>Fines of up to <strong>EUR 7 million<\/strong> or up to <strong>1.4% of total worldwide annual turnover<\/strong>, whichever is higher, again proportionate to the seriousness and duration of the breach.<\/p>\n<h3>Executive liability and disqualification measures<\/h3>\n<p>Authorities can require immediate corrective measures, impose mandatory audits and temporarily suspend management functions in the event of serious breaches. Cybersecurity thus becomes a matter of <strong>direct management accountability<\/strong>.<\/p>\n<h3>ACN inspection and supervisory powers<\/h3>\n<p>ACN can carry out inspections and audits, request technical and organisational documentation, order corrective measures and impose proportionate penalties. This makes the ability to demonstrate up-to-date risk assessments, incident reporting workflows, structured audit trails and evidence retention central to protecting the company.<\/p>\n\n\n\n<h2>Glossary<\/h2>\n<ul>\n<li><strong>NIS2<\/strong>: Directive (EU) 2022\/2555 on the security of network and information systems, repealing the 2016 NIS Directive.<\/li>\n<li><strong>Legislative Decree 138\/2024<\/strong>: the Italian decree transposing NIS2, in force since 16 October 2024.<\/li>\n<li><strong>ACN<\/strong>: Agenzia per la Cybersicurezza Nazionale, Italy&#8217;s national competent authority for NIS.<\/li>\n<li><strong>CSIRT Italia<\/strong>: the ACN unit that receives significant incident notifications.<\/li>\n<li><strong>Essential entities<\/strong>: organisations with high systemic impact, subject to proactive supervision and the highest penalties.<\/li>\n<li><strong>Important entities<\/strong>: organisations with significant but lower impact, subject mainly to ex post supervision.<\/li>\n<li><strong>Basic security measures<\/strong>: minimum requirements set by ACN Determination 379907\/2025, differentiated for important and essential entities.<\/li>\n<li><strong>GRC<\/strong>: Governance, Risk &amp; Compliance, platforms for managing risks, policies and controls.<\/li>\n<li><strong>SIEM<\/strong>: Security Information and Event Management, a system that collects and correlates security logs.<\/li>\n<li><strong>SOC<\/strong>: Security Operations Center, a team dedicated to monitoring and incident response.<\/li>\n<li><strong>EDR\/MDR<\/strong>: Endpoint\/Managed Detection &amp; Response, detection and response solutions on endpoints, also as a managed service.<\/li>\n<li><strong>MFA<\/strong>: multi-factor authentication, requiring at least two verification factors.<\/li>\n<li><strong>PAM<\/strong>: Privileged Access Management, control of privileged access.<\/li>\n<li><strong>Zero Trust<\/strong>: a security model in which no user or device is trusted by default.<\/li>\n<li><strong>Audit trail<\/strong>: a chronological, tamper-proof record of operations performed on a system.<\/li>\n<li><strong>Cybersecurity Act<\/strong>: Regulation (EU) 2019\/881 on ENISA and European ICT security certification.<\/li>\n<\/ul>\n\n\n\n<h3>Conclusions: towards integrated, sustainable digital security<\/h3>\n<p>The <strong>NIS2 Directive<\/strong> marks a turning point in European cybersecurity. In Italy, 2026 is the year obligations become fully operational: incident reporting is already in place, and entities added in 2025 must complete their basic security measures by October. It is not just about meeting new obligations, but about adopting a <strong>structured digital resilience<\/strong> model that integrates governance, risk management, technical security, continuous monitoring and evidence retention.<\/p>\n<p>An integrated approach helps reduce exposure to penalties, strengthen stakeholder and investor trust, improve operational continuity and raise overall digital maturity. Discover the trends and investments in <span style=\"background-color: #ffff00;\"><a href=\"https:\/\/www.intesa.it\/en\/cybersecurity-and-data-protection-2025-key-trends-threats-and-investments-for-businesses\/\" target=\"_blank\" rel=\"noopener noreferrer\">cybersecurity and data protection<\/a><\/span>.<\/p>\n<p>Approaching NIS2 with an integrated vision means not only being compliant, but building <strong>digital security that is solid, measurable and defensible over time<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<section id=\"FAQ\" class=\"blocco-faqs \">\n    <div class=\"wrapper\">\n        <div class=\"container\">\n                            <div class=\"row mb-5\">\n                    <div class=\"col-12\">\n                        <h2>Frequently Asked Questions<\/h2>\n                    <\/div>\n                <\/div>\n            \n                            <div class=\"row\">\n                    <div class=\"col-12\">\n                        <div class=\"faqs\">\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>What is the NIS2 Directive?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>The NIS2 Directive is the EU law that strengthens cybersecurity obligations for organisations operating in strategic sectors. It introduces stricter requirements on cyber risk management, corporate governance, incident reporting and operational resilience.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>How was NIS2 transposed in Italy?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>NIS2 was transposed by Legislative Decree 138\/2024, published in the Gazzetta Ufficiale on 1 October 2024 and in force since 16 October 2024. The decree designates ACN as the national competent authority and assigns CSIRT Italia to receive incident notifications.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>Who must comply with NIS2?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>NIS2 applies to essential and important entities, identified on the basis of size and sector criteria (energy, transport, healthcare, digital infrastructure, ICT services, finance, public administration). SMEs can also be indirectly affected if they are part of the supply chain of an obliged entity.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>What are the NIS2 deadlines in Italy for 2026 and 2027?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>For entities added to the NIS list in 2025, incident reporting has been mandatory since January 2026 and basic security measures must be adopted by October 2026 (18 months from the inclusion notice). For entities added in 2026, the deadlines move to January 2027 for reporting and July 2027 for basic measures.<\/p>\n<p>Every year, from 1 January to 28 February, all NIS entities must register or update their registration on the ACN portal.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>How quickly must a significant incident be reported?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>A significant incident requires an early warning within 24 hours of becoming aware of it and a notification within 72 hours, followed by a final report within one month. Notifications are sent to CSIRT Italia.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>What penalties does NIS2 provide for?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>Penalties can reach EUR 10 million or 2% of total worldwide annual turnover for essential entities, and EUR 7 million or 1.4% of total worldwide annual turnover for important entities. In addition to fines, corrective measures and management liability apply.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>What is ACN&#039;s role in Italy?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>The Agenzia per la Cybersicurezza Nazionale (ACN) is the competent authority responsible for identifying obliged entities, receiving incident notifications, carrying out inspections and imposing penalties. Organisations must therefore be able to document the measures they have adopted.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>Does NIS2 replace the original NIS Directive?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>Yes. NIS2 repeals and replaces the 2016 NIS Directive, widening the range of entities in scope and introducing stricter requirements on governance, risk management and supply chain security.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"domanda\"><span>How does NIS2 relate to the Cybersecurity Act?<\/span><\/h3>\t\t\t\t\t\t\t\t\t\n                                    <div class=\"risposta\" style=\"display: none\">\n                                        <p>NIS2 sets organisational and risk management obligations, while the Cybersecurity Act introduces European certification schemes for ICT products, services and processes. Together they help build a European model of integrated digital security.<\/p>\n                                    <\/div>\n                                <\/div>\n                                                    <\/div>\n                    <\/div>\n                <\/div>\n                    <\/div>\n    <\/div>\n<\/section>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4>Discover the solutions for your company&#8217;s digital transformation:<\/h4>\n<ul>\n<li><a title=\"Compliant Digital Archiving\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/electronic-archiving\/\" target=\"_blank\" rel=\"noopener noreferrer\">Compliant Digital Archiving<\/a><\/li>\n<li><a title=\"Customer Digital Onboarding\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/identification\/\" target=\"_blank\" rel=\"noopener noreferrer\">Customer Digital Onboarding<\/a><\/li>\n<li><a title=\"EDI - Electronic Data Interchange\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/edi-electronic-data-interchange\/\" target=\"_blank\" rel=\"noopener noreferrer\">EDI &#8211; Electronic Data Interchange<\/a><\/li>\n<li><a title=\"E-Invoicing Platform\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/electronic-invoicing\/\" target=\"_blank\" rel=\"noopener noreferrer\">E-Invoicing Platform<\/a><\/li>\n<li><a title=\"International E-Invoicing\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/international-electronic-invoicing\/\" target=\"_blank\" rel=\"noopener noreferrer\">International E-Invoicing<\/a><\/li>\n<li><a title=\"Business Electronic Signature\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/electronic-signature\/\" target=\"_blank\" rel=\"noopener noreferrer\">Business Electronic Signature<\/a><\/li>\n<li><a title=\"Document Management Software\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/document-management-software\/\" target=\"_blank\" rel=\"noopener noreferrer\">Document Management Software<\/a><\/li>\n<li><a title=\"Supply Chain Management\" href=\"https:\/\/www.intesa.it\/en\/what-we-do\/supply-chain-management\/\" target=\"_blank\" rel=\"noopener noreferrer\">Supply Chain Management<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>The NIS2 Directive (Directive (EU) 2022\/2555) is the EU law that sets common cybersecurity obligations for organisations operating in critical and digital sectors. Italy transposed it through Legislative Decree 138\/2024 (D.Lgs. 138\/2024), in force since 16 October 2024, and supervision is entrusted to the Agenzia per la Cybersicurezza Nazionale (ACN, Italy\u2019s National Cybersecurity Agency).Le organizzazioni che investono in un ecosistema digitale integrato trasformano l\u2019obbligo normativo in un vantaggio competitivo.<\/p>\n","protected":false},"author":2,"featured_media":10442,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","_members_access_role":[],"_members_access_error":""},"categories":[196],"tags":[301],"class_list":["post-10443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-regulations","tag-cybersecurity-3"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"etinet\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Intesa | Soluzioni per la trasformazione digitale delle aziende.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"NIS2 Directive in Italy: obligations, deadlines, penalties\" \/>\n\t\t<meta property=\"og:description\" content=\"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-03-12T13:24:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-15T15:00:50+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/IntesaKyndryl\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"NIS2 Directive in Italy: obligations, deadlines, penalties\" \/>\n\t\t<meta name=\"twitter:description\" content=\"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#article\",\"name\":\"NIS2 Directive in Italy: obligations, deadlines, penalties\",\"headline\":\"NIS2 Directive in Italy: obligations, deadlines, penalties\",\"author\":{\"@id\":\"#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/ArtSEO_CybersecurityAct2NIS2.png\",\"width\":1300,\"height\":530,\"caption\":\"Lucchetto metallico su circuito elettronico digitale, a tema direttiva NIS2 e cybersecurity\"},\"datePublished\":\"2026-03-12T14:24:13+01:00\",\"dateModified\":\"2026-10-15T17:00:50+02:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#webpage\"},\"articleSection\":\"Regulations, cybersecurity, Opzionale\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/category\\\/regulations\\\/#listItem\",\"name\":\"Regulations\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/category\\\/regulations\\\/#listItem\",\"position\":2,\"name\":\"Regulations\",\"item\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/category\\\/regulations\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#listItem\",\"name\":\"NIS2 Directive in Italy: obligations, deadlines, penalties\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#listItem\",\"position\":3,\"name\":\"NIS2 Directive in Italy: obligations, deadlines, penalties\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/category\\\/regulations\\\/#listItem\",\"name\":\"Regulations\"}}]},{\"@type\":\"FAQPage\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#faq\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Cos\\u2019\\u00e8 la Direttiva NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"La Direttiva NIS2 \\u00e8 la normativa europea che rafforza gli obblighi di sicurezza informatica per le organizzazioni che operano in settori strategici. Introduce requisiti pi\\u00f9 stringenti su gestione del rischio cyber, governance aziendale, notifica degli incidenti e resilienza operativa.\"}},{\"@type\":\"Question\",\"name\":\"Chi \\u00e8 obbligato ad adeguarsi alla NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Sono soggette alla NIS2 le Entit\\u00e0 Essenziali e Importanti, identificate in base a criteri dimensionali e settoriali (energia, trasporti, sanit\\u00e0, infrastrutture digitali, servizi ICT, finanza, PA). Anche le PMI possono essere coinvolte indirettamente se fanno parte della supply chain di un soggetto obbligato.\"}},{\"@type\":\"Question\",\"name\":\"Quali sono gli obblighi principali della Direttiva NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Gli obblighi principali della Direttiva NIS2 includono l\\u2019adozione di misure tecniche e organizzative adeguate, la gestione strutturata del rischio informatico, la notifica degli incidenti entro 24 ore, l\\u2019implementazione di piani di continuit\\u00e0 operativa e la responsabilit\\u00e0 diretta dei vertici aziendali nella governance della sicurezza.\"}},{\"@type\":\"Question\",\"name\":\"Quali sono le sanzioni previste dalla NIS2?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Le sanzioni possono arrivare fino a: 10 milioni di euro o 2% del fatturato globale per le Entit\\u00e0 Essenziali 7 milioni di euro o 1,4% del fatturato globale per le Entit\\u00e0 Importanti Oltre alle sanzioni economiche, sono previste misure correttive e responsabilit\\u00e0 dei vertici aziendali.\"}},{\"@type\":\"Question\",\"name\":\"Qual \\u00e8 il ruolo dell\\u2019ACN in Italia?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"L\\u2019Agenzia per la Cybersicurezza Nazionale (ACN) \\u00e8 l\\u2019autorit\\u00e0 competente per: Identificare i soggetti obbligati Ricevere le notifiche di incidente Effettuare ispezioni Applicare sanzioni Le organizzazioni devono quindi essere in grado di dimostrare in modo documentato le misure adottate.\"}},{\"@type\":\"Question\",\"name\":\"La NIS2 sostituisce la precedente Direttiva NIS?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"S\\u00ec. La NIS2 abroga e sostituisce la Direttiva NIS del 2016, ampliando il perimetro dei soggetti coinvolti e introducendo requisiti pi\\u00f9 severi in termini di governance, gestione del rischio e supply chain security.\"}},{\"@type\":\"Question\",\"name\":\"Come si coordina la NIS2 con il Cybersecurity Act?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"La NIS2 impone obblighi organizzativi e di gestione del rischio. Il Cybersecurity Act introduce schemi europei di certificazione per prodotti e servizi ICT. Insieme, contribuiscono a costruire un modello europeo di sicurezza digitale integrata.\"}}],\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#breadcrumblist\"}},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#organization\",\"name\":\"Intesa\",\"description\":\"Intesa \\u00e8 un digital solution provider che progetta e realizza soluzioni per la digitalizzazione dei processi aziendali. Accompagna le imprese nella trasformazione digitale attraverso piattaforme sicure, scalabili e conformi alle normative. La sua mission \\u00e8 rendere l\\u2019innovazione accessibile, sostenibile e centrata sulle persone, integrando tecnologia, design e servizi fiduciari. Societ\\u00e0 Benefit dal 2020, Intesa promuove un business etico, trasparente e attento al benessere aziendale e ambientale.\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/\",\"email\":\"INTESA@pec.trustedmail.intesa.it\",\"telephone\":\"+390239309066\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/intesa.it\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Logo-Intesa-a-Kyndryl-Company-In.Te_.S.A.-S.p.A.svg\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/IntesaKyndryl\",\"https:\\\/\\\/www.instagram.com\\\/intesa_kyndryl\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCIagCWkVwcf-4fJc42lmCGg\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/intesa-kyndryl\\\/\"]},{\"@type\":\"Person\",\"@id\":\"#author\",\"name\":\"etinet\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fb586e1550935173b606deb7c0be713d8f5dba58218d04764d989d3e27de33f9?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"etinet\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#webpage\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/\",\"name\":\"NIS2 Directive in Italy: obligations, deadlines, penalties\",\"description\":\"NIS2 in Italy: who must comply, Legislative Decree 138\\\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/ArtSEO_CybersecurityAct2NIS2.png\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#mainImage\",\"width\":1300,\"height\":530,\"caption\":\"Lucchetto metallico su circuito elettronico digitale, a tema direttiva NIS2 e cybersecurity\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/nis2-directive-in-italy-obligations-deadlines-penalties\\\/#mainImage\"},\"datePublished\":\"2026-03-12T14:24:13+01:00\",\"dateModified\":\"2026-10-15T17:00:50+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/\",\"name\":\"Intesa (Havant Group)\",\"alternateName\":\"In.Te.S.A. S.p.A.\",\"description\":\"Soluzioni per la trasformazione digitale delle aziende.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intesa.it\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>NIS2 Directive in Italy: obligations, deadlines, penalties<\/title>\n\n","aioseo_head_json":{"title":"NIS2 Directive in Italy: obligations, deadlines, penalties","description":"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.","canonical_url":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#article","name":"NIS2 Directive in Italy: obligations, deadlines, penalties","headline":"NIS2 Directive in Italy: obligations, deadlines, penalties","author":{"@id":"#author"},"publisher":{"@id":"https:\/\/www.intesa.it\/en\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.intesa.it\/wp-content\/uploads\/2026\/03\/ArtSEO_CybersecurityAct2NIS2.png","width":1300,"height":530,"caption":"Lucchetto metallico su circuito elettronico digitale, a tema direttiva NIS2 e cybersecurity"},"datePublished":"2026-03-12T14:24:13+01:00","dateModified":"2026-10-15T17:00:50+02:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#webpage"},"isPartOf":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#webpage"},"articleSection":"Regulations, cybersecurity, Opzionale"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/www.intesa.it\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/category\/regulations\/#listItem","name":"Regulations"}},{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/category\/regulations\/#listItem","position":2,"name":"Regulations","item":"https:\/\/www.intesa.it\/en\/category\/regulations\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#listItem","name":"NIS2 Directive in Italy: obligations, deadlines, penalties"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#listItem","position":3,"name":"NIS2 Directive in Italy: obligations, deadlines, penalties","previousItem":{"@type":"ListItem","@id":"https:\/\/www.intesa.it\/en\/category\/regulations\/#listItem","name":"Regulations"}}]},{"@type":"FAQPage","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#faq","url":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/","mainEntity":[{"@type":"Question","name":"Cos\u2019\u00e8 la Direttiva NIS2?","acceptedAnswer":{"@type":"Answer","text":"La Direttiva NIS2 \u00e8 la normativa europea che rafforza gli obblighi di sicurezza informatica per le organizzazioni che operano in settori strategici. Introduce requisiti pi\u00f9 stringenti su gestione del rischio cyber, governance aziendale, notifica degli incidenti e resilienza operativa."}},{"@type":"Question","name":"Chi \u00e8 obbligato ad adeguarsi alla NIS2?","acceptedAnswer":{"@type":"Answer","text":"Sono soggette alla NIS2 le Entit\u00e0 Essenziali e Importanti, identificate in base a criteri dimensionali e settoriali (energia, trasporti, sanit\u00e0, infrastrutture digitali, servizi ICT, finanza, PA). Anche le PMI possono essere coinvolte indirettamente se fanno parte della supply chain di un soggetto obbligato."}},{"@type":"Question","name":"Quali sono gli obblighi principali della Direttiva NIS2?","acceptedAnswer":{"@type":"Answer","text":"Gli obblighi principali della Direttiva NIS2 includono l\u2019adozione di misure tecniche e organizzative adeguate, la gestione strutturata del rischio informatico, la notifica degli incidenti entro 24 ore, l\u2019implementazione di piani di continuit\u00e0 operativa e la responsabilit\u00e0 diretta dei vertici aziendali nella governance della sicurezza."}},{"@type":"Question","name":"Quali sono le sanzioni previste dalla NIS2?","acceptedAnswer":{"@type":"Answer","text":"Le sanzioni possono arrivare fino a: 10 milioni di euro o 2% del fatturato globale per le Entit\u00e0 Essenziali 7 milioni di euro o 1,4% del fatturato globale per le Entit\u00e0 Importanti Oltre alle sanzioni economiche, sono previste misure correttive e responsabilit\u00e0 dei vertici aziendali."}},{"@type":"Question","name":"Qual \u00e8 il ruolo dell\u2019ACN in Italia?","acceptedAnswer":{"@type":"Answer","text":"L\u2019Agenzia per la Cybersicurezza Nazionale (ACN) \u00e8 l\u2019autorit\u00e0 competente per: Identificare i soggetti obbligati Ricevere le notifiche di incidente Effettuare ispezioni Applicare sanzioni Le organizzazioni devono quindi essere in grado di dimostrare in modo documentato le misure adottate."}},{"@type":"Question","name":"La NIS2 sostituisce la precedente Direttiva NIS?","acceptedAnswer":{"@type":"Answer","text":"S\u00ec. La NIS2 abroga e sostituisce la Direttiva NIS del 2016, ampliando il perimetro dei soggetti coinvolti e introducendo requisiti pi\u00f9 severi in termini di governance, gestione del rischio e supply chain security."}},{"@type":"Question","name":"Come si coordina la NIS2 con il Cybersecurity Act?","acceptedAnswer":{"@type":"Answer","text":"La NIS2 impone obblighi organizzativi e di gestione del rischio. Il Cybersecurity Act introduce schemi europei di certificazione per prodotti e servizi ICT. Insieme, contribuiscono a costruire un modello europeo di sicurezza digitale integrata."}},{"@type":"Question","name":"Cos\u2019\u00e8 la Direttiva NIS2?","acceptedAnswer":{"@type":"Answer","text":"La Direttiva NIS2 \u00e8 la normativa europea che rafforza gli obblighi di sicurezza informatica per le organizzazioni che operano in settori strategici. Introduce requisiti pi\u00f9 stringenti su gestione del rischio cyber, governance aziendale, notifica degli incidenti e resilienza operativa."}},{"@type":"Question","name":"Chi \u00e8 obbligato ad adeguarsi alla NIS2?","acceptedAnswer":{"@type":"Answer","text":"Sono soggette alla NIS2 le Entit\u00e0 Essenziali e Importanti, identificate in base a criteri dimensionali e settoriali (energia, trasporti, sanit\u00e0, infrastrutture digitali, servizi ICT, finanza, PA). Anche le PMI possono essere coinvolte indirettamente se fanno parte della supply chain di un soggetto obbligato."}},{"@type":"Question","name":"Quali sono gli obblighi principali della Direttiva NIS2?","acceptedAnswer":{"@type":"Answer","text":"Gli obblighi principali della Direttiva NIS2 includono l\u2019adozione di misure tecniche e organizzative adeguate, la gestione strutturata del rischio informatico, la notifica degli incidenti entro 24 ore, l\u2019implementazione di piani di continuit\u00e0 operativa e la responsabilit\u00e0 diretta dei vertici aziendali nella governance della sicurezza."}},{"@type":"Question","name":"Quali sono le sanzioni previste dalla NIS2?","acceptedAnswer":{"@type":"Answer","text":"Le sanzioni possono arrivare fino a: 10 milioni di euro o 2% del fatturato globale per le Entit\u00e0 Essenziali 7 milioni di euro o 1,4% del fatturato globale per le Entit\u00e0 Importanti Oltre alle sanzioni economiche, sono previste misure correttive e responsabilit\u00e0 dei vertici aziendali."}},{"@type":"Question","name":"Qual \u00e8 il ruolo dell\u2019ACN in Italia?","acceptedAnswer":{"@type":"Answer","text":"L\u2019Agenzia per la Cybersicurezza Nazionale (ACN) \u00e8 l\u2019autorit\u00e0 competente per: Identificare i soggetti obbligati Ricevere le notifiche di incidente Effettuare ispezioni Applicare sanzioni Le organizzazioni devono quindi essere in grado di dimostrare in modo documentato le misure adottate."}},{"@type":"Question","name":"La NIS2 sostituisce la precedente Direttiva NIS?","acceptedAnswer":{"@type":"Answer","text":"S\u00ec. La NIS2 abroga e sostituisce la Direttiva NIS del 2016, ampliando il perimetro dei soggetti coinvolti e introducendo requisiti pi\u00f9 severi in termini di governance, gestione del rischio e supply chain security."}},{"@type":"Question","name":"Come si coordina la NIS2 con il Cybersecurity Act?","acceptedAnswer":{"@type":"Answer","text":"La NIS2 impone obblighi organizzativi e di gestione del rischio. Il Cybersecurity Act introduce schemi europei di certificazione per prodotti e servizi ICT. Insieme, contribuiscono a costruire un modello europeo di sicurezza digitale integrata."}}],"inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intesa.it\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#breadcrumblist"}},{"@type":"Organization","@id":"https:\/\/www.intesa.it\/en\/#organization","name":"Intesa","description":"Intesa \u00e8 un digital solution provider che progetta e realizza soluzioni per la digitalizzazione dei processi aziendali. Accompagna le imprese nella trasformazione digitale attraverso piattaforme sicure, scalabili e conformi alle normative. La sua mission \u00e8 rendere l\u2019innovazione accessibile, sostenibile e centrata sulle persone, integrando tecnologia, design e servizi fiduciari. Societ\u00e0 Benefit dal 2020, Intesa promuove un business etico, trasparente e attento al benessere aziendale e ambientale.","url":"https:\/\/www.intesa.it\/en\/","email":"INTESA@pec.trustedmail.intesa.it","telephone":"+390239309066","logo":{"@type":"ImageObject","url":"https:\/\/intesa.it\/wp-content\/uploads\/2025\/11\/Logo-Intesa-a-Kyndryl-Company-In.Te_.S.A.-S.p.A.svg","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#organizationLogo"},"image":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/IntesaKyndryl","https:\/\/www.instagram.com\/intesa_kyndryl\/","https:\/\/www.youtube.com\/channel\/UCIagCWkVwcf-4fJc42lmCGg","https:\/\/www.linkedin.com\/company\/intesa-kyndryl\/"]},{"@type":"Person","@id":"#author","name":"etinet","image":{"@type":"ImageObject","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/fb586e1550935173b606deb7c0be713d8f5dba58218d04764d989d3e27de33f9?s=96&d=mm&r=g","width":96,"height":96,"caption":"etinet"}},{"@type":"WebPage","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#webpage","url":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/","name":"NIS2 Directive in Italy: obligations, deadlines, penalties","description":"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intesa.it\/en\/#website"},"breadcrumb":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/www.intesa.it\/wp-content\/uploads\/2026\/03\/ArtSEO_CybersecurityAct2NIS2.png","@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#mainImage","width":1300,"height":530,"caption":"Lucchetto metallico su circuito elettronico digitale, a tema direttiva NIS2 e cybersecurity"},"primaryImageOfPage":{"@id":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/#mainImage"},"datePublished":"2026-03-12T14:24:13+01:00","dateModified":"2026-10-15T17:00:50+02:00"},{"@type":"WebSite","@id":"https:\/\/www.intesa.it\/en\/#website","url":"https:\/\/www.intesa.it\/en\/","name":"Intesa (Havant Group)","alternateName":"In.Te.S.A. S.p.A.","description":"Soluzioni per la trasformazione digitale delle aziende.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.intesa.it\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Intesa | Soluzioni per la trasformazione digitale delle aziende.","og:type":"article","og:title":"NIS2 Directive in Italy: obligations, deadlines, penalties","og:description":"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.","og:url":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/","article:published_time":"2026-03-12T13:24:13+00:00","article:modified_time":"2026-10-15T15:00:50+00:00","article:publisher":"https:\/\/www.facebook.com\/IntesaKyndryl","twitter:card":"summary","twitter:title":"NIS2 Directive in Italy: obligations, deadlines, penalties","twitter:description":"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide."},"aioseo_meta_data":{"post_id":"10443","title":"NIS2 Directive in Italy: obligations, deadlines, penalties","description":"NIS2 in Italy: who must comply, Legislative Decree 138\/2024 obligations, ACN deadlines for 2026-2027, incident reporting and penalties. A practical guide.","keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[{"hidden":false,"question":"Cos\u2019\u00e8 la Direttiva NIS2?","schemaBlockId":"aioseo-mmkae6i6","tagName":"h3","answer":"La Direttiva NIS2 \u00e8 la normativa europea che rafforza gli obblighi di sicurezza informatica per le organizzazioni che operano in settori strategici. Introduce requisiti pi\u00f9 stringenti su gestione del rischio cyber, governance aziendale, notifica degli incidenti e resilienza operativa.","type":"aioseo\/faq"},{"hidden":false,"question":"Chi \u00e8 obbligato ad adeguarsi alla NIS2?","schemaBlockId":"aioseo-mmkaeivs","tagName":"h3","answer":"Sono soggette alla NIS2 le Entit\u00e0 Essenziali e Importanti, identificate in base a criteri dimensionali e settoriali (energia, trasporti, sanit\u00e0, infrastrutture digitali, servizi ICT, finanza, PA). Anche le PMI possono essere coinvolte indirettamente se fanno parte della supply chain di un soggetto obbligato.","type":"aioseo\/faq"},{"hidden":false,"question":"Quali sono gli obblighi principali della Direttiva NIS2?","schemaBlockId":"aioseo-mmkaim66","tagName":"h3","answer":"Gli obblighi principali della Direttiva NIS2 includono l\u2019adozione di misure tecniche e organizzative adeguate, la gestione strutturata del rischio informatico, la notifica degli incidenti entro 24 ore, l\u2019implementazione di piani di continuit\u00e0 operativa e la responsabilit\u00e0 diretta dei vertici aziendali nella governance della sicurezza.","type":"aioseo\/faq"},{"hidden":false,"question":"Quali sono le sanzioni previste dalla NIS2?","schemaBlockId":"aioseo-mmkaizyq","tagName":"h3","answer":"Le sanzioni possono arrivare fino a: 10 milioni di euro o 2% del fatturato globale per le Entit\u00e0 Essenziali 7 milioni di euro o 1,4% del fatturato globale per le Entit\u00e0 Importanti Oltre alle sanzioni economiche, sono previste misure correttive e responsabilit\u00e0 dei vertici aziendali.","type":"aioseo\/faq"},{"hidden":false,"question":"Qual \u00e8 il ruolo dell\u2019ACN in Italia?","schemaBlockId":"aioseo-mmkajes3","tagName":"h3","answer":"L\u2019Agenzia per la Cybersicurezza Nazionale (ACN) \u00e8 l\u2019autorit\u00e0 competente per: Identificare i soggetti obbligati Ricevere le notifiche di incidente Effettuare ispezioni Applicare sanzioni Le organizzazioni devono quindi essere in grado di dimostrare in modo documentato le misure adottate.","type":"aioseo\/faq"},{"hidden":false,"question":"La NIS2 sostituisce la precedente Direttiva NIS?","schemaBlockId":"aioseo-mmkb5p71","tagName":"h3","answer":"S\u00ec. La NIS2 abroga e sostituisce la Direttiva NIS del 2016, ampliando il perimetro dei soggetti coinvolti e introducendo requisiti pi\u00f9 severi in termini di governance, gestione del rischio e supply chain security.","type":"aioseo\/faq"},{"hidden":false,"question":"Come si coordina la NIS2 con il Cybersecurity Act?","schemaBlockId":"aioseo-mmkb6iz2","tagName":"h3","answer":"La NIS2 impone obblighi organizzativi e di gestione del rischio. Il Cybersecurity Act introduce schemi europei di certificazione per prodotti e servizi ICT. Insieme, contribuiscono a costruire un modello europeo di sicurezza digitale integrata.","type":"aioseo\/faq"}],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":false,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":0,"frequency":"default","location":null,"local_seo":null,"seo_analyzer_scan_date":"2026-10-15 15:01:47","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-15 14:54:34","updated":"2026-10-15 15:01:47"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intesa.it\/en\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intesa.it\/en\/category\/regulations\/\" title=\"Regulations\">Regulations<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tNIS2 Directive in Italy: obligations, deadlines, penalties\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.intesa.it\/en\/"},{"label":"Regulations","link":"https:\/\/www.intesa.it\/en\/category\/regulations\/"},{"label":"NIS2 Directive in Italy: obligations, deadlines, penalties","link":"https:\/\/www.intesa.it\/en\/nis2-directive-in-italy-obligations-deadlines-penalties\/"}],"_links":{"self":[{"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/posts\/10443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/comments?post=10443"}],"version-history":[{"count":7,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/posts\/10443\/revisions"}],"predecessor-version":[{"id":10452,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/posts\/10443\/revisions\/10452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/media\/10442"}],"wp:attachment":[{"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/media?parent=10443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/categories?post=10443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intesa.it\/en\/wp-json\/wp\/v2\/tags?post=10443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}