NIS2: you don’t obtain it, you comply with it. And the deadlines are close.
NIS2 is the European directive on cybersecurity; in Italy it has applied since 16 October 2024 through D.Lgs. 138/2024. It is not a certification: it is an obligation for essential and important entities, supervised by ACN, Italy’s National Cybersecurity Agency.
What it is
Security measures, incidents notified, management accountable.
NIS2 requires essential and important entities to take cyber risk management measures and to notify significant incidents. In Italy, ACN sets the baseline measures through its determinations, and compliance is measured on the implementation of all their requirements.
Who needs it
- The entities covered by the decree, which register on the ACN platform
- Their management bodies, which approve the measures and are accountable for them
- Relevant suppliers: from 2026, NIS entities list them on the ACN platform
- Entities included by ACN in 2025 or in 2026, with different deadlines
What it requires, and what you risk
Registration or update on the ACN platform every year from 1 January to 28 February; detailed data is updated from 15 April to 31 May.
D.Lgs. 138/2024, art. 7Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month.
D.Lgs. 138/2024, art. 25 c. 5For entities included in 2025, the security measures must be implemented within 18 months of the notice of inclusion, that is by October 2026; for those included in 2026, by July 2027.
ACN, modalità e specifiche di base; determinazione 127434/2026Fines of up to 10 million euros or 2% of worldwide turnover for essential entities, and up to 7 million or 1.4% for important ones, whichever is higher. Management bodies are liable for violations.
D.Lgs. 138/2024, art. 38 c. 9 and art. 23
The path
What you need to do, in order.
- 1
Find out if you’re in scope
If you are a NIS entity, you register on the ACN platform, which every year communicates inclusion, retention or exclusion.
- 2
Involve management
The management bodies approve how the measures are implemented, oversee their implementation and take part in training.
- 3
Implement the baseline measures
All the requirements of the ACN measures that apply to you, by the deadline of your phase.
- 4
Notify and update
Incidents notified within the legal deadlines, registration renewed every year, relevant suppliers on the platform.
10ISO
How 10ISO will help you
The agents will do the work that repeats itself; decisions stay with you and whoever supports you. 10ISO is coming soon: this is what we’re building.
- ACN’s baseline measures as a list of what’s missing, requirement by requirementComing soon
- The deadlines of your phase in a single calendar: registration, updates, measuresComing soon
- Evidence shared with ISO/IEC 27001 and ISO 22301, uploaded onceComing soon
- Incidents recorded with their notification times: 24 hours, 72 hours, one monthComing soon
Questions
The first questions people ask about NIS2.
Can I get “NIS2 certified”?
No: it is a legal obligation checked by ACN, not a certification scheme. ISO/IEC 27001 helps, and UNI/PdR 174:2025 acts as a bridge, but compliance is measured against the ACN measures.
When do I have to register?
Every year from 1 January to 28 February, on the ACN platform. Detailed information is updated from 15 April to 31 May.
Who pays if an entity doesn’t comply?
The entity, with fines of up to 10 million euros or 2% of turnover (essential entities) and up to 7 million or 1.4% (important entities). Directors are liable for violations, and if the entity fails to comply with formal warnings, a temporary ban from management functions may follow.
Sources
Every reference on this fact sheet comes from one of these sources, checked on 28/09/2026. If a law or a standard changes, the fact sheet is updated.
Sources
- Directive (EU) 2022/2555, NIS2 (EUR-Lex) (opens in a new tab)
- D.Lgs. 138/2024, art. 7 — registrazione (Normattiva) (opens in a new tab)
- D.Lgs. 138/2024, art. 23 — organi di amministrazione (Normattiva) (opens in a new tab)
- D.Lgs. 138/2024, art. 25 — notifica degli incidenti (Normattiva) (opens in a new tab)
- D.Lgs. 138/2024, art. 38 — sanzioni (Normattiva) (opens in a new tab)
- ACN — modalità e specifiche di base (opens in a new tab)
- ACN — FAQ NIS su misure di sicurezza e notifica degli incidenti (opens in a new tab)
- ACN — le determinazioni 2026 per i nuovi soggetti (opens in a new tab)
- ACN — UNI/PdR 174:2025 (opens in a new tab)
Waiting list
We’ll write to you when 10ISO opens.
One minute: who you are, your email and the standard you’re interested in. It’s not a subscription and we don’t ask for a card.