NIS2 for essential entities
From checking how far you are from the requirements to the procedures, the technical evidence and the incident register that the authority can ask you for at any time.
Are you an essential entity?
The NIS2 Directive, transposed into Italian law, divides organisations into essential entities and important entities according to sector and size. As an EU directive, it applies in every member state through national law; this page refers to the Italian transposition. The essential sectors include energy, transport, health, water, digital infrastructure and public administration.
For essential entities the difference is concrete: supervision is proactive, meaning the authority can carry out checks at any time, even without an incident, and the maximum fines are higher than for important entities.
If your organisation is instead an important entity, you will find the dedicated path on the NIS2 for important entities page.
The main NIS2 requirements
NIS2 does not ask for a document: it asks for a management system that works and can be demonstrated. And responsibility falls directly on the management bodies.
- Cybersecurity risk management measures
- Information system security policies
- Incident handling, with tight notification deadlines
- Business continuity, backups and crisis management
- Supply chain security
- Basic cyber hygiene and staff training
- Use of cryptography
- Human resources security and access control
- Multi-factor authentication
- Direct accountability of the management bodies
From the gap to the evidence, in a single path
It starts with the self-assessment, which tells you as a percentage how much is missing and in which security functions. Then every requirement has the tool that covers it.
| NIS2 requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the requirements of the directive, with a score by function and a simulation of the effect of the services activated |
| Risk management | Risk Assessment with a threat catalogue, treatment plan and residual risk |
| Policies and procedures | Compliance and GRC: NIS2 policies and procedures generated and kept under version control |
| Incidents and notifications | Incident Response and the data breach register, with the phases and the deadlines to meet |
| Supply chain | Supply Chain: qualification questionnaires that suppliers complete from a link |
| Cyber hygiene and training | Training and Cyber Awareness, with the record of courses ready to show |
| Technical evidence | Vulnerability Assessment, Asset Management and the Microsoft Entra ID and Google Workspace security postures |
| Business continuity | Business continuity: BIA, continuity plan and backup checks |
A system you can show to the authority
You know where you stand
You understand which category you fall into and what changes for you, with a measurable score to improve.
A score by function
A self-assessment on the requirements of the directive, broken down into the Identify, Protect, Detect, Respond and Recover functions.
Living procedures
The required policies and procedures, generated and maintained in the platform, with versions tracked.
Everything in one place
Supplier qualification, staff training and the incident register, ready when you need them.
At the end of the path you do not have a formal box-ticking exercise, but the evidence you need when the authority asks for it.
Frequently asked questions about NIS2 for essential entities
How do I know whether I am a NIS2 essential entity?
In general, essential entities are large companies in highly critical sectors, meaning those with at least 250 employees or with turnover above 50 million euros and a balance sheet above 43 million, plus certain entities regardless of size. The assessment starts with you: in Italy you register on the platform of ACN, Italy's National Cybersecurity Agency, which tells you whether you are included and in which category. Find out more in the guide NIS2: who must comply.
What fines does an essential entity face?
Up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. The directive also allows the authorities, in the most serious cases, to take measures against people with management functions, up to a temporary ban from holding the position. The Italian transposition adopts these maximums.
How soon must a significant incident be notified?
An early warning to CSIRT Italia, Italy's national computer security incident response team, within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month. To meet these deadlines you need roles already assigned and an event register ready to go: that is the job of the Incident Response module.
Is a vulnerability assessment mandatory under NIS2?
Among the minimum measures, the directive includes vulnerability handling and disclosure and procedures to assess the effectiveness of security measures. It does not prescribe a specific tool, but without a regular vulnerability assessment it is hard to demonstrate either. With proactive supervision, the scan history is evidence ready to show.
What responsibilities do company directors have?
The management bodies must approve the risk management measures, oversee their implementation and follow cybersecurity training, and they can be held liable for infringements. That is why you need documents that non-technical people can read too, such as the Cyber Risk Report.
The modules that work for NIS2
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.