NIS2 for important entities
Supervision after the event does not mean lighter obligations. Security measures, incident notification and supplier oversight are the same: what changes is when someone comes to check them.
Are you a NIS2 important entity?
The NIS2 Directive, transposed in Italy by Legislative Decree 138/2024 (D.Lgs. 138/2024, the Italian law transposing NIS2), divides organisations into essential entities and important entities according to sector and size. As an EU directive, it applies in every member state through national law. The important entities category is the broadest and the most cross-cutting: it is the one many Italian medium-sized companies fall into.
Typical sectors for important entities include postal and courier services, waste management, chemicals, food production and distribution, manufacturing (for example machinery, electronics, medical devices, vehicles), digital service providers and research. Medium-sized companies in highly critical sectors, where large companies are instead essential, can also be important entities.
If your organisation is a large company in energy, transport, health, water or digital infrastructure, check the NIS2 for essential entities page: there, supervision is proactive.
What changes for important entities
The difference is not in what you have to do, but in how and when the authority checks it, and in how heavy the fines are.
| Aspect | Important entities | Essential entities |
|---|---|---|
| Security measures | The same risk management measures | The same risk management measures |
| Notification of significant incidents | The same obligations and the same deadlines | The same obligations and the same deadlines |
| Supervision | After the event (ex post): triggered when evidence, reports or an incident come to light | Proactive (ex ante): checks possible at any time |
| Maximum fines | Lower: in the directive, up to 7 million euros or 1.4% of total worldwide annual turnover | Higher: in the directive, up to 10 million euros or 2% of total worldwide annual turnover |
Ex post supervision is a different risk, not a smaller one: when the authority arrives, it usually arrives after an incident, and asks you to prove that the measures were already in place. The evidence has to be built beforehand.
NIS2 obligations for important entities
As for essential entities, NIS2 asks for a management system that works and can be demonstrated, with responsibility resting with the management bodies.
- Risk analysis and information system security policies
- Incident handling, with an early warning within 24 hours and notification within 72 hours
- Business continuity, backups and crisis management
- Security of the supply chain and of ICT suppliers
- Security in the acquisition, development and maintenance of systems
- Vulnerability handling and assessment of the effectiveness of measures
- Basic cyber hygiene and staff training
- Cryptography, access control and multi-factor authentication
- Training and accountability of the management bodies
- Registration and updating of details with ACN, Italy's National Cybersecurity Agency
NIS2 compliance: from the gap to the evidence
The NIS2 self-assessment measures the distance from the requirements in terms of coverage and maturity. Then every requirement has the module that covers it and leaves a record.
| NIS2 requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the requirements for important entities, with a score by function and a simulation of the services to activate |
| Risk analysis | Risk Assessment with a preloaded threat catalogue, treatment plan and residual risk |
| Policies and procedures | Compliance and GRC: NIS2 procedures written in the platform, versioned, with evidence that reopens when it falls due |
| Incidents and notifications | Incident Response and Data Breach: a CSIRT with assigned roles, incident phases tracked |
| Supply chain | Supply Chain: qualification questionnaires that suppliers complete from a link, with evidence attached |
| Vulnerability handling | Internal and external Vulnerability Assessment, with history and comparison between scans |
| Access and MFA | Microsoft Entra ID and Google Workspace security postures: privileges, two-step verification, third-party apps |
| Training and cyber hygiene | Training with the record of courses and Cyber Awareness with simulated phishing run by Dottor Marc |
| Continuity and backups | Business continuity: BIA, continuity plan and backup checks |
Ready when the check comes afterwards
You know your category
You understand what changes for an important entity and on which requirements you are furthest behind.
An index to improve
A NIS2 score based on coverage and maturity, broken down into the five security functions.
Dated evidence
Versioned procedures, closed risk analysis campaigns and archived reports: they prove what was in place before the incident.
Qualified suppliers
Questionnaires sent, answers and evidence collected in one place, with the status of each supplier.
With ex post supervision the question is not "are you ready for the inspection?", but "can you prove what you were doing on the day of the incident?". Dottor Box keeps the answer.
Frequently asked questions about NIS2 for important entities
How can I tell whether my company is a NIS2 important entity?
As a rule, important entities are medium-sized companies in the sectors listed by the directive, meaning those with at least 50 employees or with turnover and balance sheet total above 10 million euros, and large companies in the other critical sectors such as manufacturing, food, chemicals and waste. There are exceptions linked to the type of service. In Italy, inclusion is communicated by ACN, the National Cybersecurity Agency, after registration. Find out more in the guide NIS2: who must comply.
When do you have to register on the ACN platform?
Every year, from 1 January to 28 February, entities within the scope of NIS2 in Italy register, or update their registration, on the digital platform of ACN, Italy's National Cybersecurity Agency. Failing to register is itself subject to sanctions.
Why do my customers ask me for NIS2 requirements even though I am not obliged to comply?
Because NIS2 requires the entities in scope to manage the security of their own supply chain, and the requirements reach suppliers through contracts and questionnaires. Answering with evidence instead of declarations makes qualification simpler. See how to deal with customer security questionnaires.
Where do you start with NIS2 compliance?
By measuring the gap: a self-assessment on the requirements tells you how much is missing and in which security functions. Then you tackle the more structural requirements, such as risk analysis, incident handling and suppliers, which take time to build and document. The full path is on the NIS2 compliance page.
Does a medium-sized company have to apply the same measures as a large one?
The measures required are the same, but the directive requires them to be proportionate to the risk, to the size of the organisation and to the possible impact of an incident. A medium-sized company does not have to build an in-house SOC, but it must be able to show that it has assessed its risks and adopted appropriate measures. Cyber security for SMEs.
The modules that work for NIS2
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more ComplianceNIS2 · essential entities
Proactive supervision and higher fines: from the gap to the evidence.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.