In Italy, NIS2 applies to medium-sized and large companies operating in the sectors listed in D.Lgs. 138/2024, the Italian law transposing the directive, plus some categories that are covered regardless of size (such as many public administrations and providers of communications networks). Organisations in scope must register every year on the platform of ACN, Italy's National Cybersecurity Agency, adopt the baseline security measures, notify significant incidents to CSIRT Italia and directly involve top management.
What NIS2 is and how it reached Italy
NIS2 is Directive (EU) 2022/2555, which replaced the first NIS directive of 2016 and greatly widened the number of organisations involved. Italy transposed it with Legislative Decree no. 138 of 4 September 2024, in force since 16 October 2024. The competent national authority is the Agenzia per la Cybersicurezza Nazionale (ACN), which also acts as the single point of contact; CSIRT Italia, the national CSIRT that operates within ACN, receives incident notifications.
The decree sets out the principles. The operational details (what to do, by when, and how) come from ACN determinations, which are updated over time. So whenever you read an article on NIS2, always check the date: a text from 2025 may refer to specifications that have since been replaced.
NIS2: who must comply, by sector and size
To work out whether NIS2 applies to you, you need to answer two questions: which sector you operate in and how big you are. The decree lists the sectors in four annexes.
- Annex I, sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), space.
- Annex II, other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment), digital providers, research.
- Annex III, public administrations: the categories of administrations to which the decree applies regardless of size.
- Annex IV, further types of entity: categories that are in scope only if identified by ACN under the decree's procedures.
The size-cap rule
For the sectors in Annexes I and II, the general rule is the size-cap rule: the decree applies to organisations that exceed the ceilings for small enterprises, that is to medium-sized and large enterprises as defined in European Recommendation 2003/361/EC. In short, a company is medium-sized if it has at least 50 employees, or annual turnover and an annual balance sheet total above 10 million euros; it is large if it has at least 250 employees, or exceeds both 50 million in turnover and 43 million on the balance sheet.
The count does not concern the individual company alone: the recommendation also takes into account partner and linked enterprises. The decree does, however, provide a proportionality safety valve: group figures may be disregarded when the company is independent of its linked enterprises as regards its information systems and the services it provides. This assessment needs to be made carefully, and justified.
Who is in scope regardless of size
Some entities are covered even if they are small: critical entities identified under Directive (EU) 2022/2557, providers of public electronic communications networks and publicly available electronic communications services, trust service providers, top-level domain name registries, DNS service providers and domain name registration service providers, and the public administrations in Annex III. ACN can also include entities that are the sole national provider of an essential service or whose disruption would have a significant impact on security or the economy.
Watch out for group companies. The decree can also extend to companies linked to a NIS entity that take decisions on its cyber security, manage the systems supporting its services or provide it with IT and security services. Anyone who runs IT for a group would do well to check this.
Essential and important entities: the differences
Organisations in scope of NIS2 are classified as essential entities or important entities. As a general rule, essential entities are large companies in the Annex I sectors, medium-sized providers of electronic communications, qualified trust service providers, top-level domain name registries, critical entities and central government administrations. Important entities are all the other organisations in scope: for example a medium-sized company in Annex I, or a medium-sized or large company in an Annex II sector, such as a manufacturer.
| Aspect | Essential entities | Important entities |
|---|---|---|
| Who they are, in general | Large companies in Annex I and categories specified by the decree (critical entities, qualified trust services, top-level domains, central administrations) | The other entities in scope: medium-sized companies in Annex I, medium-sized and large companies in Annex II, other administrations |
| Supervision | Ex ante and ex post: ACN can carry out checks even without an incident | Ex post: triggered by evidence of possible non-compliance |
| Baseline security measures | A specific annex of the ACN determinations, with a larger number of requirements | A specific annex, with a smaller set of requirements |
| Incident notification | Pre-notification within 24 hours, notification within 72 hours, final report within one month | Same deadlines as essential entities |
| Maximum fine | Up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher | Up to 7 million euros or 1.4% of total worldwide annual turnover, whichever is higher |
For details of the obligations of the two categories, see the dedicated pages: NIS2 for essential entities and NIS2 for important entities.
Annual registration on the ACN platform
NIS2 in Italy starts from a self-assessment: it is the organisation itself that has to work out whether it is in scope and register. The first registration had to be made by 28 February 2025; since then the window repeats every year from 1 January to 28 February, on the ACN services portal, through a point of contact designated by the organisation.
After registration, ACN communicates inclusion in the list of NIS entities and the category assigned. Further annual deadlines follow: from 15 April to 31 May the information required by Article 7 of the decree must be submitted or updated (including the members of the management bodies and the contact person for CSIRT Italia), and ACN has set a summer window for categorising activities and services. If any information changes during the year, it must be updated promptly.
The calendar changes. The windows given here are those in force in October 2026. Before every deadline, check the NIS section of the ACN portal (in Italian).
NIS2 obligations: the baseline measures and when they apply
The substantive obligations are in Articles 23, 24 and 25 of the decree: responsibility of the management bodies, risk management measures, incident notification. The measures required cover, among other things, risk analysis and security policies, incident handling, business continuity and backup, supply chain security, vulnerability management, cyber hygiene and training, cryptography, access control and multi-factor authentication.
ACN has translated these principles into baseline specifications. The current reference is determination no. 379907 of 2025, applicable from 15 January 2026, which replaced determination no. 164179 of 14 April 2025. It contains separate annexes for important and essential entities, both for security measures and for the significant incidents to be notified.
Phased application
- Entities included in the list in 2025: 9 months from the notice of inclusion for the notification obligation (in effect from January 2026) and 18 months to adopt the baseline measures, so by October 2026.
- Entities included for the first time in 2026: under determination no. 127434 of 2026, incident notification from 1 January 2027 and baseline measures by 31 July 2027.
The deadline is calculated from the date on which you received the notice of inclusion: check it on your own notice, not against a date you read somewhere else. And remember that "adopting" does not mean writing procedures: it means being able to show, with evidence, that the measures work. The natural starting point is a documented risk analysis.
Incident notification: 24 hours, 72 hours, one month
Incidents with a significant impact must be notified to CSIRT Italia in three stages:
- Pre-notification within 24 hours of becoming aware of the incident, stating whether unlawful action or a cross-border impact is suspected.
- Notification within 72 hours, which updates the information and provides an initial assessment of severity and impact and, where available, the indicators of compromise.
- Final report within one month of the notification, with a detailed description, the probable cause and the measures taken. CSIRT Italia can ask for intermediate reports.
The ACN determinations describe which baseline incidents are considered significant for each category. If the incident involves personal data, there is also the notification to the Garante (the Italian Data Protection Authority) required by the GDPR within 72 hours: these are two different obligations, with different recipients. We cover this in the guide on data breaches and the 72 hours.
Meeting these deadlines requires two things prepared in advance: who decides and who writes the notification, and the data to reconstruct what happened. Without centralised logs, the 72-hour notification becomes an exercise in guesswork: we explain why in the guide what is a SIEM.
Management bodies and training
NIS2 moves cyber security into the boardroom. Article 23 of the decree provides that management and governing bodies:
- approve how the risk management measures are implemented;
- oversee their implementation and are responsible in the event of infringements;
- undergo training in cyber security and promote regular training for employees;
- are informed regularly or, where necessary, promptly about incidents and notifications.
In practice you need board resolutions, minutes and a training record showing that top management and staff really have been trained. For staff, training goes hand in hand with awareness of phishing, which remains one of the most common attack vectors.
The fines
For infringements of the risk management and notification obligations, the decree provides for administrative fines of up to 10 million euros or 2% of total worldwide annual turnover for essential entities and up to 7 million euros or 1.4% for important entities, whichever amount is higher. Lower fines apply to infringements of other obligations, such as those on registration and on providing information.
In addition to financial penalties, ACN can issue warnings, orders and injunctions, and the decree provides for measures that can affect individuals with management functions. The logic of the law is clear: responsibility cannot be delegated to the IT supplier.
Not a NIS2 entity, but a supplier to one?
A great many small businesses are not in scope of NIS2, but they come across it all the same: as suppliers. Supply chain security is one of the mandatory measures, and NIS entities must assess the suppliers that have access to their systems or provide services they depend on. The 2026 ACN determinations gave this point even more weight, asking NIS entities to identify their relevant suppliers.
For a supplier, this translates into security questionnaires, contract clauses, requests for evidence (procedures, scan results, staff training) and sometimes audits. A software house, a managed service provider or a maintenance company may be asked for measures very similar to those of a NIS entity. The reason is a practical one: supply chain attacks often come in through the weakest link.
If you receive questionnaires from customers, you will find a practical guide on the page about customer security questionnaires. If instead you are the one who has to qualify suppliers, the Supply Chain module collects answers and evidence.
How Dottor Box helps
Dottor Box does not decide for you whether you are in scope of NIS2: that assessment has to be made on the company's own data and, in doubtful cases, with a consultant. It helps you with what comes next, that is building and demonstrating the system that is required:
- the NIS2 self-assessment measures how far you are from the requirements, with a score for each security function;
- Compliance and GRC generates policies and procedures and keeps them versioned;
- Incident Response organises the internal CSIRT and the event register with the phases to follow;
- Vulnerability Assessment and Business continuity produce the technical evidence and the backup checks.
The complete path is described on the NIS2 compliance page.