NIS2 compliance: what to do, and in what order
Legislative Decree 138/2024, the Italian law transposing NIS2, requires security measures, incident notification within tight deadlines and a management body that is accountable for them. Here you will find the obligations explained in plain words and a phased plan for getting to the evidence.
What NIS2 requires in Italy
The European NIS2 directive was transposed in Italy by Legislative Decree no. 138 of 4 September 2024 (D.Lgs. 138/2024), in force since 16 October 2024. The competent authority is ACN, Italy's National Cybersecurity Agency, which turns the decree into operational requirements and deadlines through its determinations (formal decisions).
The decree divides organisations into essential entities and important entities, according to sector and size. The security obligations are largely the same; what changes is the type of supervision, the number of requirements and the maximum fines. The details are on the pages NIS2 for essential entities and NIS2 for important entities.
If you do not yet know whether you are in scope, start with the guide NIS2: who must comply. This page is for those who know they need to comply and are wondering where to begin: NIS2 compliance is not a document to sign, it is a management system to build and to be able to demonstrate.
NIS2 obligations at a glance
Some obligations are formalities towards ACN, with fixed windows every year. Others are security measures to put in place and maintain over time.
| Obligation | What it means in practice | When |
|---|---|---|
| Registration on the ACN platform | The entity registers on the Agency's services portal and names a point of contact. ACN then notifies the entity of its inclusion in the list of NIS entities. | Every year from 1 January to 28 February |
| Annual update of information | Details of the entity, its management bodies and, from 2026, the list of relevant suppliers, meaning ICT suppliers or those that are not easily replaceable. | Every year from 15 April to 31 May |
| Categorisation of activities and services | The list of the entity's activities and services, using the template set by ACN. | Every year from 1 May to 30 June |
| Baseline security measures | Risk analysis, policies, incident handling, continuity, supply chain, access control, multi-factor authentication, training. The detail is in ACN's determinations on baseline obligations, which differ for important and essential entities. | Within 18 months of the notice of inclusion in the list |
| Notification of significant incidents | To CSIRT Italia, the national computer security incident response team: early warning within 24 hours of becoming aware, notification within 72 hours, final report within one month. | From 9 months after the notice of inclusion |
| Accountability of management bodies | Senior management approves how the measures are implemented, oversees their implementation, follows specific training and is accountable for infringements. | Always |
NIS2 deadlines as of October 2026
The calendar depends on the year in which you were included in the list of NIS entities.
- Included in 2025. The obligation to notify significant incidents has been in effect since January 2026. Baseline security measures must be adopted within 18 months of the notice of inclusion: for those who received it in April 2025, by October 2026.
- Included in 2026. Under ACN determination no. 127434 of 13 April 2026, incident notification applies from 1 January 2027 and baseline measures must be adopted by 31 July 2027.
- Every year, for everyone. Registration or confirmation between January and February, update of details and relevant suppliers between April and May, categorisation between May and June.
The exact dates in your calendar start from the notice you received from ACN, and the Agency regularly updates its determinations and FAQs. Before planning, always check the guidance published on ACN's NIS portal (in Italian).
Accountability of management bodies and fines
Article 23 of the decree takes cyber security to board level. Delegating to IT is not enough: management bodies approve the measures, follow their implementation, receive training and are accountable for infringements.
Administrative fines reach up to €10 million or 2% of total worldwide annual turnover for essential entities and up to €7 million or 1.4% for important entities, whichever is higher. Failure to register and failure to notify an incident can also be fined.
The question the authority asks is not "do you have a procedure?" but "can you show that senior management approved it and that it was being applied?". You need dated decisions, not statements.
The NIS2 compliance plan in five phases
Each phase has a Dottor Box module that supports it and leaves a dated record. You can enable them all or only the ones you are missing.
1. Gap analysis
The NIS2 self-assessment measures the gap from the requirements on two axes, coverage and maturity, with a score for each security function. The simulation tells you where you would get to by enabling a service, before you spend anything.
2. Security measures
Risk Assessment starts from a preloaded threat catalogue and arrives at residual risk. Technical measures are checked with the Vulnerability Assessment, the asset inventory and the Microsoft Entra ID and Google Workspace posture checks, which also verify multi-factor authentication.
3. Evidence and procedures
In the Compliance and GRC module you write policies and procedures with tracked versions, link them to the requirements and have them reopened when they are due for review. The management review minutes are closed with a person's approval: the record that senior management made the decision. Training keeps the record of courses.
4. Incidents
With Incident Response you assign the roles of the internal CSIRT in advance and, when an event happens, follow the phases with an owner for each action. Having roles and phases already decided is what makes it possible to meet the 24-hour and 72-hour deadlines.
5. Suppliers
The Supply Chain module sends suppliers a qualification questionnaire that they complete from a link, with no account, attaching the evidence. It also helps you identify the relevant suppliers to report to ACN.
Software and people, together
An index that moves
The NIS2 score is recalculated as you work: you see which functions are not covered and how much each action has achieved.
Dated evidence
Versioned procedures, completed risk analysis campaigns, reports archived in the Time Machine: they prove what was in place before an inspection or an incident.
Specialists when you need them
With Dottor Marc's consulting you book a specialist for the decisions you should not take alone, such as classifying an incident.
Questions about NIS2 compliance
Which Italian law transposes NIS2?
Legislative Decree no. 138 of 4 September 2024, in force since 16 October 2024. ACN, Italy's National Cybersecurity Agency, is the competent authority and sets out the operational details in its own determinations, such as the one on baseline security measures and significant incidents.
What is the deadline for notifying a significant incident?
An early warning must be sent to CSIRT Italia within 24 hours of becoming aware of the incident, a notification within 72 hours and a final report within one month. The incidents to be notified are those defined as significant by the ACN determination that applies to your category.
What do directors risk if the company does not comply?
The decree makes management bodies responsible for approving and overseeing security measures, and for infringements. In addition to fines on the organisation, the directive provides, for essential entities, measures that can directly affect the people who manage them.
Does Dottor Box do NIS2 compliance for me?
No. Decisions and responsibilities remain with your organisation. Dottor Box measures the gap from the requirements, gives you the tools to close it and keeps the evidence. Dottor Marc supports you with its SOC and with specialist consulting.
I supply a NIS2 entity: does this affect me?
Even if you are not directly obliged, your customers have to check the security of their supply chain and will ask you for questionnaires and evidence. Read how to handle them on the page about customer security questionnaires.
The pages and modules for NIS2
NIS2 · essential entities
Proactive supervision and higher fines: from the gap to the evidence.
Learn more ComplianceNIS2 · important entities
Security measures, incidents and suppliers for important entities.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRisk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.