NIS2 readiness
NIS2 requires the organisations in scope to manage cyber risks, check their suppliers and report significant incidents. Strategic supports the work step by step. First we establish whether and how the rules apply to you. Then we compare what you have with the ACN measures, write the plan and prepare the evidence.
01 · copy the link to this sectionWho it covers
The rules apply directly to some organisations. Many more meet them as suppliers.
NIS2 is the EU Directive (EU) 2022/2555. In Italy it applies through Legislative Decree 138/2024, enforced by the ACN, Italy’s National Cybersecurity Agency. It covers organisations in the sectors listed in the annexes, as a rule medium-sized and large companies. For some activities, such as DNS services, size does not matter.
Italian public bodies in the categories of Annex III are covered too, whatever their size. They include regions, metropolitan cities, municipalities with more than 100,000 inhabitants, regional capitals and local health authorities.
Then there are suppliers. A supplier does not fall under NIS2 because its client does. The client, however, must manage the security of its direct suppliers, and asks for it through questionnaires, clauses and audits.
Typical scenario
A medium-sized engineering company supplies components to a group subject to NIS2. It receives a long questionnaire with only a few weeks to answer. Almost all the measures are in place, but none of them is written down.
02 · copy the link to this sectionHow we work
Six steps. Decisions stay with the company, which approves every document.
Sector, size and activities. We establish whether you are in scope, a supplier to entities in scope, or both. The conclusion is shared with your lawyer.
What you have is compared with the ACN basic measures, one by one. For each measure we note what is missing and what only needs writing down.
Priorities, owners and dates, in a document that management approves and that you can show.
The missing technical and organisational measures, with your IT team and suppliers. Where needed, with testing and penetration tests.
Plans, policies, procedures, inventories and logs, kept up to date. They are the documents the ACN lists in its FAQs.
The procedure for notifications to CSIRT Italia, an exercise with management and training for the management bodies.
03 · copy the link to this sectionReference
Updated 7 November 2026
In short: the measures are those of Article 24 of Legislative Decree 138/2024. The evidence is the set of documents the ACN lists in its FAQs.
| What the law requires | What shows it | Reference |
|---|---|---|
| Risk analysis and security policies | A risk management plan, a risk treatment plan and approved policies | Article 24(2)(a) |
| Incident handling | An incident response plan and a notification procedure | Article 24(2)(b) · Article 25 |
| Business continuity and backups | Business continuity and recovery plans, with the tests carried out | Article 24(2)(c) |
| Supply chain security | A supplier inventory and security requirements in contracts signed or renewed | Article 24(2)(d) · ACN FAQ MSB.12 |
| Vulnerabilities | A vulnerability management plan and test results | Article 24(2)(e) |
| Training | A training plan and a log of staff training activities | Article 23(2) · Article 24(2)(g) |
| Access and assets | Inventories of devices, services, systems and applications, and a list of systems reachable remotely | Article 24(2)(i) · ACN FAQ MSB.11 |
| Authentication | Multi-factor authentication where appropriate | Article 24(2)(l) |
Important entities apply the measures in Annex 1 of ACN Determination 379907 of 19 December 2025, essential entities those in Annex 2. The determination has applied since 15 January 2026.
This box is for information only and is not legal advice. How the rules apply to a particular organisation should be assessed with its own lawyers.
04 · copy the link to this sectionReference
Updated 7 November 2026
| What | When | Reference |
|---|---|---|
| Registration on the ACN portal | Every year from 1 January to 28 February | ACN, ‘Ambito e registrazione’ (scope and registration) |
| Basic measures, for organisations added to the list in 2025 | Eighteen months from the notice of inclusion | ACN FAQs |
| Basic measures, for organisations added for the first time in 2026 | By 31 July 2027 | ACN FAQs |
| Basic reporting obligation, for organisations added in 2025 | From the ninth month after the notice of inclusion | ACN FAQs |
| Basic reporting obligation, for organisations added in 2026 | From 1 January 2027 | ACN FAQs |
| Early warning of a significant incident to CSIRT Italia | Within 24 hours of becoming aware of it | Legislative Decree 138/2024, Article 25(5) |
| Incident notification | Within 72 hours of becoming aware of it | Legislative Decree 138/2024, Article 25(5) |
| Final report | Within one month of the notification | Legislative Decree 138/2024, Article 25(5) |
Rules still evolving. The proposal of 20 January 2026 to amend NIS2 (COM(2026) 13) was still under discussion on 7 November 2026. This box sets out the rules currently in force.
05 · copy the link to this sectionSan Marino
NIS2 does not apply to the work done within the Republic. It covers a San Marino company if it offers digital services covered by the Directive in the EU and meets the criteria. In that case it designates a representative in a Member State. More often, it arrives as a request from Italian and EU clients.
06 · copy the link to this sectionPrinciples
07 · copy the link to this sectionFrequently asked questions
08 · copy the link to this sectionObservatory
Analysis and guides from the Strategic editorial team.
Companies subject to NIS2 must assess and check the suppliers that touch their systems. For suppliers, it all arrives as questionnaires and contract clauses. Here is what customers ask, and how to prepare answers that stand up.
17 September 2026In the first hours of a cyber incident, management does not do the technical work. It takes three decisions that only it can take. It decides who leads the response, who speaks for the company and what must be preserved.
16 September 2026Remote support, shared accounts, programs installed years ago and never removed. Supplier access is one of the most exploited ways in. How to list it, limit it, log it and close it.
12 October 2026A public grant lowers the cost, but it does not make the choices for the company. Here are the schemes that fund cybersecurity, what they really cover and the questions to ask the supplier before you sign.
6 August 2026The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.
09 · copy the link to this sectionContact
A few lines are enough: sector, size, what you have received and the deadlines. We reply by email, usually within two working days.
Please do not put credentials, IP addresses or vulnerability details in the form. We exchange them later, over the channels we agree.
Or write to us:WhatsAppstaff@strategic.sm
On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.
