Cybersecurity in San Marino
A San Marino company follows the laws of the Republic, but it often works for Italian and EU clients that apply NIS2 and ask for proof of security. Strategic is based in San Marino. We put your testing, documents and incident response plan in order, so the same papers answer both the San Marino rules and your clients’ questionnaires.
01 · copy the link to this sectionThe situation
On cybersecurity, a company in the Republic looks at two frameworks at once.
A San Marino company processes personal data under San Marino law, Law No. 171 of 2018. It is supervised by the Republic’s Data Protection Authority.
Then an Italian or EU client subject to NIS2 comes along. NIS2 is the EU cybersecurity directive, and that client must keep its suppliers under control. So it sends a questionnaire, asks for a contract clause, and wants to know the date of your last penetration test and how you handle an incident.
The two do not conflict. If you put your measures, testing and documents in order once, you can answer both with the same papers.
02 · copy the link to this sectionReference
Updated 7 November 2026
In short: personal data is governed by San Marino Law 171/2018. NIS2 does not bind the work done within the Republic, but it reaches you through your clients, and it covers anyone offering certain digital services in the EU.
| Topic | What it means for you | Reference |
|---|---|---|
| Personal data | Security measures appropriate to the risk. A personal data breach is notified to the Data Protection Authority without undue delay and, where feasible, within 72 hours. If the risk to people is high, they must be told too. | Law No. 171 of 21 December 2018, Articles 33, 34 and 35 |
| Unauthorised access | Entering a protected system without the permission of whoever has the right to exclude you is a crime in San Marino as well. That is why every security test starts with written authorisation. | San Marino Criminal Code, Article 182-bis, introduced by Law No. 114 of 23 August 2016 |
| NIS2 within the Republic | It does not apply to San Marino businesses for the work they do in San Marino. | Directive (EU) 2022/2555 |
| Digital services offered in the EU | Providers of services such as cloud, data centres, managed services or DNS in the EU that meet the criteria fall under NIS2 and designate a representative in a Member State. | Directive (EU) 2022/2555, Article 26, and Legislative Decree 138/2024, Article 5 |
| Clients subject to NIS2 | They must manage the security of their direct suppliers. Requests arrive as questionnaires, clauses and sometimes audits. | Legislative Decree 138/2024, Article 24(2)(d) |
| EU banks and insurers | The DORA regulation sets out what must be written into contracts with ICT service providers. It has applied since 17 January 2025. | Regulation (EU) 2022/2554, Article 30 |
| Association Agreement with the European Union | Signed on 19 October 2026 and not yet in force on 7 November 2026. Its effects will be assessed on the text in force. | European Commission, 19 October 2026 |
In the collection of laws of the Consiglio Grande e Generale, consulted on 7 November 2026, we found no San Marino law transposing NIS2. If one is passed, this box will be updated.
This box is for information only and is not legal advice. How the rules apply to a particular company should be assessed with its own lawyers.
03 · copy the link to this sectionClients and counterparties
The requests change with the client. The documents you need are almost always the same.
| Who asks | What they usually ask for | What to have ready |
|---|---|---|
| Italian and EU clients subject to NIS2 | A supplier questionnaire, contract clauses, sometimes an audit | Written measures, your latest test with the fixes, the incident response plan and a contact for notifications |
| EU banks and insurers | Clauses on security, incident support, access and audits | The business continuity plan, restore tests and the incident log |
| Italian public bodies and their suppliers | Security requirements in tenders and contracts | A description of the measures, the contact people and evidence from testing |
| Cyber insurance | A questionnaire before the policy or the renewal | Two-factor sign-in, isolated backups and an incident response plan |
Before answering a questionnaire, it helps to know where to start. Cyber risk assessment
04 · copy the link to this sectionWhat we do
The same services we offer in Italy, with the San Marino rules alongside those of your clients.
05 · copy the link to this sectionWhere we work
Registered office in Chiesanuova, Republic of San Marino. We work on site in the Republic, Romagna, the Marche and Emilia. With companies in the rest of Italy, we work remotely.
Testing always starts with written authorisation. Scope, time windows and contact people are agreed beforehand with whoever has legal authority over the systems.
06 · copy the link to this sectionFrequently asked questions
07 · copy the link to this sectionObservatory
Analysis and guides from the Strategic editorial team.
The association agreement will bring San Marino into the EU internal market, with the same rules and the same conditions of competition. It is not yet in force. Where it stands, what will change for businesses and what to prepare.
4 October 2026Companies subject to NIS2 must assess and check the suppliers that touch their systems. For suppliers, it all arrives as questionnaires and contract clauses. Here is what customers ask, and how to prepare answers that stand up.
17 September 2026Remote support, shared accounts, programs installed years ago and never removed. Supplier access is one of the most exploited ways in. How to list it, limit it, log it and close it.
12 October 2026The price of a penetration test depends on scope, approach, manual work, documentation and retesting. How to read a quote, what the rules require and what should be left once the test is over.
22 July 2026The essential parts of this page print as a short summary of a few pages, without images or invitations to get in touch.
08 · copy the link to this sectionContact
A few lines are enough: what kind of company you are, what your clients are asking for, and any deadlines. We reply by email, usually within two working days.
Please do not put credentials, IP addresses or vulnerability details in the form. We exchange them later, over the channels we agree. If an incident is in progress, the first steps are on the page Cyber incident response.
Or write to us:WhatsAppstaff@strategic.sm
On WhatsApp, messages are answered by Strategic’s AI assistant. Please do not use it for confidential information.
