NIS2: the October 2026
deadline

October 2026 is the month in which, for most Italian NIS entities, the term for adopting the basic security measures expires. It is not a calendar date that is the same for everyone and it does not concern “all the requirements of the directive”: it is an 18-month term that runs from the notice of inclusion in the national list, and it concerns a precise set of measures established by the ACN (Agenzia per la Cybersicurezza Nazionale, the Italian National Cybersecurity Agency). This article lines up what the source says, what must be ready, what the board of directors must have signed and what is worth checking now, with the codes of the measures to find them in the official document.

Which deadline, and for whom

The source is article 3 of ACN determination no. 379907/2025, in force since 15 January 2026, which updated and replaced determination 164179 of April 2025: the term for adopting the basic security measures is “eighteen months from receipt, by the NIS entity, of the notice of inclusion in the list of NIS entities”; the term for the incident notification obligation is nine months. Those included in the first wave received the notice in April 2025: for them the nine months expired in January 2026 and the eighteen expire in October 2026. That is the deadline everyone talks about, and the exact date is the one written in the notice received on the ACN platform.

It does not apply to everyone in the same way. On 18 September 2026 the NIS implementation Table ordered the update of the list with over 2,000 late registrations and about 2,000 reviews: those who join now receive a new notice and count their own terms from it. In the same meeting the ACN opened the consultation on the “enhanced security measures”, meant to integrate and replace the basic measures of the first application, and recalled that the next registration window runs from 1 January to 28 February 2027. For those who want to understand whether and how they fall within the scope, our NIS2 page and the article on the categorisation of activities and services are the starting point.

What must be adopted

The measures are in the annexes of the determination: annex 1 for important entities, with 37 measures and 87 requirements, annex 2 for essential entities, with 43 measures and 116 requirements. The ACN also publishes them as spreadsheets, and it is worth using them: each row is a requirement with the code of the measure, the text of what is required and the policy area it belongs to. The measures follow the National Framework for Cybersecurity and Data Protection, 2025 edition, with the same logic as the NIST CSF 2.0 we use in our assessment: six functions, from governance to recovery.

The 16 policy areas range from risk management to incident response, through staff reliability, audits, supply chain, assets, vulnerabilities, business continuity, identity and access, physical security, training, data, system lifecycle, networks and monitoring. The six additional measures for essential entities concern the representation of network flows, the training of specialised roles, configuration management, hardware maintenance, resilience mechanisms and the communication of recovery progress. The weight falls on the Protect function, where identity, backups, logs and updates sit: it is also the part where evidence is produced by technology, not by documents.

What the board of directors must have signed

Article 23 of Legislative Decree 138/2024 puts the management and governing bodies at the centre: they approve the implementation of the measures, oversee the obligations, are responsible for violations, must attend cybersecurity training and must be informed of incidents. In the basic measures this translates into nine items that require their explicit approval:

• The organisation of security roles and responsibilities (GV.RR-02).
• The cybersecurity risk management policies, across the 16 areas (GV.PO-01).
• The risk assessment (ID.RA-05).
• The risk treatment plan, including the acceptance of residual risks (ID.RA-06).
• The vulnerability and disclosure management plan (ID.RA-08).
• The improvement plan following the review, with periodic reports on results (ID.IM-01).
• The incident response, business continuity and recovery plans (ID.IM-04).
• The training plan, which includes the bodies themselves (PR.AT-01).
• The incident management and CSIRT Italia notification plan (RS.MA-01).

ACN FAQs ODA.8–12, updated on 14 July 2026, remove the most frequent doubts: approval is an exclusive competence of the collegiate body, or of the single-person body where provided, and cannot be delegated; it applies to the documents that define strategic direction and planning, not to procedures, operating instructions and manuals, which remain with the technical structures; a single document or a set of coordinated documents is allowed; updating the technical documents referenced does not require a new approval. In practice: a dated board resolution with the nine items, and an index saying where each document is, are worth more than a hundred unsigned pages.

Notifications are already in force

The nine-month term expired for the first wave in January 2026: since then basic significant incidents must be notified to CSIRT Italia. Annex 3 defines three for important entities: the loss of confidentiality towards the outside of owned or controlled data, even in part (IS-1); the loss of integrity with external impact (IS-2); the breach of the expected service levels, defined under measure DE.CM-01 (IS-3). Annex 4 adds for essential entities the unauthorised access, or access abusing granted privileges, to data (IS-4). The windows are those of article 25 of the decree: early warning within 24 hours, notification within 72 hours, final report within one month.

Two details matter more than they seem. First: IS-3 presupposes that the expected service levels have been defined and measured, so without measure DE.CM-01 you do not even know when an outage becomes notifiable. Second: the incident management and notification plan (RS.MA-01) is one of the documents approved by the board, and must say who decides, who writes to the CSIRT and through which channels. It is the service we deliver as outsourced CSIRT referent, with incident response behind it.

What to check this week

The right question is not “do we have the measure?” but “do we have the dated evidence that the measure is implemented?”. This is the list we start from, measure by measure, on the technical side:

• Inventories (ID.AM-01, ID.AM-02, ID.AM-04). Hardware, software and services, services delivered by suppliers: three updated and dated lists, not a file from 2024. Without an inventory no subsequent measure can be demonstrated.
• Identity and access (PR.AA-01, PR.AA-03, PR.AA-05). Identities and credentials managed, users and services authenticated, permissions defined in a policy and reviewed. Multi-factor authentication and the periodic access review are the easiest evidence to produce.
• Backups (PR.DS-11). Created, protected, maintained and verified: the requirement asks for verification, so you need the last restore test with date and outcome.
• Logs and monitoring (PR.PS-04, DE.CM-01, DE.CM-09). Logs generated and available for monitoring, networks and systems monitored, expected service levels defined: the same ones that trigger notification IS-3.
• Vulnerabilities and updates (ID.RA-01, PR.PS-02). Vulnerabilities identified and recorded, software maintained, replaced or removed based on risk. The PHP2Shell week is the example of how this is demonstrated: inventory, patch applied, verification.
• Suppliers (GV.SC-04, GV.SC-05, GV.SC-07). Suppliers known and ranked by criticality, security requirements set in contracts, risks recorded and monitored. What counts here is fungibility, not just the ICT label.
• Training (PR.AT-01). Plan approved, delivered and documented, management bodies included: article 23 binds them personally.
• Incidents and notification (RS.MA-01, RS.CO-02). Plan approved, channel to CSIRT Italia tested, list of who must be informed inside and outside the company.

For the technical items our part is to implement them and produce the evidence: identity and access with digital identity management, continuity and restore verification with backup and disaster recovery, suppliers with the method described in the article on relevant suppliers. Legal assessments remain with those who do them for a living.

What happens after October

The decree does not provide for a switch that flips at the deadline, but for a supervision path with gradual tools. Article 37 allows the ACN to request the data proving the implementation of policies, including audit results and the related evidence; to order targeted audits and security scans, with the limit that periodic audits cannot be prescribed to important entities; to issue binding instructions and to appoint an official to support the entity, including on-site and remote visits. Before adopting measures the Authority notifies the preliminary conclusions and grants at least 15 days for comments. Article 38 adds the invitation to comply within a term: those who comply in time see the proceeding stop.

The practical consequence is one: at the deadline what counts is the documented state, not perfection. A treatment plan approved by the board with the accepted residual risks and the closing dates (ID.RA-06), the dated technical evidence and the tested notification plan are what can be shown. Meanwhile the framework evolves: the enhanced measures under consultation since 18 September will replace the basic ones, the annual information update remains between 15 April and 31 May and the registration window reopens on 1 January 2027. Those certified to ISO/IEC 27001 start with an advantage, as we explain in the article on ISO 27001 and NIS2, but certification is the map, not compliance.