NIS2 compliance consulting for businesses

The Italian decree (article 3) applies to public and private entities in the sectors listed in its annexes that exceed the small-enterprise thresholds, so medium and large companies in energy, transport, healthcare, digital infrastructure, manufacturing, food, chemicals, waste management, postal services, research and others. Some categories are covered regardless of size: public administrations, providers of communication networks and services, trust services, DNS and domain registration. The ACN can also identify companies linked to a NIS entity and suppliers that are a systemic element of its supply chain. If you are unsure about the scope, that is where we start.

The terms run from the notice of inclusion in the list of NIS entities received on the ACN platform: nine months for the incident notification obligation and eighteen months for the basic security measures (ACN determination 379907/2025, article 3). For those included in the first wave, April 2025, this means notifications from January 2026 and measures by October 2026; those joining with later updates of the list count their own terms from the new notice. The exact date is the one written in the notice received. Read the guide to the October 2026 deadline.

They are the measures set by the ACN with determination 379907/2025: annex 1 for important entities contains 37 measures and 87 requirements, annex 2 for essential entities 43 measures and 116 requirements. They follow the six functions of the National Framework for Cybersecurity and Data Protection (govern, identify, protect, detect, respond, recover) and cover 16 policy areas, from risk management to incident response. The ACN also publishes them as spreadsheets: each row is a requirement to be demonstrated with dated evidence.

The basic significant incidents are defined in annexes 3 and 4 of the ACN determination: loss of confidentiality towards the outside of owned or controlled data, loss of integrity with external impact, breach of the expected service levels and, for essential entities, unauthorised access to data. The timing is that of article 25 of the decree: early warning to CSIRT Italia within 24 hours of becoming aware of the incident, notification within 72 hours, final report within one month. The CSIRT replies to the early warning, where possible, within 24 hours. NIS2 Referent: managed evidence and CSIRT referent.

Article 23 of the decree gives the management and governing bodies the approval of the implementation of the measures, the oversight of their application and the responsibility for violations, plus the duty to attend cybersecurity training. In the basic measures nine documents require their explicit approval: organisation of roles, security policies, risk assessment, treatment plan with accepted residual risks, vulnerability plan, improvement plan, response and continuity plans, training plan and incident management and notification plan. The ACN FAQs of July 2026 clarify that the approval cannot be delegated and concerns strategic documents, not technical procedures.

Article 38 of the decree provides for administrative fines of up to 10 million euros or 2% of worldwide annual turnover for essential entities and up to 7 million or 1.4% for important entities, with separate amounts for public administrations. Before that the path is gradual: the ACN can request evidence, order audits and issue binding instructions (article 37) and, once a violation is established, normally sends an invitation to comply within a term which, if met, closes the proceeding. Those who ignore formal notices also risk accessory sanctions against their directors.

ISO/IEC 27001 certification covers a large part of the NIS2 requirements on risk management, governance and technical measures, so much so that the ACN published with UNI the reference practice UNI/PdR 174:2025 precisely for certified NIS entities. It is not enough on its own: the basic measures require specific evidence, such as the approvals of the management bodies, the CSIRT Italia notification plan and the expected service levels. It is the most solid starting map, not compliance. AtWorkStudio is certified to ISO/IEC 27001, 27017, 27018 and ISO 9001. How we support you towards ISO 27001 certification.

The first step is an assessment against a recognised framework. Our free online assessment at assessment.atworkstudio.it follows NIST CSF 2.0, which has the same six functions as the ACN basic measures: 106 questions, instant report and gap analysis. From there we build the compliance plan with priorities and dates.

It is the obligation under article 30 of the decree: the entity communicates on the ACN platform the list of NIS activities and services delivered and their categorisation, mapping them to the macro-areas defined by the ACN and assigning a relevance category. It is not just filling in a portal: it is the basis on which the ACN calibrates obligations proportionately, and it must be integrated with inventory, risk analysis, business continuity and supplier management. The ACN clarifications from the Clusit event of 29 April 2026.

Yes, if it is a non-fungible supplier whose absence compromises the continuity of the NIS activity or service. The ACN template distinguishes three categories: ICT supply, non-fungible supply and non-fungible ICT supply. A raw material supplier, a specific industrial component or a hard-to-replace logistics service can be relevant even if it does not deliver technology. The key is fungibility, not the ICT nature. The guide to relevant suppliers on the ACN platform.

No. In Italy there are no private entities certified as NIS2 compliance auditors with an ACN mandate. The decree (article 37) provides that it is the ACN that requests evidence, orders audits and scans and issues instructions. Organisations can be supported by qualified consultants or auditors to verify their level of compliance, but no third party can “certify” NIS2 compliance on behalf of the authority. Be wary of quick, reassuring labels: independent verification is useful, “miracle” certification is something else.

Our headquarters are in Piacenza and we operate throughout Italy. We support manufacturing, logistics and service companies on their NIS2 compliance journey, from gap analysis to verifiable evidence. As Clusit members, with three ACN-qualified services and certifications to ISO/IEC 27001, 27017, 27018 and ISO 9001, we work with a structured and verifiable approach. What ACN qualification means.