Compliance and security
What Italian Legislative Decree 138/2024 requires, who is covered, the 2026-2027 deadlines and how ALAconnect helps companies adopt and document the security measures required by the Italian National Cybersecurity Agency (ACN).
NIS2
NIS2 is EU Directive 2022/2555 on the security of network and information systems, transposed in Italy by Legislative Decree 138/2024, in force since 16 October 2024. It requires companies and public bodies in critical sectors, classified as essential or important entities, to register with the Italian National Cybersecurity Agency (ACN), adopt cyber risk management measures and notify significant incidents to CSIRT Italia.
Who is covered
NIS2 applies by sector and size; many small companies are affected indirectly as suppliers.
Companies with at least 50 employees or annual turnover or balance sheet above €10 million operating in the 18 sectors listed in the decree are covered, including energy, transport, health, water, digital infrastructure, managed ICT services, waste management and the manufacture of medical devices, machinery, electronics and food.
Some entities are covered even if small, for example DNS service providers, domain name registries, trust service providers and public communication networks, as well as the public administrations identified by the decree.
Companies that are not NIS entities but supply goods or services to an essential or important entity are affected through supply chain security: clients ask for evidence of the measures adopted and may include them in contracts.
ACN classifies entities as essential or important by sector and size. Obligations are similar, but essential entities face broader measures and closer supervision.
Deadlines
Timeline for entities already listed and for those added from 2026.
| When | Obligation |
|---|---|
| Every year, 1 January - 28 February | Registration of new entities on the ACN platform |
| Every year, by 31 May | Annual update of information on the ACN platform, including relevant suppliers |
| From January 2026 | Notification of significant incidents to CSIRT Italia for entities listed in 2025 |
| By October 2026 | Basic security measures adopted and documented for entities listed in 2025 |
| From 1 January 2027 | Incident notification for entities added in 2026 |
| By 31 July 2027 | Basic security measures for entities added in 2026 |
Obligations
The main obligations of Legislative Decree 138/2024 and ACN determinations.
Management bodies approve the risk management measures, oversee their implementation and are accountable for them; they must also take cybersecurity training.
Risk analysis, asset inventory, vulnerability management, access control and multi-factor authentication, encryption, backup and business continuity, supply chain security and staff training, according to ACN specifications.
Significant incidents must be notified to CSIRT Italia with an early warning within 24 hours, a notification within 72 hours and a final report within one month. This requires system monitoring and an incident management procedure.
For essential entities, fines reach up to €10 million or 2% of worldwide annual turnover; for important entities up to €7 million or 1.4%. Directors can be held liable for breaches.
How we help
ALAconnect handles the technical and organisational side of security; for legal aspects we work with your advisor or DPO.
We establish whether the company is a NIS entity or a supplier of NIS entities, and which obligations apply.
We compare systems and procedures with the ACN basic measures and define a prioritised compliance plan.
We deliver the technical measures: firewalls, MFA, backup, monitoring, vulnerability management and incident procedure.
We document controls and deadlines in the Privacy & Compliance Portal to demonstrate compliance.
Services
The technical measures required by NIS2 match services ALAconnect already manages for its clients.
Security event monitoring with SIEM/XDR, to detect attacks in time and have the information needed to notify within 24 hours.
Next-generation firewalls, network segmentation, VPNs, multi-factor authentication and endpoint protection.
Encrypted and tested backups with regular restore tests and disaster recovery plans, as required by the basic measures.
ACN basic measures checklists, deadline calendar, incident register with notification deadlines and dated technical evidence from monitoring.
Many of these measures can be funded with the Cloud & Cybersecurity Voucher and hyper-depreciation 2026-2028: see Grants and funding.
FAQ
Short answers to the most common questions from SMEs.
Two elements must be checked: whether the activity falls within one of the sectors listed in the annexes of Legislative Decree 138/2024, and whether the company exceeds the medium-sized enterprise thresholds, that is at least 50 employees or more than €10 million in turnover or balance sheet. Some entities are covered regardless of size. If in doubt, a check with an advisor is recommended.
Often yes, indirectly. Small companies supplying goods or services to NIS entities fall within supply chain security: clients ask them to demonstrate the measures adopted, such as backup, multi-factor authentication and incident management, and may include them in contracts.
For entities added to the NIS list in 2025, the basic security measures must be adopted by October 2026, 18 months after the ACN notice. For entities added in 2026, the deadline is 31 July 2027. Incident notification has been mandatory since January 2026 for the former and from 1 January 2027 for the latter.
A significant incident must be reported to CSIRT Italia with an early warning within 24 hours of becoming aware of it, a notification within 72 hours and a final report within one month. If the incident also involves personal data, notification to the Italian Data Protection Authority within 72 hours under the GDPR must be assessed in parallel.
No. There is no NIS2 compliance certification: responsibility lies with the company and its directors. ALAconnect helps implement the technical and organisational measures, keep them up to date and collect the evidence that demonstrates compliance in the event of an ACN inspection.
NIS2 compliance
We start with a gap analysis against the ACN basic measures and tell you what is missing, in which order to act and at what cost.
Request a NIS2 gap analysis