NIS2 Compliance for Companies in Italy and the EU
Fidem helps companies comply with the NIS2 Directive (Italian Legislative Decree 138/2024) with real operational infrastructure: a managed SOC, certified VAPT, Attack Surface Management, email identity defense and Incident Response. Not just legal advice: compliance requires working technical systems, structured governance and a professional Gap Analysis as the starting point. Deadline: October 2026.
What the NIS2 Directive Is and Who It Applies To
The NIS2 Directive (EU 2022/2555), transposed in Italy by Legislative Decree 138/2024, is the European cybersecurity law that replaces the 2016 NIS1 Directive. It significantly widens the regulated sectors and the number of organizations in scope, and introduces an “all-hazards” approach: multi-risk, holistic and inclusive of the supply chain.
NIS2 distinguishes two categories:
- Essential entities: highly critical sectors (energy, transport, banking, healthcare, digital infrastructure, public administration). Fines of up to 2% of global turnover or 10 million euros.
- Important entities: other relevant sectors (manufacturing, postal services, waste management, digital providers). Fines of up to 1.7% of turnover or 7 million euros.
SMEs are not automatically excluded: if they provide services to essential or important entities (supply chain), they can fall within scope. In Italy, ACN (the National Cybersecurity Agency) notifies each entity included in the national NIS list individually.
NIS2 Deadlines in 2026: What Happens and When
2026 is the decisive year for NIS2 becoming fully operational in Italy. These are the official deadlines:
- 1 January 2026: the obligation to notify significant incidents to CSIRT Italia takes effect (ACN Determination 379907 of 15 January 2026). Process: early warning within 24h, formal notification within 72h, final report within 1 month.
- April-June 2026: publication of the ACN categorization model and collection of self-declarations. Companies in scope must report the list of activities and services they provide, together with their relevance.
- October 2026: final deadline to adopt all the basic technical, operational and organizational security measures required by Art. 21.
- End of 2026: ACN starts systematic inspections and audits. From that date, non-compliance can be sanctioned.
Important: individual deadlines run from the date the entity receives ACN’s official notice of inclusion in the list, not from the date the decree entered into force.
How to Comply with NIS2: the 4 Operational Phases
NIS2 compliance is not a one-off project: it is a structured process of continuous improvement. The standard path has four phases:
Phase 1: Gap Analysis, the Mandatory Starting Point
Before any intervention, you need to know where you stand. A NIS2 Gap Analysis assesses the organization’s current security posture against the requirements of Legislative Decree 138/2024 and the ACN determinations. It includes:
- Inventory of the relevant IT/OT assets and mapping of critical systems
- Assessment of existing security policies against Art. 21
- Analysis of incident management and supply chain processes
- Identification of documentation gaps (the evidence pack for ACN inspections)
- Prioritized remediation plan with a timeline
Fidem delivers a Gap Analysis report that states every gap against Art. 21 clearly, with a compliance plan that sets realistic priorities and timelines.
Phase 2: Governance and Planning
NIS2 makes the management and supervisory bodies (the board) directly accountable. Executives must approve the risk management measures, oversee their implementation and, in case of breaches, can be held personally liable. Cybersecurity can no longer be delegated to IT alone as a “technical topic”. Fidem helps define:
- A risk management policy approved by the board
- Appointment of responsible people with formal roles
- A training plan for management bodies and staff
- Business Continuity and Disaster Recovery procedures
Phase 3: Technical Implementation
The technical measures required by Art. 21, delivered by Fidem through the Defensio ecosystem:
- Managed SOC: continuous monitoring and incident notification (24h/72h/1 month) in line with Art. 21
- VAPT (Vulnerability Assessment & Penetration Testing): periodic vulnerability verification
- Attack Surface Management (ASM): continuous monitoring of external exposure and of the supply chain
- Multi-factor authentication (MFA), encryption, network segmentation, endpoint protection
- Log management and SIEM for incident detection and audit trails
Phase 4: Continuous Verification and Inspection Readiness
Compliance is not a state, it is a process. After the initial implementation, compliance has to be maintained with:
- Periodic penetration tests as required by ACN
- Up-to-date documentation (an evidence pack that is always current)
- Annual review of the risk management plan
- Incident response drills to verify the 24h/72h notification times
The 5 Technical Obligations of Art. 21 and How Fidem Meets Them
Article 21 of Legislative Decree 138/2024 defines the technical, operational and organizational measures every NIS2 entity must adopt. Fidem covers all 5 clusters of obligations through the Defensio ecosystem:
- Risk and Incident Management: Defensio SOC with a multi-stage AI pipeline and Defensio Sensor inside the network: real-time detection, built-in deception for early warning, detection of data exfiltration and of unauthorized remote access tools; incident handling in line with the ACN procedure (24h/72h/1 month notification), periodic VAPT to verify vulnerabilities.
- Business Continuity and Disaster Recovery: Managed Backup with documented RPO/RTO, crisis management procedures, tested recovery plans.
- Supply Chain Security: continuous Attack Surface Management of suppliers and third parties exposed on the Internet, with Defensio XT, Defensio SECaaS and the dedicated DENG scan engines.
- System Security and Cyber Hygiene: endpoint detection and response, MFA, encryption, network segmentation, privileged access management with sealed, verifiable logging of administrator access (Custos) and email identity defense against spoofing and BEC fraud with Defensio Identity Shield (DMARC monitoring, scheduled spoof tests, lookalike domains).
- Training and Awareness: a structured Cyber Awareness Program for employees and management bodies, meeting the board training obligation of Art. 21.
Why Fidem: Operational Infrastructure, Not Just Legal Advice
The difference between Fidem and a legal consultancy or a traditional compliance firm is concrete: we deliver the technical services NIS2 requires, not just the documents that describe them.
- Operational SOC: Defensio SOC provides the continuous monitoring required by Art. 21. We do not “recommend having a SOC”: we are the SOC.
- VAPT performed in-house: Vulnerability Assessments and Penetration Tests are performed by our team with proprietary tools from the Defensio ecosystem, not resold from third parties.
- ASM for the supply chain: Defensio XT, Defensio SECaaS and the dedicated DENG engines continuously monitor the external attack surface, including the supply chain, as required by Art. 21.
- Protected email identity: Defensio Identity Shield closes the spoofing and BEC fraud channel with continuous DMARC monitoring, scheduled spoof tests and lookalike domain surveillance.
- Gap Analysis + Compliance Plan: every engagement starts with a documented Gap Analysis that becomes the foundation of the evidence pack for ACN inspections.
- Verifiable certifications: ISO/IEC 27001, 27017, 27018 and ISO 9001; the Defensio ecosystem is registered at CSA STAR Level 1, with full transparency in the Trust Center.
- ACN-certified Italian data centers: all processed data stays on Italian infrastructure with EU data residency.
The Concrete Benefits of NIS2 Compliance for Your Company
NIS2 compliance is not just an obligation, it is a strategic opportunity. Compliant companies gain direct competitive advantages:
- Access to public tenders: failing to comply with NIS2 can lead to exclusion from public calls and tenders from the end of 2026. Certified companies can bid in tender categories closed to non-compliant ones.
- Reputation and supply chain trust: large enterprise and public-sector customers will start asking their suppliers for NIS2 compliance statements. Being compliant means not losing existing contracts.
- Operational resilience: the measures NIS2 requires (SOC, endpoint protection, tested backups, Incident Response) concretely reduce the risk of downtime after a cyberattack, whose average cost exceeds 200,000 euros for an Italian SME.
- Alignment with GDPR and DORA: NIS2 measures also speed up GDPR compliance (shared security measures) and DORA compliance for financial sector entities, avoiding double compliance spending.
- Sustainability and ESG ratings: NIS2 compliance has a positive effect on corporate ESG ratings, increasingly requested by investors and strategic partners.
Frequently Asked Questions about NIS2 Compliance
Does NIS2 apply to my company?
It depends on two factors: the business sector and the size of the company. Essential entities are typically companies with more than 250 employees or more than 50 million euros of turnover in critical sectors (energy, healthcare, banking, digital infrastructure). Important entities include medium-sized companies in other relevant sectors. SMEs are not automatically excluded if they are part of the supply chain of an essential entity. In Italy ACN notifies every entity included, but it is wise to check your own position before receiving the notice, given the tight 2026 deadlines.
How is a NIS2 Gap Analysis carried out?
A NIS2 Gap Analysis is a structured assessment of the current security posture against the requirements of Legislative Decree 138/2024. It starts from an inventory of the relevant IT/OT assets, assesses existing policies, maps critical processes and identifies the gaps against the obligations of Art. 21. The result is a prioritized remediation plan with a timeline. Fidem performs the Gap Analysis by combining document review with technical vulnerability assessment and attack surface analysis tools, so you get both the legal picture and the real operational one.
What happens if I am not compliant by October 2026?
Fines depend on the category: essential entities risk up to 2% of worldwide turnover or 10 million euros; important entities up to 1.7% or 7 million euros. But the fine is only part of the risk: if an ACN warning is ignored, Legislative Decree 138/2024 provides for the temporary suspension of executives from their management functions, a personal consequence for management. ACN inspections will start systematically at the end of 2026.
How does incident notification work?
The notification procedure has been binding since 1 January 2026. A “significant” incident must be notified to CSIRT Italia in three stages: an early warning within 24 hours of becoming aware of the incident, a formal notification within 72 hours with an assessment of the impact and nature of the incident, and a final report within 1 month of the end of incident handling. Fidem’s managed Defensio SOC includes notification support in its incident response service, so the deadlines are met at night and at weekends too.
Does NIS2 also apply to SMEs?
The size thresholds are precise. Large companies (essential entities): more than 250 employees and annual turnover of at least 50 million euros or a balance sheet total of at least 43 million. Medium-sized companies (important entities): 50-249 employees, turnover below 50 million. SMEs with fewer than 50 employees: generally excluded, unless they operate in specific critical sectors (energy, healthcare, etc.) or provide services to essential/important entities, such as MSPs, cloud providers, software or OT suppliers. The supply chain clause is the critical point: many SMEs fall within NIS2 scope without knowing it.
Which specific technical tools does NIS2 require (SIEM, EDR, NGFW, OT)?
Legislative Decree 138/2024 does not prescribe brands or specific products, but the required measures translate into precise technology categories: a SOC (Security Operations Center) for continuous monitoring and centralized log management; Fidem’s service goes beyond the traditional SIEM with AI-based detection, multi-source correlation and managed response (Defensio SOC & MDR); EDR (Endpoint Detection & Response) to protect endpoints, including remote working scenarios; Defensio Sensor for internal network monitoring, segmentation and an NGFW-equivalent function: the Defensio on-premise sensor covers threat detection, NetFlow and real-time vulnerability assessment; MFA for identity and access management; Managed Backup + Disaster Recovery with documented RPO/RTO and tested recovery. For companies with OT (Operational Technology) systems, such as manufacturing, energy and utilities, NIS2 requires specific OT security measures, separate from standard IT measures. The Defensio Ecosystem covers all of these layers as a managed service.
Check Whether Your Company Falls Within NIS2 Scope
The first step is to understand whether and how NIS2 applies to your organization. Fidem performs a NIS2 Gap Analysis that produces a documented report of the current state against the requirements of Legislative Decree 138/2024, with a compliance plan and clear priorities. Data stays in ACN-certified Italian data centers.
Not sure whether your company has these obligations? Find out in 2 minutes whether NIS2, GDPR or customer requirements apply to you, with an instant result.
Related topics
Services linked to the compliance path: GDPR consulting · Defensio SOC: managed detection and response · Defensio Identity Shield: DMARC monitoring · log analysis · Custos, system administrator logs · Defensio SECaaS: cloud vulnerability scanning
Technical measures supporting compliance: VAPT · staff training · our certifications · cybersecurity services
Supporting platform: Defensio XT · the Defensio ecosystem
Defensio tools for the technical measures of Art. 21
The technical measures NIS2 requires are demonstrated with tools that produce evidence: continuous vulnerability scanning to manage vulnerabilities on the exposed perimeter, the passive network probe Defensio Sensor for continuous monitoring and asset inventory, SOC as a service for incident management and on-time notification, and Identity Shield email spoofing protection for email security.
Definitions: NIS2 · significant incident in the cybersecurity glossary.