NIS2 obligations in Italy (D.Lgs. 138/2024)

Competent authority & CSIRT Legal ref: Art. 15

• Agenzia per la Cybersicurezza Nazionale (ACN) is the national NIS authority; CSIRT Italia operates within ACN and receives incident notifications. acn.gov.it · 28 Oct 2026 · source-checked
• National Cybersecurity Agency. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Defense. ecs-org.eu · 28 Oct 2026 · secondary source
• CSIRT Italia. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Cybersecurity Agency acts as an intermediary to ensure cross-border cooperation between national authorities and the relevant authorities of other Member States, the Commission, and ENISA. ecs-org.eu · 28 Oct 2026 · secondary source
• The National Cybersecurity Agency (in a coordinating role) and the Ministry of Defense are the National Authorities for the management of cybersecurity crises. ecs-org.eu · 28 Oct 2026 · secondary source
• The CSIRT Italia, the national Computer Security Incident Response Team, also operates within the National Cybersecurity Agency. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex I, II, III, IV

• Entities in NIS 2 scope (Annex I and II) plus Annex III (Central, regional, local, and other types of administrations) and Annex IV (Additional types of entities, e.g., local public transport, research institutions, cultural organisations, in-house companies, publicly controlled companies). ecs-org.eu · 28 Oct 2026 · secondary source
• Annex III – Further details on public administrations. ecs-org.eu · 28 Oct 2026 · secondary source
• Link: Visual representation of sectors in scope Link: Further details Link: Timeline for next steps Link: Main implementing measures ecs-org.eu · 28 Oct 2026 · secondary source
• A safeguard clause, established by the DPCM on February 10, 2025, allows exemptions from regulatory size classifications under the NIS2 Decree (Legislative Decree 138/2024) if a company proves total independence of its NIS2 systems, activities, and services from linked companies. However, entities influencing cybersecurity decisions, managing critical NIS2 systems, or providing ICT/security services to essential entities are not eligible, with requests handled via the National Cybersecurity Agency (ACN) platform. ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Visual representation of sectors in scope · Further details · Timeline for next steps · Main implementing measures

Registration

• Entities register on the ACN digital platform (company name, contacts, point of contact, sectors/types). ACN uses the data to compile the list of NIS entities by 31 March each year. acn.gov.it · 28 Oct 2026 · source-checked
• Entities falling within one of the sectors/subsectors/types defined by Legislative Decree No. 138/2024 must register on the ACN platform within February 28th, 2025 – with the exception of providers of domain name system services, operators of top-level domain name registries, domain name registration service providers, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, search engines, and social network service platforms, who fall within the scope of the decree and are required to register by January 17th, 2025. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities in scope register on the digital platform, providing at least the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• The company name. ecs-org.eu · 28 Oct 2026 · secondary source
• The updated address and contact details, including addresses e-mail and telephone numbers. ecs-org.eu · 28 Oct 2026 · secondary source
• The designation of a contact point, indicating their role at the entity and updated contact details, including e-mail addresses and telephone numbers. ecs-org.eu · 28 Oct 2026 · secondary source
• Where applicable, the relevant sectors, sub-sectors and types of entities. ecs-org.eu · 28 Oct 2026 · secondary source
• The NIS 2 Directive provides the possibility of excluding an entity from the scope of applicability if it is independent from its linked companies that fall within NIS 2 Scope, in terms of ICT systems and networks (Transposition Legislative Decree, Article 3, Paragraph 4) ecs-org.eu · 28 Oct 2026 · secondary source
• By March 31st, the competent national authority draws up the list of essential and important entities and communicates: ecs-org.eu · 28 Oct 2026 · secondary source
• Inclusion in the list of essential or important entities. ecs-org.eu · 28 Oct 2026 · secondary source
• Confirmation of their status of essential or important entities. ecs-org.eu · 28 Oct 2026 · secondary source
• Removal from the list of entities. From 15 April to 31 May*, the entities who have been notified provide or update at least the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• The public IP address space and domain names of the subject. ecs-org.eu · 28 Oct 2026 · secondary source
• The list of Member States in which they provide services falling within the scope. ecs-org.eu · 28 Oct 2026 · secondary source
• The persons responsible, indicating their role and their updated contact details, including email addresses and telephone numbers. ecs-org.eu · 28 Oct 2026 · secondary source
• A substitute for the point of contact indicating their role and their updated contact details, including email addresses and telephone numbers. ecs-org.eu · 28 Oct 2026 · secondary source
• *Deadline postponed to 31 July for the entities who have requested support for the annual data update. ecs-org.eu · 28 Oct 2026 · secondary source
• Organisations (besides public administrations) must perform a self-assessment before registration: https://www.acn.gov.it/portale/faq/nis ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 25

• Significant incidents are reported to CSIRT Italia with a pre-notification without undue delay and in any case within 24 hours of becoming aware; incident categories are defined in Annexes 3 (important) and 4 (essential) of ACN Determination 379907 of 19 Dec 2025. acn.gov.it · 28 Oct 2026 · source-checked
• Timing of the basic notification obligation: for entities first listed in 2025, nine months from receiving the listing notice; for entities first listed in 2026, from 1 Jan 2027. acn.gov.it · 28 Oct 2026 · source-checked
• By January 2026 (within 9 months from the receipt of the notification of inclusion in the list of NIS entities), entities must ensure compliance with the basic obligations regarding incident notification. ecs-org.eu · 28 Oct 2026 · secondary source
• Significant incidents if: ecs-org.eu · 28 Oct 2026 · secondary source
• Serious disturbance on operational services or financial losses for the entity affected. ecs-org.eu · 28 Oct 2026 · secondary source
• Considerable material or immaterial losses. ecs-org.eu · 28 Oct 2026 · secondary source
• Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Within 24 hours a pre-notification. ecs-org.eu · 28 Oct 2026 · secondary source
• Within 72 hours an incident notification with an initial assessment, including its severity and its impact, as well as, where available, the indicators of compromise. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
• Upon request of CSIRT Italy, an intermediate report on relevant situation updates. ecs-org.eu · 28 Oct 2026 · secondary source
• A final report within one month of the transmission of the notification including: ecs-org.eu · 28 Oct 2026 · secondary source
• A detailed description of the accident, including its severity and impact ecs-org.eu · 28 Oct 2026 · secondary source
• The type of threat or the original cause (root cause) that has probably triggered the accident ecs-org.eu · 28 Oct 2026 · secondary source
• The mitigation measures adopted and underway ecs-org.eu · 28 Oct 2026 · secondary source
• Where known, the cross-border impact of the accident ecs-org.eu · 28 Oct 2026 · secondary source
• Within 24 hours a pre-notification. ecs-org.eu · 28 Oct 2026 · secondary source
• In the event of an accident in progress at the time of transmission of the final report, a monthly report on progress and a final report within one month of completion of incident management. ecs-org.eu · 28 Oct 2026 · secondary source
• Para. 6 – further details on exceptions for trusted services. Para. 7 – The CSIRT Italia can provide a response and directions and advising on mitigation measures and, if requested, further technical support. Para. 8-12 – Further details on other notifications and disclosures ecs-org.eu · 28 Oct 2026 · secondary source
• Art. 26 – Voluntary incident notifications ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

• Administrative and management bodies approve how risk-management measures are implemented, oversee the obligations and are responsible for violations (Art. 23(1)); they must follow cybersecurity training and promote periodic training for staff (Art. 23(2)); they are informed periodically of incidents and notifications (Art. 23(3)). gazzettaufficiale.it · 28 Oct 2026 · source-checked
• Tasks can be delegated internally, but responsibility under Art. 23 remains with the management bodies; all NIS entities must list their management bodies' members. acn.gov.it · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 38

• Para. 8-9 ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to comply with the obligations imposed by Article 23 to the administrative bodies and to the management bodies, as well as to the obligations relating to security risk management information technology and incident notification. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to comply with the provisions adopted by the Authority competent national NIS pursuant to Article 37, paragraphs 3 and 4, and to the relevant warnings. ecs-org.eu · 28 Oct 2026 · secondary source
• These violations are punishable: ecs-org.eu · 28 Oct 2026 · secondary source
• For essential subjects, excluding public ones administrations: up to maximum of €10,000,000 or 2% of the total annual turnover on world scale for the entity’s previous fiscal year. ecs-org.eu · 28 Oct 2026 · secondary source
• For important subjects, excluding public ones administrations: up to maximum of €7,000,000 or 1.4% of total annual turnover on a global scale for the entity’s previous fiscal year. ecs-org.eu · 28 Oct 2026 · secondary source
• For the public administrations as well as for the entities participated in or subjected to control public: €25,000 to €125,000; the fines for these entities, if identified as important entities, are reduced by one third. ecs-org.eu · 28 Oct 2026 · secondary source
• Para. 10-11 ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to register, communicate or update the entity’s information. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to comply with the procedures established by the Authority competent national NIS. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to communicate or update the list of activities and services as well as their categorization. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to implement or enforce the relevant obligations to the use of certification schemes, to the database of registration of domain names as well as sectoral provisions specifications. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to cooperate with the competent national authority NIS in carrying out its activities and exercising its powers referred to in this chapter. ecs-org.eu · 28 Oct 2026 · secondary source
• Failure to collaborate with CSIRT Italy. ecs-org.eu · 28 Oct 2026 · secondary source
• These violations are punishable: ecs-org.eu · 28 Oct 2026 · secondary source
• For essential subjects: up to a maximum of 0.1% of the total annual turnover on a worldwide scale for the entity’s previous fiscal year. ecs-org.eu · 28 Oct 2026 · secondary source
• For important subjects: up to a maximum of 0.07% of the total annual turnover on a worldwide scale for the entity’s previous fiscal year. ecs-org.eu · 28 Oct 2026 · secondary source
• for the public administrations, as well as for the subjects participated in or subjected to public control: from €10,000 to €50,000; the fines for these entities, if identified as important entities, are reduced by one third. In cases of specific repetition, the sanction foreseen for the violation is increased up to double. In cases of non-specific repetition, the sanction provided for the most serious offence is applied, increased up to three times. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 24

• Basic security measures (ACN Determination 379907/2025, applicable from 15 Jan 2026): deadline 18 months from the listing notice for entities listed in 2025; 31 Jul 2027 for entities first listed in 2026. acn.gov.it · 28 Oct 2026 · source-checked
• Secondary sources report 31 Oct 2026 as the effective basic-measures deadline for the 2025 cohort, with ACN inspections possible thereafter. iusprivacy.eu · 28 Oct 2026 · needs verification
• The National Framework for Cybersecurity and Data Protection, based on NIST CSF 2.0, was updated in 2025. Reference to security domains as per NIS2 Directive with further modalities and specifics to be defined in the upcoming months. ecs-org.eu · 28 Oct 2026 · secondary source
• By April 2025 – Definition of basic measures. ecs-org.eu · 28 Oct 2026 · secondary source
• By April 2026 – Definition of long-term measures. ecs-org.eu · 28 Oct 2026 · secondary source
• Under NIS1, Italy relied both on the National Framework for Cybersecurity and Data Protection and on international frameworks ecs-org.eu · 28 Oct 2026 · secondary source
• The technical annexes of the future determinations of the ACN will establish the minimum security requirements to be implemented by October 2026, following the National Framework for Cyber Security and Data Protection (FNCS), which is the Italian adaptation of the NIST Cybersecurity Framework. ecs-org.eu · 28 Oct 2026 · secondary source
• Italy’s NIS2 transposition is closely aligned with the NIS2 Directive regarding risk management requirements. Risks must be assessed periodically or when changes occur. Risk assessment should include technical, physical, sector-specific, and other risks, considering their impacts on IT services, business continuity, incident handling, vulnerability management, and supply chain. Corrective Action Plans must be designed and implemented to address identified risks. Any standard Risk Analysis Methodology is accepted. Risk Analysis compliance by Authorities is embedded into regular audit and compliance processes. ecs-org.eu · 28 Oct 2026 · secondary source
• NIS2 Guidelines Basic Specifications ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: The National Framework for Cybersecurity and Data Protection

Supervisory guidance

• ACN – NIS FAQ (general) acn.gov.it
• ACN – NIS FAQ (basic measures & notifications) acn.gov.it
• ACN – NIS FAQ (roles & procedures) acn.gov.it

Key dates

• 31 Oct 2026 Italy: basic security measures deadline for 2025-listed NIS entities (reported; verify per listing date)
  iusprivacy.eu needs verification
• 1 Jan 2027 Italy: incident notification obligation starts for entities first listed in 2026
  acn.gov.it source-checked
• 31 Jul 2027 Italy: basic security measures deadline for entities first listed in 2026
  acn.gov.it source-checked

What changed recently

1. 15 Jan 2026
   ACN Determination 379907/2025 on basic obligations applies acn.gov.it source-checked
2. 16 Oct 2024
   National NIS2 law enters into force (per tracker) ecs-org.eu secondary source