NIS2 in Italy: the technical side of servers, sites and software

Who has to comply

Legislative Decree 138/2024 is NIS2 in Italy. The national cybersecurity agency (ACN) counts 18 sectors: energy, transport, health and business ICT services, but also manufacturing, food, waste and couriers. The decree applies to organisations above the small-company limits, and ACN divides them into essential and important entities.

Those outside can still get the question: entities in scope have to look after their supply chain, so they send questionnaires to suppliers. If your biggest customer asks for inventories and multi-factor login, the technical work is the same.

The dates

• NIS list of 2025: incident notification from January 2026, basic measures by October 2026. That's 9 and 18 months from the notice of inclusion in the list, so the date on your own notice is the one that counts.
• List of 2026: notification from 1 January 2027, basic measures by July 2027 (ACN determination 127434/2026).
• Every year, from 15 April to 31 May: updating your details on the ACN portal, IP addresses and domains included.

For a significant incident, CSIRT Italia wants a first notice within 24 hours and the notification within 72. Fines go up to EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important ones (article 38).

What the measures ask of your systems

The basic measures are in ACN determination 379907/2025. ACN's guide gives multi-factor authentication on at least the relevant systems and periodic backup restore tests among its examples. It also asks for inventories of devices, software, network flows and suppliers, a vulnerability management plan and a list of systems reachable remotely.

A backup nobody has ever tried to restore won't do, and neither will a measure that isn't written down: you need evidence, and some documents have to be approved by the board.

What I do

• the inventory of servers, sites, domains, business software and remote access, with who manages each;
• a second factor on panels, servers and business software, inside custom programs too;
• encrypted backups and a real restore test, with date and result in a log;
• system, PHP and plugin updates, and a check on whatever no longer gets security fixes;
• monitoring of sites and servers with SitePing, which also flags changed files and admin logins.

I work on what I know: Linux servers, websites, web applications. Office networks, firewalls and Windows workstations stay with whoever looks after them today.

What I don't do

I'm neither a lawyer nor a NIS consultant. Registration on the ACN portal, risk assessment and board resolutions stay with you or your consultant. This page summarises rules as read on 30 October 2026 and is not legal advice: the reference texts are the ones published by ACN.

The closest Swiss rule is the duty to report cyberattacks.

Frequently asked questions

My company is small. Does NIS2 apply to me?

The decree usually starts from medium-sized companies: 50 people or more, or both turnover and balance sheet above EUR 10 million. Some entities are in whatever their size, such as DNS service providers. If a large customer sends you a questionnaire, the law may not touch you directly, but that customer still has to check its suppliers. For your exact case, ask a lawyer or your trade association.

Our software has no two-factor login. Does it have to go?

Not necessarily. If it's a web application and you own the code, I can usually add it. If it's an old program nobody can touch, it can go behind a VPN with a second factor, or be rebuilt. First I look at what data it holds and who uses it from outside.

Is a compliant hosting provider enough?

No. The provider answers for its own part. Admin passwords, plugins, remote access and restore tests often stay with you, and the decree also asks you to check your suppliers.

What do I get at the end?

The fixes made on the systems, updated inventories, the dated result of the restore tests and a list of what is still open, most urgent first. These are the technical pieces for whoever keeps your NIS documents.

Read more

• The service: Hacked sites and security
• Work of this kind: SitePing
• More pages like this: New rules to comply with