--- title: "NIS2 for SMEs after October 2026: what is left to do" description: "The NIS2 baseline measures deadline passed in October 2026 for most entities listed since 2025. Who is in scope and who is not, the 2027 dates for those listed in 2026, 24 and 72-hour notification, penalties and a checklist for SMEs in Italy." url: "https://www.noze.it/en/insights/nis2-smes-after-october-2026/" lang: "en" alternate: "https://www.noze.it/insights/nis2-pmi-dopo-ottobre-2026/" published: "2026-11-09" author: "noze S.r.l." keywords: "Cybersecurity, Compliance, Governance, NIS2, Legislative Decree 138/2024, ACN, SMEs, Baseline security measures, Significant incidents, Suppliers" --- # NIS2 for SMEs after October 2026: what is left to do The NIS2 baseline measures deadline passed in October 2026 for most entities listed since 2025. Who is in scope and who is not, the 2027 dates for those listed in 2026, 24 and 72-hour notification, penalties and a checklist for SMEs in Italy. 9 November 2026 ![NIS2 calendar after October 2026. Entities listed since 2025: incident notification active since January 2026, baseline measures deadline passed in October 2026 for most. Entities listed in 2026: CSIRT contact by 31 December 2026, notification from 1 January 2027, baseline measures by 31 July 2027. Annual 2027 windows: registration from 1 January to 28 February (listed entities only if something changed), update from 15 April to 31 May, categorisation from 1 May to 30 June.](https://www.noze.it/images/insights/nis2-pmi-dopo-ottobre-2026-en.svg) The dates depend on the year of inclusion in the NIS list. For 2025 entities the exact date runs from the communication received from ACN. Sources at the end. In Italy, for most entities added to the NIS list in 2025, the deadline for the **baseline security measures** passed in **October 2026**. [ACN determination 379907/2025](https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed) sets it at eighteen months from receipt of the communication of inclusion, so each organisation works out the exact date from its own certified email (PEC). [ICT Security Magazine](https://www.ictsecuritymagazine.com/notizie/nis2-adempimenti/) reports that the communications went out from 12 and 13 April 2025 and continued over the following weeks. According to the same source, ACN, the national cybersecurity agency, has granted no extensions. For an SME, what applies depends on its position: listed since 2025, added in 2026, or out of scope while supplying a NIS entity. ## Who is in scope [Legislative Decree 138/2024](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138!vig=) applies to organisations of the types listed in Annexes I and II that exceed the small-enterprise ceilings, so medium-sized enterprises and above. Under Recommendation 2003/361/EC a small enterprise has fewer than 50 staff and annual turnover or a balance sheet total of no more than EUR 10 million. An enterprise that is not autonomous does the calculation under Article 6(2) of the annex to the Recommendation. If it considers the result disproportionate, it can request the safeguard clause during registration (Article 12 of determination 314287/2026), which also looks at how independent its systems and services are from linked enterprises. Regardless of size, the scope includes among others providers of public electronic communications networks or publicly available services, trust service providers, top-level domain name registries, DNS service providers and providers of domain name registration services. Article 3(10) also brings in an enterprise linked to a NIS entity that decides or has a dominant influence over its security measures, runs the systems its services depend on, carries out its security operations or provides it with ICT or security services, including managed ones. ### Suppliers According to [ACN’s FAQ on scope](https://www.acn.gov.it/portale/faq/nis/ambito), an organisation that does not meet the Article 3 criteria is not automatically in scope merely because it supplies a NIS entity: in general, there is no direct propagation of scope down the supply chain. The supplier may however receive contractual obligations, because NIS entities must manage the risk of their own supply chain. Since 2026 NIS entities also send ACN a **list of relevant suppliers**, defined by [determination 314287/2026](https://www.acn.gov.it/portale/documents/d/guest/detacn_piattaforma_314287-2026_signeddg): ICT supplies, or supplies whose interruption or compromise would have a significant impact, including because there are no alternatives. A supplier can therefore appear on that list and sign security clauses without falling under ACN’s supervision. The list also serves to identify systemic elements of the supply chain (Article 3(9)(f)): an organisation so identified receives a specific notice from ACN, and the registration duty follows from there. ## Listed since 2025 Determination 379907/2025 sets out **37 measures** for important entities (Annex 1) and **43** for essential entities (Annex 2). Attesting them takes several kinds of document, listed in [ACN’s FAQ MSB.11](https://www.acn.gov.it/portale/faq/nis/misure-di-sicurezza-e-notifica-di-incidenti): lists, inventories, plans, policies, procedures and registers. They include the risk management plan, the vulnerability management plan, the incident response plan and the training plan. [Article 23](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art23!vig=) applies directly to management bodies: they approve how the measures are implemented, oversee implementation, follow cybersecurity training and answer for violations. ### Incident notification For these entities, notification of significant incidents applies nine months after the communication from ACN, so since **January 2026** for those who received it in April 2025. [Article 25](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art25!vig=) requires a pre-notification to CSIRT Italia within **24 hours** of becoming aware, a notification within **72 hours** (24 hours for the notification too, for trust service providers) and a final report within **one month of the notification**. According to ACN the 24 hours start when, after even a summary analysis, the entity has objective elements matching one of the cases in Annexes 3 and 4. Important entities have three such cases: loss of confidentiality towards the outside, loss of integrity with external impact, breach of expected service levels. Essential entities add unauthorised access or abuse of privileges. The third case is measured against the service levels defined under measure DE.CM-01: where they have not been defined, the yardstick for recognising the incident is missing. ### Checks and penalties ACN’s verification and inspection powers are in [Article 36](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art36!vig=): document checks, on-site and remote inspections, requests for data. For important entities they apply only if ACN obtains elements suggesting possible violations. [Article 37](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art37!vig=) allows it to request data showing the measures are in place, including audit results and the related evidence. ACN can also order audits, periodic or targeted, and security scans; it cannot impose periodic audits on important entities. ICT Security Magazine describes a shift from assistance to supervision; no inspection calendar appears on the ACN NIS pages consulted as of 9 November 2026. [Article 38](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138~art38!vig=) penalises failure to comply with the duties of management bodies, the measures and notification: - **essential entities**: up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher, with a minimum of one twentieth of the maximum; - **important entities**: up to EUR 7 million or 1.4%, whichever is higher, with a minimum of one thirtieth. Public administrations have their own amounts. Use of the Article 37 powers does not rule out a penalty (paragraph 3). For failures on registration, updates and categorisation (paragraph 10) the ceiling is 0.1% of turnover for essential entities and 0.07% for important ones, without prejudice to the minimums in paragraph 9. Where registration is missing or late, paragraph 13 has all the paragraph 8 and 10 violations contested and applies the penalty for the most serious one, increased up to threefold. ### Enhanced measures On [18 September 2026](https://www.acn.gov.it/portale/web/guest/-/le-novita-per-i-soggetti-nis) ACN opened a consultation with the sector tables on enhanced security measures, with the aim of supplementing and replacing the baseline ones. The announcement gives no adoption date. ## Added in 2026 [Determination 127434/2026](https://www.acn.gov.it/portale/documents/d/guest/detacn_misuresicurezza-v4_post) of 13 April sets the deadlines on specific dates: - **CSIRT contact** to be designated by **31 December 2026** (Article 7 of determination 314287/2026); - **incident notification** from **1 January 2027**; - **baseline security measures** by **31 July 2027**. The determination covers those added «in the course of calendar year 2026»: we read this as including those who came in through this year’s list updates. According to ACN, the one announced in September covers over 2,000 late registrations and around 2,000 review procedures. Entities already listed since 2025 keep the 2025 deadlines. The measures to adopt are the same. ## The 2027 calendar The [NIS Vademecum](https://www.acn.gov.it/portale/documents/20119/600993/VademecumNIS_2026_v1.pdf) of September 2026 lists the windows that return each year; the notes also draw on determination 314287/2026: | Period | Obligation | Note | | ----------------------- | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1 January - 28 February | Registration or update of the declaration | entities already listed find a pre-filled draft; with no changes they file no new declaration and stay listed | | by 14 April | To timely registrants, ACN communicates inclusion, continued listing or removal | by certified email (PEC); entities that stay listed with no changes still receive a communication of continued listing, for which the determination sets no date | | 15 April - 31 May | Annual update of information | includes the list of relevant suppliers | | 1 May - 30 June | Listing and categorisation of activities and services | ACN checks a sample; response within 150 days until 31 December 2027 | Outside these windows, any change to the information provided must be reported within 14 days. Missing or late registration is penalised under Article 38(10) and (13). ## The minimum checklist It applies to listed entities, with the dates for their own year of inclusion. The codes are those in the annexes to determination 379907/2025. 1. **Status and dates.** Retrieve the communication from ACN, note whether the entity is important or essential and from which day the deadlines run. 2. **Roles.** Point of contact, substitute, CSIRT contact and a cybersecurity organisation approved by the management bodies (GV.RR-02). 3. **Incidents.** Management and notification plan (RS.MA-01), expected service levels (DE.CM-01) and a tabletop exercise on the 24 and 72-hour windows. 4. **Inventories and suppliers.** Hardware, software and services (ID.AM-01, ID.AM-02), supplier services (ID.AM-04) and an inventory of suppliers with potential security impact (GV.SC-04), the starting point for the list of relevant suppliers in the 15 April - 31 May window. 5. **Vulnerabilities.** CSIRT Italia channels monitored and vulnerabilities fixed through updates or mitigations, or the risk accepted and documented (ID.RA-08). 6. **Access and backups.** Multi-factor authentication on relevant systems according to the risk assessment (PR.AA-03), separate administrator accounts (PR.AA-05), offline backup copies (PR.DS-11). 7. **Management bodies.** Approval of how the measures are implemented, training and periodic reporting on incidents (Article 23). 8. **Evidence file.** Lists, inventories, plans, policies, procedures and registers kept current and easy to find, ready for a request from ACN. An organisation out of scope that supplies a NIS entity starts from the contract: which security clauses are required, with which incident reporting times and which evidence. ## Where CyberAgent and DataGovern help Our view here is not neutral: these are noze products. [CyberAgent](https://www.noze.it/en/products/cyberagent/) works on item 5 and the technical part of item 8, with continuous vulnerability assessment, automated pentesting and reports aligned with NIS2 to validate. [DataGovern](https://www.noze.it/en/products/datagovern/) works on items 3 and 8, with the measures register, the notification windows and documents linked to their source, on-premise. Registration and categorisation on the ACN portal, the designations, approval by the management bodies and sending the notifications to CSIRT Italia remain with the organisation. For posture and the adaptation plan without an in-house CISO there is [CISO-as-a-service consulting](https://www.noze.it/en/cybersecurity/). ## Sources Consulted on 9 November 2026. - [Normattiva, Legislative Decree 138 of 4 September 2024](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2024-09-04;138!vig=) - [ACN, determination 379907 of 19 December 2025: baseline specifications](https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed) - [ACN, determination 127434 of 13 April 2026: deadlines for 2026 entities](https://www.acn.gov.it/portale/documents/d/guest/detacn_misuresicurezza-v4_post) - [ACN, determination 314287/2026: platform, point of contact and NIS representatives](https://www.acn.gov.it/portale/documents/d/guest/detacn_piattaforma_314287-2026_signeddg) - [ACN, NIS Vademecum, September 2026](https://www.acn.gov.it/portale/documents/20119/600993/VademecumNIS_2026_v1.pdf) - [ACN, baseline methods and specifications](https://www.acn.gov.it/portale/nis/modalita-specifiche-base) - [ACN, News for NIS entities, 18 September 2026](https://www.acn.gov.it/portale/web/guest/-/le-novita-per-i-soggetti-nis) - [ACN, NIS FAQ on scope](https://www.acn.gov.it/portale/faq/nis/ambito) - [ACN, NIS FAQ on security measures and incident notification](https://www.acn.gov.it/portale/faq/nis/misure-di-sicurezza-e-notifica-di-incidenti) - [ICT Security Magazine: NIS2, obligations and deadlines after October 2026](https://www.ictsecuritymagazine.com/notizie/nis2-adempimenti/)