Contents

Who is in scope
Listed since 2025
Added in 2026
The 2027 calendar
The minimum checklist
Where CyberAgent and DataGovern help
Sources

CyberAgent

Continuous vulnerability assessment and automated pentesting: validated risks and reports aligned with NIS2, to review before handing them over.

Discover CyberAgent →

DataGovern

NIS2 measures register, incident notification within the 24/72-hour windows and documents linked to their source, on-premise.

Discover DataGovern →

Cybersecurity

CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.

Discover →

The dates depend on the year of inclusion in the NIS list. For 2025 entities the exact date runs from the communication received from ACN. Sources at the end.

In Italy, for most entities added to the NIS list in 2025, the deadline for the baseline security measures passed in October 2026. ACN determination 379907/2025 sets it at eighteen months from receipt of the communication of inclusion, so each organisation works out the exact date from its own certified email (PEC). ICT Security Magazine reports that the communications went out from 12 and 13 April 2025 and continued over the following weeks. According to the same source, ACN, the national cybersecurity agency, has granted no extensions.

For an SME, what applies depends on its position: listed since 2025, added in 2026, or out of scope while supplying a NIS entity.

Who is in scope

Legislative Decree 138/2024 applies to organisations of the types listed in Annexes I and II that exceed the small-enterprise ceilings, so medium-sized enterprises and above. Under Recommendation 2003/361/EC a small enterprise has fewer than 50 staff and annual turnover or a balance sheet total of no more than EUR 10 million. An enterprise that is not autonomous does the calculation under Article 6(2) of the annex to the Recommendation. If it considers the result disproportionate, it can request the safeguard clause during registration (Article 12 of determination 314287/2026), which also looks at how independent its systems and services are from linked enterprises.

Regardless of size, the scope includes among others providers of public electronic communications networks or publicly available services, trust service providers, top-level domain name registries, DNS service providers and providers of domain name registration services. Article 3(10) also brings in an enterprise linked to a NIS entity that decides or has a dominant influence over its security measures, runs the systems its services depend on, carries out its security operations or provides it with ICT or security services, including managed ones.

Suppliers

According to ACN’s FAQ on scope, an organisation that does not meet the Article 3 criteria is not automatically in scope merely because it supplies a NIS entity: in general, there is no direct propagation of scope down the supply chain. The supplier may however receive contractual obligations, because NIS entities must manage the risk of their own supply chain.

Since 2026 NIS entities also send ACN a list of relevant suppliers, defined by determination 314287/2026: ICT supplies, or supplies whose interruption or compromise would have a significant impact, including because there are no alternatives. A supplier can therefore appear on that list and sign security clauses without falling under ACN’s supervision. The list also serves to identify systemic elements of the supply chain (Article 3(9)(f)): an organisation so identified receives a specific notice from ACN, and the registration duty follows from there.

Listed since 2025

Determination 379907/2025 sets out 37 measures for important entities (Annex 1) and 43 for essential entities (Annex 2). Attesting them takes several kinds of document, listed in ACN’s FAQ MSB.11: lists, inventories, plans, policies, procedures and registers. They include the risk management plan, the vulnerability management plan, the incident response plan and the training plan.

Article 23 applies directly to management bodies: they approve how the measures are implemented, oversee implementation, follow cybersecurity training and answer for violations.

Incident notification

For these entities, notification of significant incidents applies nine months after the communication from ACN, so since January 2026 for those who received it in April 2025. Article 25 requires a pre-notification to CSIRT Italia within 24 hours of becoming aware, a notification within 72 hours (24 hours for the notification too, for trust service providers) and a final report within one month of the notification. According to ACN the 24 hours start when, after even a summary analysis, the entity has objective elements matching one of the cases in Annexes 3 and 4.

Important entities have three such cases: loss of confidentiality towards the outside, loss of integrity with external impact, breach of expected service levels. Essential entities add unauthorised access or abuse of privileges. The third case is measured against the service levels defined under measure DE.CM-01: where they have not been defined, the yardstick for recognising the incident is missing.

Checks and penalties

ACN’s verification and inspection powers are in Article 36: document checks, on-site and remote inspections, requests for data. For important entities they apply only if ACN obtains elements suggesting possible violations. Article 37 allows it to request data showing the measures are in place, including audit results and the related evidence. ACN can also order audits, periodic or targeted, and security scans; it cannot impose periodic audits on important entities. ICT Security Magazine describes a shift from assistance to supervision; no inspection calendar appears on the ACN NIS pages consulted as of 9 November 2026.

Article 38 penalises failure to comply with the duties of management bodies, the measures and notification:

essential entities: up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher, with a minimum of one twentieth of the maximum;
important entities: up to EUR 7 million or 1.4%, whichever is higher, with a minimum of one thirtieth.

Public administrations have their own amounts. Use of the Article 37 powers does not rule out a penalty (paragraph 3).

For failures on registration, updates and categorisation (paragraph 10) the ceiling is 0.1% of turnover for essential entities and 0.07% for important ones, without prejudice to the minimums in paragraph 9. Where registration is missing or late, paragraph 13 has all the paragraph 8 and 10 violations contested and applies the penalty for the most serious one, increased up to threefold.

Enhanced measures

On 18 September 2026 ACN opened a consultation with the sector tables on enhanced security measures, with the aim of supplementing and replacing the baseline ones. The announcement gives no adoption date.

Added in 2026

Determination 127434/2026 of 13 April sets the deadlines on specific dates:

CSIRT contact to be designated by 31 December 2026 (Article 7 of determination 314287/2026);
incident notification from 1 January 2027;
baseline security measures by 31 July 2027.

The determination covers those added «in the course of calendar year 2026»: we read this as including those who came in through this year’s list updates. According to ACN, the one announced in September covers over 2,000 late registrations and around 2,000 review procedures. Entities already listed since 2025 keep the 2025 deadlines. The measures to adopt are the same.

The 2027 calendar

The NIS Vademecum of September 2026 lists the windows that return each year; the notes also draw on determination 314287/2026:

Period	Obligation	Note
1 January - 28 February	Registration or update of the declaration	entities already listed find a pre-filled draft; with no changes they file no new declaration and stay listed
by 14 April	To timely registrants, ACN communicates inclusion, continued listing or removal	by certified email (PEC); entities that stay listed with no changes still receive a communication of continued listing, for which the determination sets no date
15 April - 31 May	Annual update of information	includes the list of relevant suppliers
1 May - 30 June	Listing and categorisation of activities and services	ACN checks a sample; response within 150 days until 31 December 2027

Outside these windows, any change to the information provided must be reported within 14 days. Missing or late registration is penalised under Article 38(10) and (13).

The minimum checklist

It applies to listed entities, with the dates for their own year of inclusion. The codes are those in the annexes to determination 379907/2025.

Status and dates. Retrieve the communication from ACN, note whether the entity is important or essential and from which day the deadlines run.
Roles. Point of contact, substitute, CSIRT contact and a cybersecurity organisation approved by the management bodies (GV.RR-02).
Incidents. Management and notification plan (RS.MA-01), expected service levels (DE.CM-01) and a tabletop exercise on the 24 and 72-hour windows.
Inventories and suppliers. Hardware, software and services (ID.AM-01, ID.AM-02), supplier services (ID.AM-04) and an inventory of suppliers with potential security impact (GV.SC-04), the starting point for the list of relevant suppliers in the 15 April - 31 May window.
Vulnerabilities. CSIRT Italia channels monitored and vulnerabilities fixed through updates or mitigations, or the risk accepted and documented (ID.RA-08).
Access and backups. Multi-factor authentication on relevant systems according to the risk assessment (PR.AA-03), separate administrator accounts (PR.AA-05), offline backup copies (PR.DS-11).
Management bodies. Approval of how the measures are implemented, training and periodic reporting on incidents (Article 23).
Evidence file. Lists, inventories, plans, policies, procedures and registers kept current and easy to find, ready for a request from ACN.

An organisation out of scope that supplies a NIS entity starts from the contract: which security clauses are required, with which incident reporting times and which evidence.

Where CyberAgent and DataGovern help

Our view here is not neutral: these are noze products. CyberAgent works on item 5 and the technical part of item 8, with continuous vulnerability assessment, automated pentesting and reports aligned with NIS2 to validate. DataGovern works on items 3 and 8, with the measures register, the notification windows and documents linked to their source, on-premise.

Registration and categorisation on the ACN portal, the designations, approval by the management bodies and sending the notifications to CSIRT Italia remain with the organisation. For posture and the adaptation plan without an in-house CISO there is CISO-as-a-service consulting.

Sources

Consulted on 9 November 2026.

NIS2 for SMEs after October 2026: what is left to do

Article