NIS2 in Italy: who is affected and what changes for suppliers and SMEs

In short: NIS2 (Directive (EU) 2022/2555, transposed in Italy by Legislative Decree 138/2024, in force since 16 October 2024) applies to medium-sized and large businesses in the sectors listed in its annexes. It requires management bodies to govern risk, security measures (backups, access, suppliers, training) and the reporting of significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within one month of the notification.

The NIS2 Directive (Directive (EU) 2022/2555) raises the level of cybersecurity required of many European organisations. In Italy it was transposed by Legislative Decree no. 138 of 4 September 2024, in force since 16 October 2024. The competent authority is the National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale, ACN).

This is an explainer, not legal advice. ACN's deadlines and decisions change: check the latest information on the Agency's website or with a consultant.

Who is affected

The directive applies to public or private entities in the sectors listed in Annexes I and II that are medium-sized enterprises or exceed the ceilings for medium-sized enterprises under Recommendation 2003/361/EC. Under the recommendation, an enterprise is at least medium-sized when it has 50 or more staff or exceeds €10 million in both annual turnover and balance sheet total. For some activities the rules apply regardless of size: for example DNS services, top-level domain name registries and trust service providers.

Annex I: sectors of high criticality

Energy, transport, banking, financial market infrastructures, health, drinking water and waste water, space, public administration and two groups that matter to anyone working in digital:

• Digital infrastructure: cloud computing services, data centres, content delivery networks, DNS, domain registries, internet exchange points, trust services and electronic communications.
• ICT service management (business-to-business): managed service providers and managed security service providers.

Annex II: other critical sectors

Postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, vehicles), research and digital providers: online marketplaces, online search engines and social networking platforms.

Essential and important entities

The directive distinguishes two categories (Article 3). Essential entities are those in Annex I that exceed the ceilings for medium-sized enterprises, plus certain categories whatever their size, such as DNS and domain registries. Important entities are all the other entities in Annexes I and II, for example medium-sized enterprises in Annex I and medium-sized and large enterprises in Annex II. The difference matters for supervision and penalties.

What the rules require

Risk governance (Article 20)

Management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Their members must undergo training. This isn't something to leave to the IT department alone.

Security measures (Article 21)

Appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach. At a minimum they include:

• policies on risk analysis and information system security;
• incident handling;
• business continuity, such as backup management and disaster recovery;
• supply chain security and relationships with suppliers;
• security in the acquisition, development and maintenance of systems, including vulnerability handling;
• policies to assess the effectiveness of the measures;
• basic cyber hygiene and training;
• use of cryptography where needed;
• human resources security, access control and asset management;
• multi-factor or continuous authentication and secured communications where appropriate.

Incident reporting (Article 23)

An incident is significant if it has caused, or is capable of causing, severe operational disruption or financial loss. It also counts if it has affected other people by causing considerable material or non-material damage. The stages:

1. Early warning within 24 hours of becoming aware of the incident.
2. Incident notification within 72 hours, with an initial assessment of its severity and impact.
3. Intermediate report at the authority's request.
4. Final report within one month of submitting the notification.

Supply chain security

Entities in scope must assess the risks posed by their direct suppliers, including their security and secure development practices. This point weighs heavily on the small companies that provide digital services to entities in scope.

If you're a supplier

Even if you're not directly in scope, a client that is may ask you for:

• a questionnaire on your security measures;
• contract clauses on incident reporting, updates and backups;
• evidence of how you manage access and data;
• audits or periodic checks.

Penalties

The directive provides (Article 34) for fines of up to at least €10 million or 2% of total worldwide annual turnover for essential entities, and up to at least €7 million or 1.4% for important entities, whichever is higher in both cases. Supervisory and inspection powers are also provided for.

Sensible first steps

1. Work out where you stand. Check the sectors and size thresholds and follow ACN's communications. Check whether any of your clients are in scope.
2. List your important systems and data and who has access to them.
3. Check the basics: updates, tested backups, two-factor authentication, access for staff and contractors.
4. Write an incident procedure with names, phone numbers and the 24- and 72-hour stages.
5. Review your supplier contracts and prepare your answers for clients.
6. Document everything. In an inspection, what isn't written down doesn't exist.

Further reading: ransomware: how to reduce the risk · passwords and two-factor authentication · Cyber Resilience Act · website care and maintenance

Frequently asked questions

What is the NIS2 Directive?

It's Directive (EU) 2022/2555 on the security of network and information systems. In Italy it was transposed by Legislative Decree no. 138 of 4 September 2024, in force since 16 October 2024. The competent authority is the National Cybersecurity Agency (Agenzia per la cybersicurezza nazionale, ACN).

Does NIS2 apply to small businesses?

In general it applies to entities in the sectors listed in the annexes that are medium-sized enterprises or exceed the ceilings for medium-sized enterprises. Some activities, such as DNS services and domain name registries, are covered regardless of size. A small business may still receive contractual requests from clients that are in scope.

How quickly must a significant incident be reported?

An early warning within 24 hours of becoming aware of it, a notification with an initial assessment within 72 hours and a final report within one month of submitting the notification (Article 23 of the directive).

What are the penalties?

For essential entities, the directive provides for fines of up to at least €10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, up to at least €7 million or 1.4%, whichever is higher (Article 34). The Italian decree transposes these maximum amounts.

Are IT service providers affected?

Yes. Annex I lists managed service providers and managed security service providers among the sectors of high criticality, along with cloud computing services, data centres and content delivery networks. Online shops are affected if they count as online marketplace providers under Annex II and meet the size thresholds.