ISO 27001 and NIS2: why certification is the best route to compliance

ISO 27001 and NIS2 point in the same direction: if you need to comply with NIS2, ISO 27001 certification is the most solid and efficient way to get there. It gives you a proven working method (management system, risk assessment, audits, continual improvement) that covers most of the risk management measures required by Legislative Decree 138/2024 (the Italian NIS2 decree), plus proof verified by an independent third party that you can show to clients, suppliers and authorities.

The timing matters. Today, 31 October 2026, for most entities added to the Italian NIS list in 2025 the 18 months granted to implement the baseline security measures expire, and the Italian National Cybersecurity Agency (ACN) moves into the phase where it verifies rather than guides. If you have a certified management system, you reach this phase with risk analysis, policies, incident management, business continuity and access control already up and running.

In Italy the certificate does not count as compliance on its own: a few specific obligations remain, such as registration on the ACN platform, incident notification to CSIRT Italia and the accountability of management bodies. They are, however, few and well defined, and you address them within the same management system. In this guide you will find why ISO 27001 is the right strategy, what it already covers, a comparison table and an operational plan to complete the journey.

Is ISO 27001 the right route to NIS2 compliance?

Yes: ISO 27001 is the most structured way to achieve NIS2 compliance. It covers most of the technical and organisational core of the risk management measures in Article 24 of Legislative Decree 138/2024, gives you a method to maintain them over time and produces the evidence the ACN asks for during a review. One point needs clarifying: in Italy the certificate does not create a presumption of conformity, because compliance is measured against the requirements of the ACN technical annexes. The final step is therefore a requirement-by-requirement mapping, a task that anyone running an ISMS already knows how to do.

What NIS2 adds to a certified system

An ISO 27001 certificate attests that a management system meets the requirements of the standard within a defined scope. The ACN measures are legal obligations with their own content: for important entities, Annex 1 sets out 37 measures and 87 requirements; for essential entities, Annex 2 sets out 43, with 116 requirements. Many of these requirements have a direct counterpart in the ISO controls, and if you have an ISMS you have already implemented most of them: the task is to link them to the corresponding ACN requirement.

There is also a difference in logic to manage. ISO 27001 leaves the choice of controls to the organisation through risk assessment and the Statement of Applicability: a control can be excluded if justified. The ACN baseline measures, by contrast, are a minimum level that the NIS entity must guarantee. You simply need to review the SoA exclusions against the ACN requirements: it is a check you do once, within the system you already have.

What other European countries do

NIS2 is a directive, and each Member State has transposed it with its own choices. Some countries have introduced mechanisms that give direct weight to certification: in Belgium, according to the Centre for Cybersecurity Belgium FAQs, ISO/IEC 27001 certification can provide a presumption of NIS2 conformity, provided the scope and Statement of Applicability are deemed adequate. Italy has no equivalent provision. The legislator and the ACN opted for a model based on measures defined at national level, built on the Italian National Framework for Cybersecurity and Data Protection, with their own reference codes (for example GV.RR-02 for the organisation of security).

The Italian model nonetheless confirms the value of certification. A well-functioning management system produces exactly what the ACN asks for during a review: approved policies, risk assessments, records, internal audits, corrective actions. The certificate is strong evidence of maturity, complemented by an explicit requirement-by-requirement mapping. If you want to refresh the structure of the standard, its clauses and controls, you will find everything in our complete guide to ISO 27001.

Why ISO 27001 is the right strategy for NIS2

Choosing ISO 27001 as the basis for NIS2 is not just a matter of technical coverage. It is a choice of method that simplifies the work now and in the years that follow, when NIS2 becomes a cycle of annual obligations. Here are the practical arguments.

One system instead of two

NIS2 requires policies, risk analysis, incident management, business continuity, supplier control and assessment of the effectiveness of measures. These are the same building blocks as an ISMS. Building NIS2 compliance on an ISO 27001 system means having a single documentation base, a single risk register, a single internal audit programme and a single management review covering both frameworks.

The saving is in time and duplicated work. Each policy is updated only once, each piece of evidence serves twice and the ACN requirements enter the Statement of Applicability as an extension, not as a parallel file to maintain by hand. If you tackle NIS2 as a separate project, you end up managing two structures to realign with every change.

Evidence ready for an ACN review

In a review, what matters is the state of implementation of the obligations, not just the adoption of documents: the measures must be demonstrated in practice. This is exactly the logic of ISO 27001, which rests on records, indicators, internal audits and corrective actions. A certified ISMS produces evidence that is already organised every year: management review minutes, audit reports, incident logs, restore tests.

The certification cycle adds an independent review carried out by a third party, with annual surveillance audits and recertification every three years. It does not replace the ACN review, but it gets the company used to answering an auditor with documents, dates and owners. When a request for documents arrives, you already know where to find what you need.

Commercial value: tenders, clients and the supply chain

ISO 27001 is an internationally recognised standard, and that carries weight beyond NIS2. In tenders and in relationships with large clients, certification is often among the requirements requested or assessed, and it is proof verified by third parties, not a self-declaration.

The effect on the supply chain also matters. NIS entities must assess the security of their direct suppliers and, from 2026, list the relevant ones in their annual update to the ACN. That is why they ask suppliers for assurances in line with NIS2 requirements, even when the supplier is not itself a NIS entity. An ISO 27001 certificate is the most direct way to answer these requests and remain a qualified supplier.

Governance and management accountability already in place

NIS2 requires management bodies to approve the measures, oversee their implementation and undergo training. ISO 27001 prepares the ground: clause 5.1 requires leadership and commitment from top management, clause 5.3 the assignment of roles and responsibilities, clause 9.3 a periodic management review. If you are certified, you already have a reporting line to senior management on risks, incidents and security objectives.

The extra step is a formal one: linking the management review to the management body in the corporate sense, with a resolution approving the measures and records of the training received. You start from something that already exists. For a certified company, NIS2 governance is an adaptation, not a restart.

The NIS2 framework in Italy at the end of 2026: decree, determinations and deadlines

NIS2 in Italy rests on three levels: Directive (EU) 2022/2555, Legislative Decree 138/2024 which transposes it, and the ACN implementing determinations. To understand what ISO 27001 covers, you first need to know which obligations are in force today and with what deadlines.

Legislative Decree 138/2024 and the role of the ACN

Legislative Decree 138/2024 identifies essential and important entities according to sector and size, with some exceptions where inclusion depends on the role performed. The ACN is the competent national authority and the single point of contact; CSIRT Italia, set up within the Agency, receives incident notifications. Four articles are key to the comparison with ISO 27001. Article 23 concerns management and governing bodies. Article 24 lists the risk management measures, along the lines of Article 21 of the directive. Article 25 governs the notification of significant incidents. Article 38 sets out the penalties.

The decree leaves it to the ACN to define the procedures and baseline specifications for compliance. This is where the operational game is played: the law says what to do, the determinations say how and in how much detail.

The ACN determinations in force

The reference for the baseline measures is no longer determination no. 164179 of 14 April 2025. It has been updated and replaced by determination no. 379907 of 19 December 2025, applicable from 15 January 2026, which rewrites the four technical annexes: measures for important entities (Annex 1), measures for essential entities (Annex 2) and criteria for significant incidents (Annexes 3 and 4). The same determination adds the CSIRT contact person to the security organisation and confirms the compliance deadlines: 18 months for the measures and 9 months for notification, running from the communication of inclusion in the NIS list.

Two further determinations were added in 2026. No. 127434 of 13 April 2026 sets the deadlines for entities added to the list for the first time in 2026: notification obligation from 1 January 2027, security measures by 31 July 2027. No. 127437/2026 replaces the rules on the NIS platform and introduces two significant changes: the annual categorisation of activities and services, and the listing of relevant suppliers in the annual update.

From 31 October 2026: from the support phase to supervision

For most entities added to the list in 2025, the 18-month deadline falls at the end of October 2026. The exact date remains individual: you need to read it on your own inclusion notice. From this point on, the requirements in the annexes become verifiable controls.

The ACN FAQs on monitoring, supervision and enforcement, published on 11 August 2026, describe four areas: monitoring, analysis and support; audits and inspections; enforcement measures; penalties. Monitoring is systematic and ongoing and is used to understand how far obligations have been implemented. Audits can include requests for documents and on-site or remote inspections. For essential entities inspections can also be ordered ex ante; for important entities they cannot: there must be evidence, indications or information suggesting possible breaches.

This leads to a point that anyone coming from the ISO world knows well: adopting a procedure is not enough, you have to show that you apply it. A policy that has been approved but never put into practice is exactly the kind of misalignment a review brings to light.

Where ISO 27001 already covers the NIS2 requirements

ISO 27001:2022 covers much of the technical and organisational core of the NIS2 measures. The ten areas of Article 24 of Legislative Decree 138/2024 (from letter a to letter l) almost all have a counterpart in clauses 4-10 and in the 93 controls of Annex A. Let us look at where the overlap is strongest.

Risk analysis, policies and measuring effectiveness

NIS2 requires risk analysis and information system security policies, and policies to assess the effectiveness of the measures. This is the heart of ISO 27001. Clause 6.1.2 requires a repeatable risk assessment process, clause 6.1.3 risk treatment and the Statement of Applicability, and control A.5.1 the information security policies.

On effectiveness, clause 9.1 requires monitoring and measurement, 9.2 internal audit, 9.3 management review and 10.2 the handling of nonconformities and corrective actions. A mature ISMS already has indicators, records and improvement cycles: this is the documentary base the ACN expects to find when it asks you to show that the measures work over time. You should still check that the risk assessment covers the systems and services relevant for NIS purposes, and not only those included in the scope of the certificate.

Incident management, business continuity and backup

Letter b) of Article 24 concerns incident handling; letter c) business continuity, backup, disaster recovery and crisis management. ISO 27001:2022 devotes a coherent block of controls to these topics. Controls A.5.24 to A.5.28 cover the whole incident lifecycle: planning, assessment of events, response, learning and collection of evidence. A.5.29 and A.5.30 deal with security during disruption and ICT readiness for business continuity. A.8.13 covers backup, A.8.14 redundancy.

If you have implemented these controls seriously, you already have roles, escalation procedures and event classification criteria. The point to watch is testing. The ACN requirements ask for plans to be tested, and records of restore tests are among the most frequently requested evidence. Yet even certified companies do not always genuinely test their incident management procedure or their restore from backup: sometimes these exist on paper but not in day-to-day operations.

Technical controls: access, vulnerabilities, cryptography, training

Letters e) to l) of Article 24 require technical and cyber hygiene measures that ISO 27001 covers extensively. Access control and asset management correspond to A.5.9 (inventory), A.5.15-A.5.18 (access and identity) and A.8.2 (privileged access). Cryptography corresponds to A.8.24. Security in development and maintenance corresponds to A.8.25-A.8.29, including security testing. Technical vulnerability management corresponds to A.8.8; logging and monitoring to A.8.15 and A.8.16; protection against malware to A.8.7.

On training and basic cyber hygiene, clause 7.2 (competence), clause 7.3 (awareness) and control A.6.3 cover staff. To verify the effectiveness of technical controls on exposed applications, many companies use penetration testing: in our guide to WAPT we explain how a report with a remediation plan and retest becomes valid evidence both in an ISO audit and for NIS2. WAPT is not an explicit obligation, but it is one of the most concrete tools to show that vulnerability management works.

Comparison table: ISO 27001:2022 and NIS2/ACN requirements

The table compares the NIS2 areas with the ISO 27001:2022 references and shows what remains to be done. Coverage is qualitative: it depends on how the management system has been implemented and on its scope, not on simply holding the certificate.

The extra steps: what to add to ISO 27001 for NIS2

With ISO 27001 you have already done the largest part of the work. Six extra steps remain, linked to obligations towards the authority, the personal accountability of directors and the detailed requirements of the ACN determinations. They do not stem from weaknesses in your management system: the standard was simply not written for a public supervisory regime. That is why they fit into your existing ISMS without overturning it.

Registration and annual updates on the ACN platform

No ISO clause provides for periodic obligations towards a public authority. NIS2, however, has a fixed calendar. Between 1 January and 28 February each year, you register or renew on the ACN portal. Between 15 April and 31 May, you update your data, including the point of contact and their substitute. From 2026, between 1 May and 30 June, you submit the categorised list of activities and services. From the 2027 registration onwards, entities already on the list with no changes to declare do not need to resubmit the declaration.

The platform rules, now set out in determination no. 314287/2026, applicable from 25 October 2026, treat the point of contact's submission as a formal declaration under Presidential Decree 445/2000 (Italian law on self-declarations). Ten calendar days after submission, the declaration becomes final and can no longer be changed. The CSIRT contact person must be designated by 31 December of the year of inclusion in the list.

These obligations are not "security" in the strict sense, but failing to meet them is a breach in its own right. They are easy to integrate into an ISMS: just add them to the register of legal requirements under control A.5.31 and assign them to an owner with precise deadlines.

Incident notification to CSIRT Italia: 24 hours, 72 hours, one month

ISO 27001 requires you to manage incidents and to maintain contact with authorities (A.5.5), but it does not set mandatory deadlines or recipients. Article 25 of Legislative Decree 138/2024, on the other hand, introduces a precise sequence for significant incidents. The early warning must be sent to CSIRT Italia within 24 hours of becoming aware of the incident. The notification, which updates the early warning with an initial assessment of severity and impact, must be sent within 72 hours. The final report must be submitted within one month of the notification, and an intermediate report may be requested.

The operational sticking point is the definition of "significant incident". It does not coincide with the internal classification many certified companies use. The criteria are set out in Annexes 3 and 4 of determination no. 379907/2025. If you are already certified, you therefore need to rewrite your incident management procedure on two levels: the internal one, which already exists, and the regulatory one, with thresholds, deadlines, named roles and submission channels. An exercise based on a realistic scenario is the quickest way to find out whether the 24 hours are really achievable.

Management bodies: approval, accountability and training

ISO 27001 requires leadership and commitment from top management (clause 5.1), but it stays within the boundaries of the management system. Article 23 of Legislative Decree 138/2024 goes further. Management and governing bodies approve how the risk management measures are implemented, oversee their implementation and are accountable for breaches. They are also required to undergo cybersecurity training and to promote similar training for employees.

In practice you need three pieces of evidence that an ISO audit does not require in this form. The first is a formal resolution, dated and minuted, approving the measures. The second is a regular flow of information on risks, incidents and notifications to the management body. The third is a record of the training received by its members. The ISO management review (clause 9.3) is a good starting point, but the link with the management body in the corporate sense must be made explicit. Moreover, accountability cannot be transferred to the managed service provider or to the IT manager.

Supply chain and relevant suppliers

ISO 27001:2022 deals with suppliers through five controls, A.5.19 to A.5.23, including cloud. It is a good foundation, but NIS2 asks for more. Article 24 requires you to consider the specific vulnerabilities of each direct supplier, the quality of products and security practices, including secure development procedures. Many certified companies manage suppliers with generic questionnaires and standard contractual clauses, without checking the security requirements of products and services before purchase.

From 2026 there is also a new reporting obligation. Introduced by determination no. 127437/2026 and confirmed by no. 314287/2026, the rule is that relevant suppliers must be listed in the annual update, with company name, tax code, country of registered office, CPV codes and relevance criterion. You therefore need a supplier register built on NIS criteria, consistent with what you declare to the ACN.

Specific requirements of the ACN baseline measures

The ISO Statement of Applicability is built on the Annex A controls, not on the ACN requirements. The annexes to determination no. 379907/2025 contain requirements worded with their own level of detail, organised according to the functions of the National Framework. Some match an ISO control almost word for word; others ask for elements that ISO leaves to the organisation's discretion.

Typical examples are the adoption of multi-factor authentication, emergency communications, the formalisation of specific plans and registers, and the documentation of periodic tests. This is why the mapping must be done requirement by requirement, with a grid showing for each one its status (met, partial, missing), the evidence available, the owner and the date of the last check.

Scope: the certification scope and the NIS entity

Clause 4.3 of ISO 27001 allows you to define the scope of the management system. Many companies certify only one site, one service, one data centre or one product line. It is a legitimate choice for certification purposes, but NIS2 does not reason in terms of scope: the obligations concern the NIS entity, with its activities and services, as categorised on the ACN platform.

If the certificate covers the cloud service but not the administrative or production systems, there is a scope gap. The same happens in corporate groups where the certification is held by a single entity. The first check is to compare the certificate scope with the list of declared activities and services.

Penalties and supervision: why complete the journey beyond the certificate

Completing the NIS2 steps on top of the certificate protects you from significant financial penalties and from measures that directly involve senior management. Article 38 of Legislative Decree 138/2024 provides, for essential entities, for fines of up to EUR 10 million or 2% of total worldwide annual turnover; for important entities, up to EUR 7 million or 1.4%. In both cases the higher amount applies.

How an ACN review works

According to the ACN FAQs, the Agency follows a gradual, risk-based approach. It can request reports or self-assessments, check the documentation submitted and, if necessary, order inspections. Alongside penalties there are enforcement measures: orders and formal warnings, with reasonable deadlines, to remedy shortcomings and restore compliance. The types of infringement are the same for everyone, but the size of the penalties and the ancillary measures differ between essential entities, important entities and public administrations.

For a certified company, an ACN review has a lot in common with an audit. The focus is on consistency between documents and practice, records and the traceability of decisions. The difference is the yardstick: the ACN assesses the technical annexes and legal obligations, not the Statement of Applicability.

Why evidence matters more than policies

The criterion is clear: in a review what counts is that the measures are actually implemented, not just adopted. The expected evidence is typical of a living ISMS. You need an inventory of assets and services consistent with what is declared on the portal and the management body's resolution. You also need the notification procedure with named owners, the log of restore tests, the training records for management and the documentation on supplier security.

If you have a certified management system, you have a clear advantage: you already know how to build and keep evidence. But you need to organise it so that it answers the ACN's questions, not only those of the certification auditor.

Operational plan: from ISO 27001 to NIS2 compliance

Moving from ISO 27001 to NIS2 compliance is an integration job, not a second project from scratch. The goal is a single management system that meets both frameworks, with one documentary base. Here is the sequence we suggest.

Phase 1: check your scope and individual deadlines

The first step is to understand precisely where you stand. Retrieve your notice of inclusion in the NIS list and work out your individual deadlines: 18 months for the measures and 9 for notification if you are in the 2025 cohort; 31 July 2027 and 1 January 2027 if you were added in 2026. Check whether you are an essential or an important entity, because the annex and the number of requirements change.

Then compare the scope of your ISO certificate with the categorised list of activities and services submitted to the ACN. Every NIS system or service outside the ISO scope should be flagged as an area to cover. This phase takes little time but avoids the most costly mistake: doing good work on the wrong scope.

Phase 2: requirement-by-requirement gap analysis

Take the applicable ACN annex and match each requirement with the corresponding ISO control, the existing evidence and its status. The comparison table in this guide is a starting point, but the operational grid must go down to the individual requirement. For each one it is worth recording: requirement code, status (met, partial, missing), evidence, named owner, date of the last check and any notes.

The typical result for a certified company is a picture with many requirements already met or partially met on the technical side, and gaps concentrated on governance, notification, suppliers and obligations towards the authority. That is good news: these gaps are closed with processes and documents, rarely with new technology investments. If you want a reference on how to set up this work, on our page dedicated to NIS2 Directive compliance we describe how we tackle it with companies.

Phase 3: integration into the management system

The gaps must be closed within the ISMS, not in a parallel file. In practice, the work consists of six actions:

1. update the register of legal requirements (A.5.31) with Legislative Decree 138/2024 and the ACN determinations;

2. extend the risk assessment to NIS systems outside the scope;

3. rewrite the incident procedure with the regulatory level of notification to CSIRT Italia;

4. update the Statement of Applicability with references to the ACN requirements;

5. review supplier management with the NIS relevance criteria;

6. submit the measures and the training plan to the management body for a formal resolution.

Integration avoids double maintenance. Whenever a policy changes, it changes only once, and the next internal audit checks ISO and ACN requirements together.

Phase 4: governance, training and testing

This is the phase in which the system becomes demonstrable. The management body approves the measures by resolution, receives the first periodic report on risks and incidents and completes the required training, with records kept. The CSIRT contact person and substitutes are designated, if they have not been already.

Then you test. A notification exercise on a realistic scenario checks that the 24 hours are achievable. A restore test from backup, recorded with date and outcome, checks continuity. A security test on exposed applications, such as a WAPT, checks vulnerability management and produces a traceable remediation plan.

Phase 5: calendar and ongoing maintenance

NIS2 compliance does not end with a deadline: it is an annual cycle. The compliance calendar must include registration and renewal (1 January-28 February), data update (15 April-31 May), categorisation (1 May-30 June), the list of relevant suppliers, periodic training, policy reviews, restore tests and exercises.

On top of this sits the ISO cycle: internal audit, management review, annual surveillance audits and recertification every three years. Aligning the two calendars, with an internal audit that checks both frameworks before the management review, is the most efficient way to keep everything under control. A single compliance calendar, like the one in the Complaion platform, stops an ACN obligation from getting lost between one audit and the next. Finally, keep an eye on how the measures evolve: the current specifications are baseline ones, adopted in the first application phase, and Article 31 of Legislative Decree 138/2024 requires the ACN to set proportionate obligations and gradual implementation timelines.

The most common mistakes made by ISO 27001 certified companies

The most common mistake is to stop at the certificate without completing the few extra steps that NIS2 requires. Other recurring mistakes follow from it; we often see them in gap analyses of companies that are already certified, and they are easy to avoid.

Confusing the Statement of Applicability with ACN compliance

The Statement of Applicability lists the ISO controls applied and excluded, with the reasons. It says nothing about the ACN requirements. A control excluded for a reason that is valid for ISO purposes, for example because the risk has been accepted, may correspond to a requirement that is mandatory for a NIS entity. The risk is turning up to a review with documentation that is formally flawless but built on the wrong framework.

The solution is simple: add to the SoA, or alongside it, a column referencing the corresponding ACN requirement. That way each exclusion is assessed twice, before it becomes a problem.

Treating notification as a variant of incident management

Many incident management procedures already include a step for "communication to the authorities". It is usually a generic line, designed for the data protection authority or law enforcement. NIS notification has its own thresholds, deadlines, content and channels, and the first deadline is 24 hours. Simply adding CSIRT Italia to the list of recipients is not enough.

You need a dedicated procedure, with significance criteria taken from the ACN annexes, named roles, on-call availability, pre-filled templates and at least one exercise a year. Without a practical test, the procedure remains just a document.

Leaving governance to IT

Clause 5 of ISO 27001 involves top management, but in many SMEs the system is in fact run by the IT manager or the external consultant. Under NIS2 this arrangement does not hold. Management bodies must approve, oversee and undergo training, and they are personally accountable. A missing resolution or undocumented training are among the easiest gaps to spot in a review, and among the simplest to avoid.

How Complaion takes you from ISO 27001 to NIS2

With Complaion, ISO 27001 and NIS2 become a single pathway: one management system, one work plan, one evidence base for both certification and compliance with the ACN measures.

We support you with a dedicated Lead Auditor and a digital platform. The Lead Auditor sets up or reviews your ISMS with a scope consistent with the NIS perimeter, carries out the gap analysis against the ACN annexes and guides you through the extra steps, from the notification procedure to the management body's resolution. They also carry out the internal audit, on the ISO 27001 controls and the ACN requirements together, before the management review and every surveillance audit. The platform centralises evidence collection, document management, the compliance calendar and audit preparation, so ISO and NIS2 requirements live in a single system. More than 1,000 clients already work with us.

If you are starting from scratch, the ISO 27001 certification pathway is designed from the outset to cover NIS2 as well. If you are already certified, we start from your ISMS and complete it with the ACN requirements. To test your exposed applications and obtain concrete evidence that vulnerability management works, useful for both ISO 27001 and NIS2, you can use our WAPT penetration test. To understand where to start, book a free 30-minute call with a Lead Auditor.

Frequently asked questions about ISO 27001 and NIS2

Is it worth getting ISO 27001 certified if I need to comply with NIS2?

Yes, the most efficient strategy. Certification covers most of the risk management measures required by NIS2, gives you a method to maintain them over time and an independent review to show to clients, suppliers and authorities. With a single management system you avoid running two parallel documentation structures, and the few NIS2-specific obligations are added to the same system. Certification also helps with clients who, as NIS entities, must assess the security of their own suppliers. It is best designed from the outset with a scope consistent with the NIS perimeter.

Is ISO 27001 certification mandatory for NIS2?

No, NIS2 does not require ISO 27001 certification. Legislative Decree 138/2024 requires appropriate and proportionate risk management measures, and the ACN determinations set out the baseline measures. ISO 27001 is one of the most effective ways to structure and demonstrate these measures, because it covers much of their technical core. It remains a voluntary choice, but it is the one that takes you to NIS2 with the least duplicated work.

If I am ISO 27001 certified, am I automatically NIS2 compliant?

Not automatically, but you get there with a few extra steps. In Italy there is no presumption of conformity linked to ISO 27001 certification: the ACN assesses the implementation of the requirements in the annexes to determination no. 379907/2025. The certificate, however, covers most of the work and is strong evidence of maturity. To complete compliance, you integrate a requirement-by-requirement mapping and the NIS2-specific obligations into your ISMS.

What do I need to add to ISO 27001 to comply with NIS2?

Six well-defined steps, all of which fit into your ISMS. There are registration and annual updates on the ACN platform, and notification of significant incidents to CSIRT Italia within the statutory deadlines. Then come the accountability and mandatory training of management bodies, and the listing of relevant suppliers. Finally, there is the mapping against the specific ACN requirements and any alignment needed between the certificate scope and the NIS entity.

What are the notification deadlines for a significant incident?

Article 25 of Legislative Decree 138/2024 requires an early warning to CSIRT Italia within 24 hours of becoming aware of the incident. The notification, with an initial assessment of severity and impact, must be sent within 72 hours. The final report must be submitted within one month of the notification, and CSIRT Italia may request an intermediate report. The criteria for deciding whether an incident is significant are in the annexes to ACN determination no. 379907/2025.

By when must the baseline security measures be implemented?

The deadline is 18 months from the notice of inclusion in the NIS list. For most entities added in 2025 it falls at the end of October 2026, but the exact date is individual and should be read on your own notice. For entities added for the first time in 2026, determination no. 127434/2026 sets the deadline at 31 July 2027. For them, the notification obligation applies from 1 January 2027.

Are directors personally liable for NIS2 breaches?

Yes, Article 23 of Legislative Decree 138/2024 states that management and governing bodies are accountable for breaches of the decree. They must approve how the measures are implemented and oversee their application. They are also required to undergo cybersecurity training. Accountability is not transferred by delegating management to the IT department or an external provider.

What penalties apply for failing to comply with NIS2?

Article 38 of Legislative Decree 138/2024 provides for essential entities fines of up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities the maximum is EUR 7 million or 1.4% of total worldwide annual turnover. The size of the penalties and the ancillary measures vary between essential entities, important entities and public administrations. Finding a shortcoming can also lead to measures aimed at restoring compliance.