Is your company
subject to NIS2?
Answer four questions on sector, size and activities: we'll tell you whether NIS2 applies to your company, and as which type of entity.
Frequently asked questions
about NIS2.
What is the NIS2 directive?
NIS2 is the EU Directive 2022/2555 on the security of network and information systems. In Italy it was transposed by Legislative Decree 138/2024, in force since 16 October 2024. Compared with the first NIS directive, it covers many more sectors and companies and introduces stricter obligations for management bodies.
Which companies are subject to NIS2?
As a rule, medium and large companies operating in the sectors listed in Annex I (high criticality, such as energy, transport, health, banking and digital infrastructure) and Annex II (other critical sectors, such as manufacturing, food and waste management). Some activities, such as DNS providers, TLD registries, trust service providers and electronic communications, fall within scope regardless of size.
What is the difference between essential and important entities?
Essential entities are mostly large companies in Annex I sectors, plus some specific categories; important entities are the other companies within scope. The obligations are similar, but essential entities face proactive supervision and higher fines, while important entities are supervised mainly after an incident or a report.
What do I have to do if my company is in scope?
In Italy you must register on the ACN (National Cybersecurity Agency) platform and update your data every year between 1 January and 28 February. You must adopt risk management measures, including supply chain security and staff training, and report significant incidents to CSIRT Italia: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Management bodies approve the measures and are responsible for them.
What are the fines?
Under Legislative Decree 138/2024, essential entities face fines of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. For important entities the cap is 7 million euros or 1.4% of turnover. Management bodies can also be held personally liable for failing to meet the obligations.
Is the quiz result final?
No. The quiz gives a preliminary estimate based on your answers. The formal classification depends on your ATECO code, the activities you actually carry out and any designation by the authority, so it should be checked with an expert.
My company is not in scope. Do I still need to do anything?
Possibly. Companies subject to NIS2 must manage the security of their supply chain, so they are increasingly asking their suppliers for security requirements, evidence and certifications. Being ready gives you an advantage with those clients.
Does ISO 27001 help with NIS2?
Yes. An information security management system certified to ISO 27001 already covers many of the risk management measures required by NIS2, such as risk assessment, access control, incident management and supplier security. It does not replace the specific obligations, such as registration and incident reporting, but it is a solid foundation.
