Share This Article
NIS compliance in Italy is no longer optional—with the formal notifications by the Italian cybersecurity authority (ACN) to the impacted entities, the race to meet regulatory cybersecurity obligations has officially begun.
🎧 Listen on the topic to the podcast episode below or on Apple Podcasts, Google Podcasts, Spotify, and Audible. In this episode of Diritto al Digitale, Giulio Coraggio and Giulia Zappatterra from DLA Piper explain what NIS 2 compliance means for your organization and how to prepare effectively.
The NIS 2 Countdown Has Started in Italy
The Italian Cybersecurity Agency has begun sending official communications to companies falling within the scope of NIS 2. If you received your notification in April 2025, here’s your roadmap:
-
By May 31, 2025: Entities must complete data entry in the ACN portal, including information on domain names, public IP ranges, applicable EU Member States, and designated compliance officers.
-
By January 2026: You must be able to detect and report significant cybersecurity incidents in line with Article 25 of the NIS 2 Decree.
-
By October 2026: Full compliance with ACN’s security measures is required.
Failing to meet these deadlines exposes organizations to reputational, regulatory, and operational risks.
What Are the NIS 2 Compliance Requirements in Italy?
NIS 2 compliance in Italy is governed by a national framework structured around six core areas:
-
Governance: Define roles and responsibilities, assign contact points, and formalize cybersecurity policies across 15+ areas.
-
Identify: Inventory all ICT assets, suppliers, and systems. Perform formal cyber risk assessments every two years.
-
Protect: Implement MFA, encryption, and staff training protocols.
-
Detect: Monitor activity, centralize logging, and track threat advisories from CSIRT Italia.
-
Respond: Develop and document incident response and notification protocols.
-
Recover: Ensure continuity with disaster recovery and crisis management plans.
Each requirement must be documented, reviewed regularly, and approved at the board level for both essential and important entities.
DLA Piper’s Methodology for NIS Compliance in Italy
At DLA Piper, we help clients navigate this complex regulatory shift through a tailored, modular methodology designed specifically for NIS 2 compliance in Italy:
-
Mapping ICT systems and services
-
Gap analysis against ACN’s expectations
-
Implementing a cyber governance framework
-
Drafting and revising policies and procedures
-
Creating a central “NIS 2 Bible” with scope, responsibilities, and documentation
-
Executive and board-level training
-
Ongoing legal support for ACN interactions and cross-regulatory alignment
Our experience shows that approaching compliance with a strategic, business-oriented mindset is not only more effective—it also creates lasting value beyond regulation. On the topic, you can read also the article “NIS 2 – Personal Liability of Directors For Lack of Compliance is a Warning Message“.