NIS2 Compliance: Obligations for EU Businesses

The NIS2 Directive (Network and Information Security 2) represents a significant evolution in the European cybersecurity landscape, with direct and stringent impacts on businesses across the EU. Its transposition into national law, such as Italy’s Legislative Decree 4 September 2024, n. 138, has expanded its scope compared to the previous NIS1, encompassing a greater number of sectors and types of organizations. This means that many more entities, including medium-sized ones, now face new and complex cybersecurity obligations. The stakes are high: not only data protection and operational continuity but also the prevention of substantial penalties that can amount to a significant portion of global turnover. Understanding whether your company falls within the scope and what priority actions to take is the first step towards effective compliance. When I managed the compliance process for a public healthcare organization with 2,000 endpoints, the initial challenge was precisely identifying and mapping all critical services that fell within the NIS2 perimeter. Read also: GDPR System Admin: Role, Obligations & Compliance

Tested on: Legislative Decree 4 September 2024, n. 138 · ACN Guidelines · October 2026

What is NIS2 and the National Transposition Law

The NIS2 Directive (EU 2022/2555) is the second pillar of Europe’s cybersecurity strategy, succeeding NIS1 (EU 2016/1148). Its objective is to raise the level of cyber resilience and incident response capability across the Union, harmonizing national regulations. In Italy, NIS2 was transposed with Legislative Decree 4 September 2024, n. 138, published in the Official Gazette no. 219 on September 18, 2024, and effective from October 3, 2024. This decree is not a mere transposition but an integration that considers the specificities of the Italian context, strengthening the powers of the National Cybersecurity Agency (ACN) as the competent authority. The national law introduces a risk-based approach, significantly expanding the number of entities subject to the directive and introducing more stringent security measures and faster incident notification mechanisms.

Essential and Important Entities: How to Determine Your Status

NIS2 classifies entities into two main categories: Essential Entities (EEs) and Important Entities (IEs). This distinction is crucial because it determines the applicable supervisory regime, controls, and penalties. Classification depends on the sector and the size of the organization. To determine if your company falls within the scope, you need to cross-reference the sectors listed in Annex I (Essential Entities) and Annex II (Important Entities) of the national transposition law and your organization’s size.

An organization is considered medium-sized if it has:

• Fewer than 250 employees AND
• An annual turnover not exceeding 50 million euros OR an annual balance sheet total not exceeding 43 million euros.

Entities exceeding these thresholds are considered large. Generally, large entities in Annex I sectors are EEs, while those in Annex II sectors are IEs. For medium-sized entities, classification may vary depending on the sector and specific criteria defined by the national competent authority (e.g., ACN in Italy). Read also: ACN Cloud Catalog: QC1-QC4 Levels Explained

Sectors and Size Thresholds

The NIS2 directive drastically expands the sectors covered compared to NIS1. Here are some examples:

Essential Entities (Annex I of National Transposition Law):

• Energy (electricity, gas, district heating and cooling, oil, hydrogen)
• Transport (air, rail, water, road)
• Banking and financial market infrastructures
• Health (healthcare providers, reference laboratories, pharmaceutical R&D)
• Drinking water and wastewater
• Digital infrastructure (IXP, DNS, TLD, cloud services, data centers, CDNs)
• Public administration (central and regional)
• Space

Important Entities (Annex II of National Transposition Law):

• Postal and courier services
• Waste management
• Manufacturing (medical devices, motor vehicles, electronic equipment, machinery, chemicals, food products)
• Digital providers (search engines, social networking platforms, content delivery network services)
• Research

Organization size is a fundamental criterion. Small enterprises (fewer than 50 employees and turnover/balance sheet < 10 million euros) are generally excluded, except for specific exceptions (e.g., sole providers of critical services or high-risk entities). It is essential to consult the text of your national transposition law and the guidelines from your competent authority for a precise assessment of your status. National authorities also have the power to identify additional entities as critical, regardless of their size or sector.

Key Obligations: Security Measures, Incident Notification, Management Accountability

The obligations imposed by NIS2 are broad and require a holistic approach to cybersecurity. Among the main ones:

1. Security Measures: Entities must adopt appropriate technical, operational, and organizational measures to manage risks to the security of network and information systems. These include:

• Risk analysis and information security policies.
• Incident management (prevention, detection, response).
• Business continuity and crisis management (backup, disaster recovery).
• Supply chain security (risk assessment of suppliers and external services).
• Security in the acquisition, development, and maintenance of information systems.
• Policies and procedures for testing and evaluating the effectiveness of security measures.
• Use of encryption and multi-factor authentication (MFA).
• Cybersecurity training and hygiene awareness for personnel.

An example of a fundamental technical measure is the implementation of a SIEM for security event correlation, as I did in an enterprise environment to detect anomalies. Read also: Docker Disk Space: Prune, Logs, and Unused Images

    # Example command to check the status of a SIEM service like Wazuh
    sudo systemctl status wazuh-manager

    # Example command to view SIEM logs for troubleshooting
    journalctl -u wazuh-manager.service -f

1. Incident Notification: Significant incidents must be notified to the national competent authority (e.g., ACN) within very strict deadlines:

• Early Warning (24 hours): Within 24 hours of becoming aware of the incident, a preliminary notification must be sent indicating the nature of the incident and its estimated impact.
• Incident Notification (72 hours): Within 72 hours, a more detailed notification including an initial assessment of the incident, its severity and impact, and indicators of compromise.
• Final Report (one month): Within one month, a final report detailing the causes, measures taken, and long-term impact.

These deadlines require well-defined and tested incident response plans with clear roles and responsibilities.

1. Accountability of Management Bodies: NIS2 introduces a principle of direct accountability for management bodies (e.g., board of directors, CEOs). They must approve cybersecurity measures, oversee their implementation, and are liable for penalties in case of non-compliance. This elevates cybersecurity from a technical issue to a strategic business priority.

Passed and Upcoming Deadlines

The national transposition law (e.g., Italy’s D.Lgs. 138/2024) became effective on October 3, 2024. This means that companies falling within the NIS2 perimeter are already subject to its obligations. However, some specific deadlines for compliance are staggered:

• April 3, 2025: Deadline by which entities must notify their national competent authority of their classification as an Essential or Important Entity and the services they provide. This is a crucial deadline requiring immediate self-assessment.
• October 3, 2025: Deadline by which all entities must have implemented the technical and organizational security measures required by the directive.

It is essential to act urgently to avoid penalties. National authorities (e.g., ACN) have already started publishing guidelines and clarifications on their websites, which are indispensable resources for compliance.

Where to Start if Your Company Has Done Nothing Yet

If your company has not yet begun the NIS2 compliance journey, here is an operational roadmap:

1. Preliminary Assessment: Determine if your organization qualifies as an Essential or Important Entity based on the sectors and size thresholds in your national transposition law. Do not underestimate this step: an error here can expose you to unnecessary risks.

1. Gap Analysis and Risk Assessment: Conduct a thorough analysis of current security measures against NIS2 requirements. Identify gaps and assess residual risks. This includes analyzing the supply chain and critical service providers.

1. Define the Compliance Plan: Based on the gap analysis, develop a detailed action plan that includes implementing required measures, reviewing policies, staff training, and defining incident management and notification procedures. Assign clear responsibilities and internal deadlines.

1. Implement Measures: Proceed with the implementation of technical (e.g., MFA, SIEM, system hardening Read also: Passwordless SSH Linux: Configure Keys in 5 Minutes (2026)), organizational (e.g., security policies, access management), and procedural (e.g., Business Continuity and Disaster Recovery plan) measures.

1. Training and Awareness: Invest in continuous training for personnel at all levels, including management bodies, to increase awareness of cyber risks and NIS2 obligations.

1. Testing and Monitoring: Regularly test the effectiveness of implemented measures (e.g., penetration tests, attack simulations) and constantly monitor the environment to detect and respond to incidents. NIS2 compliance is a dynamic process, not a single event.

Common Errors and Troubleshooting

One of the most common errors is underestimating the complexity and breadth of NIS2, thinking it’s just an IT issue. The directive involves the entire corporate governance. Another mistake is focusing only on technical measures, ignoring organizational and procedural aspects, such as supply chain management or staff training. I’ve seen companies that, despite having state-of-the-art firewalls and EDRs, lacked a tested incident response plan or a clear notification procedure, making them vulnerable to NIS2 penalties. It is crucial to involve all departments and consider cybersecurity a strategic investment, not a cost.

FAQ — Frequently Asked Questions

Is my SME too small for NIS2?

Not necessarily. While NIS2 generally excludes micro and small enterprises, there are exceptions. If your SME operates in a critical sector (e.g., healthcare, energy) or is a sole provider of essential services, you might fall within scope. It is crucial to conduct an accurate assessment based on your national transposition law and competent authority guidelines.

What is the difference between an Essential Entity and an Important Entity?

The distinction concerns the level of criticality of the service provided and the company’s size. Essential Entities (EEs) operate in highly critical sectors (e.g., energy, transport, healthcare) and are generally large. Important Entities (IEs) operate in relevant sectors (e.g., manufacturing, digital services) and are often medium-sized. Penalties for EEs are higher, and the supervisory regime is more stringent.

What happens if I don’t comply with NIS2?

Penalties are significant. For Essential Entities, fines can reach up to 10 million euros or a significant percentage of annual global turnover (whichever is greater). For Important Entities, up to 7 million euros or a significant percentage of annual global turnover. Furthermore, management bodies can be held personally accountable. Beyond monetary penalties, there are reputational risks and service disruption.

Does NIS2 replace GDPR?

No, NIS2 does not replace GDPR (General Data Protection Regulation) but complements it. GDPR focuses on the protection of personal data, while NIS2 focuses on the security of network and information systems that support essential and important services. Both regulations are complementary and aim to ensure a high level of security and protection in the digital world.

Conclusions with Operational Takeaways

NIS2, as transposed into national law, is a complex but unavoidable regulation for many EU businesses. It is no longer sufficient to have a good firewall; a systemic approach to cybersecurity involving governance, processes, and people is necessary. The operational takeaways are clear: identify your status (Essential or Important Entity), perform a gap analysis, implement robust security measures (technical and organizational), prepare and test incident response plans, and actively involve management bodies. Time is pressing, with important deadlines already passed or approaching. Proactive compliance is not just a matter of conformity but an investment in your company’s resilience and operational continuity.

Sources

• Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union – EUR-Lex
• National Cybersecurity Agency (ACN) – NIS2 Guidelines (Italian example)

Updated: October 2026