10 million euros.
That's the maximum fine your company faces if you don't comply with the NIS2 directive. And no, this doesn't only concern large corporations. If you're part of an "essential" or "important" company's supply chain, it concerns you too.
Welcome to the new era of mandatory cybersecurity.
What Changed and Why You Should Care
On September 4, 2024, Italy transposed the European NIS2 directive through Legislative Decree 138. It wasn't a bureaucratic formality. It was a paradigm shift.
The old NIS1 involved fewer than 1,000 entities in Italy. NIS2? Over 12,000 organizations. And we're not just talking about banks and hospitals. We're talking about:
- Digital service providers
- Strategic manufacturing companies
- Logistics operators
- IT service providers
- And their entire supply chain
If you work with any of these sectors, even as a small company, NIS2 affects you.
The Calendar You Can't Ignore
Here are the dates you must mark in red on your calendar:
January - February 2025
Registration on the ACN portal. If your organization falls among "essential" or "important" subjects, you must register online with the National Cybersecurity Agency (ACN).
March 31, 2025
ACN publishes the official list of entities to which NIS2 applies. If you still don't know if you're involved, after this date you'll have no more excuses.
April 15, 2025
Cyber responsible nomination. You must formally designate a person responsible for cybersecurity and communicate it to ACN. This can't be a token appointment: this person will be your point of contact with authorities.
April 15 - May 31, 2025
Mandatory information transmission. You must provide ACN with:
- Personal and contact details of legal representatives
- Technical details about your IT infrastructure
- List of member states where you operate
May 31, 2025
Risk assessment deadline. You must complete an internal cybersecurity audit according to ACN guidelines. This isn't a theoretical exercise: you'll need to document vulnerabilities and countermeasures adopted.
July 31, 2025
Extension for those with difficulties. If you've encountered technical or organizational problems and formally requested ACN support, you have 60 extra days to update portal information.
July 2025 onwards
National CSIRT Registry registration. Becomes mandatory for all "essential" and "important" companies. CSIRT is the national incident response team: being registered means being part of the collective defense network.
November 20 - December 31, 2025
CSIRT contact nomination. You must designate a dedicated contact person for communications with the national CSIRT.
What Non-Compliance Risks
Penalties are calibrated to the severity of non-compliance:
| Category | Maximum Fine |
|---|---|
| Essential entities | Up to €10 million or 2% of global turnover |
| Important entities | Up to €7 million or 1.4% of global turnover |
But fines are just the tip of the iceberg. The real NIS2 novelty is personal management liability. CEOs and top executives can be held directly responsible for non-compliance.
Translation: you can no longer delegate cybersecurity to IT and forget about it.
The 5 Pillars of NIS2 Compliance
Compliance doesn't mean installing a more powerful antivirus. It requires a systematic approach touching five fundamental areas:
1. Security Governance
You must demonstrate that cybersecurity is a board-level priority. Documented policies, defined roles, allocated budgets are needed. Top management must be involved and regularly informed.
2. Risk Management
You must identify, assess, and mitigate cyber risks continuously. A one-time assessment isn't enough: you need a cyclical process that adapts to new threats.
3. Technical Protection
Security measures must be proportionate to identified risks. This includes:
- Access control
- Sensitive data encryption
- Network segmentation
- Backup and disaster recovery
- Continuous monitoring
4. Incident Management
You must have clear procedures to detect, manage, and notify security incidents. NIS2 introduces stringent notification requirements: you have 24 hours for a preliminary alert and 72 hours for a complete notification.
5. Supply Chain Security
You must extend security requirements to your critical suppliers. This is the point that also hits SMEs: if you're a NIS2 entity's supplier, you must demonstrate your reliability.
A Practical Roadmap for SMEs
If you're a small or medium enterprise feeling overwhelmed, here's a concrete action plan:
Month 1-2: Assessment
- Check if you fall among obligated entities (directly or as suppliers)
- Map your current IT infrastructure
- Identify critical data you manage
Month 3-4: Gap Analysis
- Compare your situation with NIS2 requirements
- Identify priority gaps
- Estimate compliance costs
Month 5-6: Remediation Plan
- Define corrective actions with realistic timelines
- Allocate budget and resources
- Start with the most urgent measures
Month 7-12: Implementation
- Execute the remediation plan
- Document every action
- Train personnel
- Test procedures
Available Support
You're not alone in this journey. Resources and support are available:
ACN (National Cybersecurity Agency): offers guidelines, FAQs, and technical support through its dedicated portal.
Trade associations: Confindustria, CNA, and other organizations are organizing webinars and training programs.
Tax incentives: the tax credit for cybersecurity investments can cover part of compliance costs.
Specialized consultants: if you lack internal expertise, relying on professionals can accelerate the process and reduce risks.
Cybersecurity as Competitive Advantage
I'll conclude with a reflection that's often overlooked.
Yes, NIS2 is an obligation. Yes, it requires investments. Yes, it's complex. But if you change perspective, it becomes an opportunity.
Companies demonstrating solid cybersecurity practices:
- Win tenders requiring certifications
- Earn trust from increasingly aware customers
- Reduce incident costs (averaging over 4 million euros)
- Get better conditions from cyber insurers
NIS2 forces you to do what you should have done anyway. The difference is now you have a deadline.
What to Do Monday Morning
If you're reading this article in 2025, time is running out. Here are three immediate actions:
-
Verify your status. Are you an essential, important entity, or supplier to one? If you don't know, find out now.
-
Nominate a responsible person. Even if informal, identify who in your organization will follow this topic.
-
Book an assessment. Whether internal or with a consultant, you need to know where you stand.
Cybersecurity is no longer a cost. It's a license to operate. And NIS2 is the reminder you can no longer postpone.
Need support for NIS2 compliance? Contact us for a free preliminary assessment. ```