What it is, in brief
NIS2 is the European directive on the security of network and information systems (Directive (EU) 2022/2555), transposed into Italian law by Legislative Decree 138/2024. It replaces the first NIS Directive of 2016 and greatly increases the number of companies affected: no longer just large energy, transport or telecommunications operators, but also a significant share of Italian medium-sized businesses.
The underlying idea is simple: a company's cyber security is not only its own concern. If a critical supplier is hit by an attack, the damage spreads to all its customers. NIS2 aims to raise the minimum level of security along the whole chain, not just at the most exposed links.
Who falls within scope
The directive distinguishes two categories of entities, with similar obligations but different penalties: essential (energy, transport, banking, financial market infrastructures, health, drinking water and waste water, digital infrastructure, ICT service management, public administration, space) and important (postal services, waste management, chemicals, food, manufacturing of certain products, digital providers, research).
Within these sectors, as a rule, medium-sized and large companies are covered, meaning those above the size thresholds (generally at least 50 employees, or annual turnover or an annual balance sheet total above €10 million). Some entities are covered regardless of size, for example trust service providers and DNS service providers.
Even an SME outside these sectors can be affected indirectly: if you supply an entity that falls within the scope of NIS2, you are likely to be asked, sooner or later, for contractual security guarantees. The directive explicitly addresses supply chain security. Falling outside the scope does not always mean being unaffected.
To know for certain whether your company is covered, and in which category, you need a proper check of your business sector, your size and your role in your customers' supply chain. This is not a question to answer with a rough guess.
What changes in practice
For those within scope, NIS2 does not require a one-off formality but a set of risk management measures, proportionate to the size and exposure of the company. The typical areas are:
- Risk analysis and security policies for information systems;
- Incident handling, with a defined procedure rather than improvisation;
- Business continuity: backup, disaster recovery, crisis management (see the guide on RTO and RPO);
- Supply chain security, including relationships with individual suppliers;
- Security in the acquisition, development and maintenance of systems, including vulnerability handling procedures;
- Assessment of the effectiveness of the measures adopted, not just their existence on paper;
- Training and basic cyber hygiene for everyone who works in the company;
- Cryptography, where appropriate;
- Access management and multi-factor authentication, particularly for privileged access.
On top of these comes a specific obligation: notifying significant incidents. Entities within scope send CSIRT Italia (Italy's national computer security incident response team) an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours and a final report within one month: the same sequence described in the guide on the first hours of a ransomware attack.
Finally, one point changes the tone of the conversation within the company: the management bodies must approve the security measures, oversee their implementation and undergo specific training. In the event of serious and repeated infringements, responsibility does not stay confined to IT.
Penalties, and why they are not the main point
The directive sets high maximum fines: up to €10 million or 2% of total worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever amount is higher. These figures are aimed mainly at large groups, but they signal that cyber security is now a compliance matter, not just an internal technical issue.
For an SME, the most concrete risk is rarely the penalty itself: it is being dropped from the supply chain of customers who, to meet their own obligations, start requiring verifiable security standards from the companies they work with.
Where to start
- Check whether you fall within scope, directly or as a supplier to an entity that does, and in which category.
- Analyse your current position against the required areas: what already exists, what is missing, what exists only on paper.
- Assign clear responsibilities, including those of top management, and define how security decisions are made.
- Put an incident handling procedure in writing, with the correct notification deadlines and who is responsible for them.
- Plan training: both technical training for those who manage the systems and basic training for everyone in the company.
Quick checklist
- I know for certain whether my company falls within the scope of NIS2, and in which category;
- I know whether I supply companies that fall within scope;
- there is a written incident handling procedure, with the correct notification deadlines;
- someone in senior management has approved the security measures with a real understanding of them, not just as a formality;
- backups and continuity plans are documented and tested, not just in place;
- everyone who works in the company has received basic cyber security training.
In short
NIS2 extends cyber security obligations to many more companies than before, requires concrete measures rather than just documents, and makes those who run the company accountable. Even companies that are not directly within scope can be affected as suppliers.