In brief. NIS2 is no longer a future compliance concern for Italian companies. For organisations already included in the national NIS list, the first deadlines for adopting the basic cybersecurity measures set by ACN, the Italian national cybersecurity agency, have arrived or have passed: companies notified in April 2025 had 18 months, which ran out in October 2026. One requirement deserves particular attention. Companies must know whether the software they rely on still receives security updates, install those updates, and document every case where that is not possible. For businesses running legacy systems this raises a practical question: can the software stay, does it need to be upgraded, or is replacement the only realistic option? This guide explains who is covered, what the measures actually say about old software, what the fines are, and what a realistic plan looks like.
Does NIS2 apply to your company?
In Italy, NIS2 was transposed by Legislative Decree 138/2024, in force since 16 October 2024. Article 3 sets two filters: your sector and your size.
The size filter follows the EU definition of an SME. The decree applies to companies in the listed sectors that exceed the ceilings for a small enterprise under Article 2 of the Annex to EU Recommendation 2003/361/EC. A small enterprise employs fewer than 50 people and has an annual turnover and/or an annual balance sheet total of no more than 10 million euro. In practice, a company in a listed sector is in scope if it has 50 or more employees, or if both its turnover and its balance sheet total exceed 10 million euro. A company with 40 employees, 12 million euro of turnover and an 8 million euro balance sheet still counts as small and, as a rule, is out of scope. Two further rules matter. For groups, Article 3, paragraph 4 of the decree applies the Recommendation’s rule that the figures of partner and linked enterprises are added together, unless that would be disproportionate given how independent the company’s network and information systems are. And a few categories, for example telecom providers, trust service providers and DNS operators, are covered regardless of size. If your company is close to the thresholds or part of a group, the size test is a question for your accountant and legal counsel, not for the IT manager.
The sector filter is wider than most people expect. Annex I of the decree lists ten highly critical sectors: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B) and space. Public administrations are covered separately in Annex III, regardless of size. Annex II lists the other critical sectors: postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles and other transport equipment), digital providers and research. If you run a machinery plant near Bergamo with 60 employees, you are in Annex II.
There is also a third route that can reach smaller companies: the supply chain. A NIS entity must take into account the vulnerabilities and the overall cybersecurity practices of its direct suppliers and service providers (Article 24, paragraph 3) and, under ACN’s basic measures, include security requirements in contracts for supplies that can affect the security of its systems. Those requirements must be proportionate. ACN’s FAQ of July 2026 state that a NIS entity does not have to define security requirements for every supply, and does not have to pass all of its own basic measures on to each supplier; what is asked depends on the risk and the criticality of the service. Since April 2026, under ACN Determination 127437/2026, NIS entities also list their relevant suppliers on the ACN platform. That list is the basis on which ACN may designate individual suppliers as important or essential entities under Article 3, paragraph 9 of the decree. Designation is a case-by-case decision by ACN; a supplier is not in scope simply because it appears on a customer’s list. So a 30-person software house or systems integrator serving a hospital or a utility is not a NIS entity by default, but it should expect security requirements in its contracts and questions about its own update and patching practices.
How many companies are we talking about? ACN reported in April 2025 that the first NIS list included over 20,000 organisations, of which over 5,000 are essential entities, built from information shared by over 30,000 organisations. ACN’s 2025 annual report to Parliament, published in May 2026, gives the total at the end of 2025 as over 21,800 NIS subjects. The two figures describe the same list at two points in time, before and after ACN processed late registrations and reviews.
The deadlines that matter
NIS2 in Italy works in cohorts. Your deadlines depend on the year you were added to the list, because they are counted from the date ACN notified you.
| Obligation | Companies listed in 2025 | Companies listed in 2026 |
|---|---|---|
| Notification of significant incidents to CSIRT Italia | From January 2026 (9 months after the notice) | From 1 January 2027 |
| Designation of the CSIRT contact person | By 31 December 2025 | By 31 December 2026 |
| Adoption of the basic security measures | October 2026 (18 months after the notice) | By 31 July 2027 |
| Annual update of information on the ACN platform | 15 April to 31 May, every year | 15 April to 31 May, every year |
| Registration window for new entities | 1 January to 28 February, every year | 1 January to 28 February, every year |
Sources: ACN, Modalità e specifiche di base (18 months for measures, 9 months for notifications); ACN, 13 April 2026 note on Determination 127434/2026 (2026 cohort), whose Article 1 sets 31 July 2027 and 1 January 2027 (text in the Sources table); ACN, 18 September 2026 note (2027 registration window); CMS Legal note of 24 December 2025 on Determinations 379907/2025 and 379887/2025, linked in the Sources table (CSIRT contact person for the 2025 cohort).
Two details are easy to miss. First, the “October 2026” date is not a single calendar day for everyone. ACN began sending inclusion notices on 12 April 2025, so the 18 months expire in October 2026 for most of the first cohort, but your exact date is 18 months after your own notice. Second, in September 2026 ACN updated the list after reviewing over 2,000 late registrations and about 2,000 review requests, and opened a consultation on reinforced security measures that will integrate and replace the basic ones. The basic measures are the floor, not the ceiling.
What the law actually requires
Article 24 of the decree lists ten areas every essential and important entity must cover: risk analysis and system security policies; incident handling; business continuity, including backup management and disaster recovery; supply chain security; security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure; procedures to assess whether the measures work; basic cyber hygiene and training; cryptography; human resources security, access control and asset management; and multi-factor or continuous authentication.
That list is principle-based. ACN turned it into a checklist with Determination 379907/2025, which updated the April 2025 version (Determination 164179/2025). Annex 1 applies to important entities, Annex 2 to essential entities. When ACN presented the first version in April 2025, it described 37 measures and 87 requirements for important entities, and 43 measures and 116 requirements for essential ones. The measures follow the structure of the Italian National Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, Recover. Each measure has a code, a description and one or more requirements that say what has to exist in practice.
The next section is about the handful of those requirements that decide whether a legacy system can stay.
Where legacy software breaks compliance
“Legacy” is a loose word. For NIS2 purposes it is useful to be precise: the problem is software (an operating system, a database, a framework, an ERP, a custom application) that no longer receives security updates from its producer, or that cannot be updated because something else in the stack would break. Here are the requirements in Annex 1 of Determination 379907/2025 that such systems collide with. The quotes are our translation of the Italian text; the codes are ACN’s.
| Requirement (Annex 1, important entities) | What it says | Why legacy systems fail it |
|---|---|---|
| PR.PS-02, point 1 | Only software, including operating systems, for which security updates are guaranteed to be available may be installed, unless there are documented regulatory or technical reasons | Software that no longer receives security updates can stay only as a documented exception, justified by the risk assessment. Without that documentation, running it is a compliance gap |
| PR.PS-02, point 2 | The latest security updates released by the producer are installed without undue delay, in line with the vulnerability management plan | A system that cannot be patched because of dependencies cannot meet this |
| ID.AM-02 | An up-to-date inventory is kept of services, systems and software applications, including commercial, open-source and custom applications, also those accessible via API | Most SMEs have no complete list of what runs where. The custom application a former employee wrote in 2014 counts |
| ID.RA-01 and ID.RA-08 | Vulnerabilities in assets are identified, confirmed and recorded; a documented vulnerability management plan exists and is approved by management | You cannot track vulnerabilities in a component nobody publishes advisories for any more |
| PR.PS-04 | Remote and administrative access is logged; logs for relevant systems are collected and kept securely, preferably centrally | Old applications often have no usable audit logging |
| PR.PS-06 | Secure development practices are adopted and documented for software development | Applies to custom software you build or commission, including modernisation work |
| PR.DS-11 | Backups of data and configurations are made periodically, with offline copies for relevant systems | Legacy systems on old hardware frequently sit outside the backup policy |
| GV.SC-04 and GV.SC-05 | A supplier inventory is kept; security requirements are included in tenders, contracts and agreements for supplies that can affect security | The vendor of a discontinued product cannot sign those requirements |
Source: ACN, Annex 1 to Determination 379907/2025, consulted 30 October 2026. Essential entities follow Annex 2. We checked Annex 2 against Annex 1: all eight requirements above appear in Annex 2 with the same codes and the same wording, and essential entities have additional ones, for example PR.PS-02, point 4 (updates to software deemed critical are tested in a test environment before going into production), PR.PS-01 (hardened reference configurations) and PR.PS-03 (secure disposal of hardware). The table is the common floor for both categories, not the full list for essential entities.
Read together, these requirements describe a simple test. For every system you run, can you answer three questions in writing: do we know it exists, does it still receive security updates, and are we installing them? The answers put each system in one of three situations, and they are not the same problem. In the first, the software is supported and updates are available, but the company does not install them: that is a process failure under PR.PS-02, point 2, usually fixed with a patch calendar and clear ownership. In the second, the producer no longer publishes security updates: PR.PS-02, point 1 then leaves two routes, a documented regulatory or technical reason recorded in the risk treatment plan, or replacement. In the third, the software cannot be upgraded or replaced in the short term for documented technical or regulatory reasons, for example because it drives certified equipment: that is the case the exception is designed for, provided the risk is assessed, compensating controls such as network isolation are in place, and management has signed off. NIS2 does not declare unsupported software illegal. It requires a decision, a risk assessment and a paper trail for each case, and in none of the three situations does a system quietly stay because it still works.
The “documented reason” route is narrower than it sounds. It has to be consistent with your risk assessment (ID.RA-05), which management must approve and repeat at least every two years. An industrial machine whose controller runs on a vendor-locked operating system can plausibly be documented and isolated. A company’s main order-management application running on an unsupported database because nobody budgeted the migration is harder to defend in an inspection.
A concrete case: the ERP on an old database
Take a manufacturing company with 120 employees, in Annex II. Its ERP runs on a database version the database vendor stopped supporting two years ago. The ERP itself is maintained, but its producer has not certified it on a newer database, and the last upgrade attempt broke the production planning module. Under PR.PS-02 the company has four options, and they can be combined over time. It can upgrade, if the ERP vendor confirms a supported database version and the migration is tested before going live. It can isolate: segment the database server from the rest of the network, restrict and log administrative access (PR.PS-04), keep offline backups (PR.DS-11) and treat it as a known, monitored risk. It can document an exception: write down the technical reason, the compensating controls and a review date in the risk treatment plan that management approves (ID.RA-05). Or it can plan a replacement with a date and a budget, which is usually where the first three options lead when the vendor has no roadmap. What it cannot do is leave the question unanswered until an inspector, or a ransomware group, asks it.
Why this is not just paperwork
The measures target the way attacks actually happen in Italy. In its 2025 annual report, ACN says CSIRT Italia handled 2,729 cyber events and 615 incidents with confirmed impact. The distinction matters: ACN counts every malicious activity CSIRT Italia handled as an event, and reserves “incident” for cases where an impact on the victim was confirmed. The main entry points were email (40%), valid but compromised accounts (24%) and exploitation of vulnerabilities (11%). On ransomware, the report says most victims are small businesses, concentrated in manufacturing, often with limited levels of cybersecurity, and that attacks exploited unpatched vulnerabilities and poorly managed or obsolete software. The previous report, on 2024, gave the size split for ransomware victims handled by ACN: 48% small enterprises, 27% medium, 25% large, with manufacturing the most hit sector.
The trend is accelerating where Italian SMEs are concentrated. On 28 October 2026 ACN reported that in the first half of 2026, in the provinces of Milan, Monza and Brianza, Lodi and Pavia, it recorded 612 cyber events and 300 incidents with confirmed impact, up from 282 events and 55 confirmed incidents in the same period of 2025. ACN attributes part of the increase to NIS2 itself: more companies are now obliged to notify, so more incidents become visible. Clusit’s October 2026 update makes the sector point: manufacturing was the most targeted sector in Italy in the first half of 2026, with 18.4% of known incidents, against 5.4% globally.
Internationally, the picture is the same. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities was the initial access vector in 31% of breaches, overtaking credential abuse (13%). For small and medium businesses in the same dataset, vulnerabilities accounted for 26% of initial access, and the report notes that small organisations are disproportionately affected by ransomware. Only 26% of the vulnerabilities Verizon classes as critical, meaning those listed in CISA’s Known Exploited Vulnerabilities catalogue, were fully remediated by organisations during 2025, down from 38% the year before, and the median time to full resolution rose to 43 days. Unsupported software never gets to day one of that clock.
Fines and personal liability
Article 38, paragraph 9 of Legislative Decree 138/2024 sets the ceilings. For essential entities, breaches of the risk management and notification obligations (Articles 23, 24 and 25) can cost up to 10 million euro or 2% of worldwide annual turnover, whichever is higher, with a statutory minimum of one twentieth of the maximum. For important entities, up to 7 million euro or 1.4% of turnover, with a minimum of one thirtieth of the maximum.
The decree also makes management personally accountable. Article 23 says the administrative and management bodies approve how the risk management measures are implemented, oversee compliance, are responsible for violations, and must themselves attend cybersecurity training. Article 38, paragraph 5 adds that the natural persons responsible for an essential entity, or acting as its legal representatives, must ensure compliance and can be held liable for breaches. Article 38, paragraph 6 goes further for both essential and important entities: if the company does not comply within the terms of a formal warning (diffida) issued by ACN under Article 37, ACN can impose on the responsible executives, including members of the management bodies, CEOs and legal representatives, the accessory sanction of being barred from management functions within that company, until the gaps are fixed. The ban is therefore not automatic; it follows an ignored warning.
ACN’s own roadmap, published in its 2024 annual report, has three phases: October 2024 to April 2025, first rules and registration; April 2025 to April 2026, completion of the rules and first obligations; from April 2026, completion of the basic obligations and further requirements. For companies in the first cohort the 18 months have now run out. The practical consequence is that they should be able to show, with documents, that the basic measures are in place: the software inventory, the risk assessment approved by management, the vulnerability management plan and the exceptions they have recorded. Articles 36 and 37 of the decree give ACN the powers to verify this and to issue formal warnings; whether and when ACN uses them in a given sector is ACN’s decision, not something the law schedules.
What to do: a plan that fits an SME
The companies we see handle this well do not start from the legal text. They start from an inventory and work towards the decisions the law forces.
- Build the software inventory first (ID.AM-02). List every system, application and service, including the custom ones, the spreadsheets that act as databases, and anything reachable through an API. For each, record the producer, the version, and whether security updates are still published. This is one to three weeks of work for a typical mid-sized company, and it is the document an inspector will ask for first.
- Mark what is end-of-life. Split the list into three groups: supported and patched; supported but not patched; unsupported. The third group is your PR.PS-02 problem. The second is a process problem, usually fixable with a patch calendar and ownership.
- Decide per system: update, isolate or replace. Some systems can simply be upgraded. Some must stay because they drive physical equipment, and can be documented as an exception, segmented from the rest of the network, and monitored. The rest need a replacement plan with a date. Our guide on replacing software that still works covers how to sequence that without stopping operations, and our piece on technical debt explains how to measure what you are carrying.
- Put it in the risk assessment and get it signed (ID.RA-05). Every exception and every replacement date goes into the risk treatment plan that management approves. This is what turns a technical choice into a defensible compliance position.
- Fix the contracts (GV.SC-05). For new software, require secure development practices, a vulnerability disclosure channel and a support horizon in the contract. For existing suppliers, ask the same questions you asked yourself: will this product still receive security updates in three years?
- Budget replacement as a programme, not an emergency. Modernisation projects have known cost ranges; our cost guide gives figures with sources. A company that cannot staff this internally can use a fractional CTO to own the plan and the ACN relationship.
Sources
All sources were opened and read on 30 October 2026.
- Legislative Decree 138/2024, Normattiva (consolidated text): Art. 3 scope and size rule; Art. 23 management duties; Art. 24 ten measure areas and supplier assessment; Art. 25 notification timelines; Art. 38 fines and executive ban; entry into force 16 Oct 2024. normattiva.it
- EU Recommendation 2003/361/EC, Annex Art. 2: Small enterprise = fewer than 50 employees and turnover or balance sheet up to 10 million euro. eur-lex.europa.eu
- ACN, Modalità e specifiche di base: Determination 379907/2025; 18 months for basic measures (October 2026); 9 months for incident notification (January 2026); Annex 1 important, Annex 2 essential. acn.gov.it
- ACN, Annex 1 to Determination 379907/2025: Text of PR.PS-02, ID.AM-02, ID.RA-01, ID.RA-05, ID.RA-08, PR.PS-04, PR.PS-06, PR.DS-11, GV.SC-04, GV.SC-05, GV.SC-07. acn.gov.it (PDF)
- ACN, NIS, avviata la seconda fase, 15 Apr 2025: Over 20,000 organisations, over 5,000 essential, over 30,000 self-declarations; 37 measures / 87 requirements and 43 / 116; notices from 12 Apr 2025; Determination 164179/2025. acn.gov.it
- ACN, note of 13 Apr 2026: Determination 127434/2026: 2026 cohort notifies from 1 Jan 2027, measures by July 2027; Determination 127437/2026: list of relevant suppliers. acn.gov.it
- ACN, Le novità per i soggetti NIS, 18 Sep 2026: List update: over 2,000 late registrations and about 2,000 reviews; consultation on reinforced measures; registration window 1 Jan to 28 Feb 2027. acn.gov.it
- ACN, FAQ on supply chain measures, 24 Jul 2026: Supply chain process in four phases; requirements modulated, not all passed to suppliers (FAQ MSB.13 to MSB.19). acn.gov.it
- ACN and Assolombarda, 28 Oct 2026: Milan, Monza-Brianza, Lodi, Pavia: 612 events and 300 confirmed incidents in H1 2026 vs 282 and 55 in H1 2025. acn.gov.it
- ACN, Relazione annuale al Parlamento 2025 (May 2026): 2,729 events, 615 confirmed incidents; vectors email 40%, valid accounts 24%, vulnerabilities 11%; ransomware victims mostly small manufacturers with limited security; over 21,800 NIS subjects. ACN page and PDF copy
- ACN, Relazione annuale al Parlamento 2024: Ransomware victims by size: small 48%, medium 27%, large 25%; manufacturing top sector; vulnerability exploitation 14% “from failure to update systems”; three-phase NIS roadmap. acn.gov.it (PDF)
- Verizon, 2026 DBIR Executive Summary: Vulnerability exploitation 31% of breaches, credential abuse 13%; SMB vulnerabilities 26%; 26% of CISA KEV critical vulnerabilities remediated; median 43 days. verizon.com (PDF)
- Clusit, October 2026 update (via ZeroUno): Manufacturing 18.4% of Italian incidents in H1 2026 vs 5.4% globally; 245 incidents in Italy. zerounoweb.it
- Directive (EU) 2022/2555, Art. 21 (mirror of the Official Journal text): Cross-check of the ten measure areas and Art. 21(3) on suppliers. springlex.eu
- CMS Legal, note of 24 Dec 2025 (secondary source): Determination 379907/2025 applies from 15 Jan 2026 and updates the April 2025 basic measures; Determination 379887/2025 on the ACN portal applies from 31 Dec 2025; CSIRT contact person included in GV.RR-02. cms.law
- ACN Determination 127434 of 13 April 2026 (copy hosted by Diritto Bancario): Art. 1: for entities added to the NIS list in 2026, basic measures by 31 July 2027 and incident notification from 1 January 2027. dirittobancario.it (PDF)
- ACN, Annex 2 to Determination 379907/2025 (essential entities): Same eight requirements as Annex 1 with identical wording, plus extra ones such as PR.PS-02 point 4, PR.PS-01, PR.PS-03. acn.gov.it (PDF)
FAQ
Frequently asked questions
Short answers on who NIS2 covers in Italy, the deadlines, the fines and what it means for software that no longer gets security updates.
