NIS2 Italy: Legislative Process, Authorities & Key Requirements
Understand how Italy is preparing to implement the NIS2 Directive (EU) 2022/2555 through new legislative decrees, which entities will be classified as essential or important, how supervision is organized, and how to prepare before the new rules apply.
Introduction: NIS2 Directive & the Italian context
Italy has implemented the NIS2 Directive through Legislative Decree No. 138/2024, adopted under the mandate provided by the Legge di delegazione europea 2022-2023. The new framework significantly expands Italy’s national cybersecurity perimeter and aligns domestic obligations with EU-wide standards for essential and important entities. Agenzia per la Cybersicurezza Nazionale (ACN) plays a central role in overseeing the NIS2 framework, working together with the Presidency of the Council of Ministers and the relevant sectoral ministries.
ACN (Agenzia per la Cybersicurezza Nazionale) is leading the drafting of Italy’s NIS2 framework together with the Presidency of the Council of Ministers and relevant sectoral ministries.
NIS2 Directive implementation in Italy
Italy has implemented the NIS2 Directive through Legislative Decree No. 138 of 4 September 2024,adopted pursuant to Law No. 15 of 21 February 2024 (Legge di delegazione europea 2022-2023). The new decree replaces the previous national NIS framework and significantly expands Italy’s cybersecurity perimeter.
It repeals and updates, in particular:
- Decreto Legislativo 65/2018 (NIS 1 implementation)
- Relevant sectoral cybersecurity obligations coordinated with the Perimetro Nazionale di Sicurezza Cibernetica
Status
Although the EU transposition deadline was 17 October 2024, the national decree has since entered into force and replaced the previous NIS framework.
Legislative basis
NIS2 was adopted under Law No. 15/2024 (European Delegation Law 2022-2023) and implemented through Legislative Decree No. 138/2024.
Scope
Italy applies the NIS2 categories of essential and important entities, with integration and coordination mechanisms vis-à-vis the National Cybersecurity Perimeter for strategically critical operators.
| Area | Italian note |
|---|---|
| Current rules | The previous NIS framework, implemented through Decreto Legislativo 65/2018, has been replaced by Legislative Decree No. 138/2024 implementing NIS2. |
| Public sector | Italy will include a wide range of public administrations under NIS2, while coordinating with AGID and ACN’s guidelines. |
| National Cybersecurity Perimeter | Operators already within the Perimetro Nazionale will likely face strengthened obligations, with oversight by ACN and sectoral authorities. |
NIS2 Italy: what you need to know about compliance & certification
Italy follows NIS2’s structure of Essential Entities (EE) and Important Entities (IE), with additional obligations for operators within the National Cybersecurity Perimeter.
Scope criteria
- Operate in one of the sectors in Annex I or II of NIS2 (energy, transport, health, finance, digital infrastructure, etc.).
- Meet size thresholds (≥50 employees or ≥€10M turnover/balance sheet).
- Established in Italy or providing NIS2-relevant services on Italian territory.
- Possible inclusion regardless of size for high-criticality operators.
Obligations
- Risk management and cybersecurity policy (IT/OT).
- Incident reporting in strict timeframes.
- Business continuity and crisis management.
- Supply chain security and contractual controls.
- Access control, encryption, vulnerability handling.
- Board accountability and cybersecurity governance.
Standards & certification
Italy does not mandate compliance with a specific certification standard under NIS2, but recognised frameworks such as ISO/IEC 27001, NIST CSF and IEC 62443 (for industrial environments) are commonly used to structure and demonstrate compliance. Operators in the National Cybersecurity Perimeter are subject to enhanced technical and organisational requirements, including detailed assessments coordinated by ACN.
National NIS2 timeline & key dates (Italy)
Sector-specific requirements (Italy)
- Energy: alignment with ARERA and MITE requirements for critical operators.
- Transport: aviation, rail, maritime and road operators under sectoral regulators.
- Digital infrastructure: data centers, CDN, cloud, IXPs, and managed service providers under NIS2 scope.
- Finance: coordinated with Bank of Italy and CONSOB; integration with DORA.
- Health: hospitals, labs and health service operators monitored by the Ministry of Health.
Penalties for non-compliance
Italy applies the NIS2 maximum administrative fine thresholds:
- Up to €10 million or 2% of global annual turnover for essential entities.
- Up to €7 million or 1.4% of global turnover for important entities.
Competent authorities may also impose corrective measures, binding instructions, temporary suspension of activities, and mandatory remediation. Entities falling within the Perimetro Nazionale di Sicurezza Cibernetica may be subject to enhanced supervisory scrutiny in line with their criticality.
How to prepare for NIS2 in Italy
- Assess scope: identify Annex I/II services, size thresholds, and critical functions.
- Identify your supervisory authority: determine whether ACN or a sectoral regulator oversees you.
- Perform a gap assessment: compare current practices to NIS2 requirements.
- Strengthen governance: ensure management and board accountability for cybersecurity.
- Improve risk management: update policies, controls, and processes in line with NIS2 expectations.
- Review supply chain: ensure contracts include cybersecurity clauses and risk controls.
- Prepare for reporting: build incident detection, escalation and 24/7 reporting workflows.
- Document and evidence: maintain records of controls, assessments, and remediation actions.