Table of contents
- The NIS 2 directive moves forward: Italy enters the operational phase
- Board-level responsibilities under the spotlight
- Cyber security measures: 116 requirements to meet
- Incident notification obligations from 2026
- DNS resilience: specific protocols for domain services
- Over 5,000 essential entities identified
- What NIS entities must do by May 31
- Toward a unified national cyber security governance
The NIS 2 directive moves forward: Italy enters the operational phase
The Working Group for the implementation of the NIS discipline met on April 10 to officially mark the launch of phase two of the NIS 2 directive.
This crucial step affects over 20,000 Italian organizations, which must now comply with technical, procedural and governance measures under strict deadlines.
Chaired by the Director General of the National Cyber Security Agency (ACN), the Group outlined the core requirements that will guide the application of the law, establishing a national framework for strengthening the cyber resilience of critical sectors.
Board-level responsibilities under the spotlight
A key point of the meeting concerned the responsibilities of administrative and management bodies (as per Article 23).
From now on, board members and executives will be held directly accountable for the implementation of cyber security strategies, with a growing emphasis on reporting, oversight and active leadership in risk governance.
Cyber security measures: 116 requirements to meet
The directive’s operational backbone is Article 24, which mandates the adoption of cyber security measures by October 2026. The breakdown is as follows:
- Important entities
37 measures across 87 specific requirements - Essential entities
43 total measures including 116 requirements
All measures are structured around the National Framework for Cyber security and Data Protection, covering areas such as risk management, incident response, staff training, IT asset protection, and business continuity.
Incident notification obligations from 2026
Starting January 2026, all NIS entities will be required to report significant cyber security incidents under the new rules of Article 25.
These obligations differ by classification:
- Important entities
Must monitor 3 categories of incidents - Essential entities
Required to monitor 4 categories
The aim is to ensure early detection of threats, especially for high-impact sectors such as healthcare, energy, telecommunications and transport.
DNS resilience: specific protocols for domain services
Article 29 focuses on the security and resilience of domain name systems (DNS). Specific protocols are outlined to address the technical and organizational characteristics of different types of entities, ensuring stability and security in the DNS infrastructure.
Over 5,000 essential entities identified
One of the main results of the April 10 meeting was the update of the official NIS entities list, compiled using data from over 30,000 organizations. The final count: more than 20,000 entities, with over 5,000 designated as essential.
Since April 12, the ACN has been notifying organizations of their inclusion or exclusion from the NIS list through the dedicated NIS platform, marking a new chapter in institutional transparency and preparedness.
What NIS entities must do by May 31
Between April 15 and May 31, all NIS entities are required to:
- Appoint a substitute contact point
- Provide updated data, including:
- names of board and executive members
- public and static IP addresses
- all domain names in use
- Report any voluntary cyber security information-sharing agreements signed since the NIS decree came into effect
These obligations are governed by Determination ACN no. 136117/2025 and Determination ACN no. 136118/2025.
Toward a unified national cyber security governance
The NIS Implementation Working Group includes representatives from nine sectoral authorities and the Permanent State-Regions Conference, signaling a strong inter-institutional commitment to creating a robust and coordinated cyber security ecosystem.
