NIS2 and cybersecurity for businesses
NIS2: does it apply to you?
It is the European directive on network security: it applies across the whole Union, and each country writes it into its own law. Those inside its scope must register, adopt risk-management measures and report incidents within windows measured in hours, not days. Fines are calculated as a percentage of turnover. The part that surprises almost everyone: it is not only about large companies. The scope covers the sectors named in the directive — energy, transport, health, water, digital infrastructure, food, certain kinds of manufacturing — and it extends down the supply chain. If you supply a company that is in scope, its obligations become contractual requirements on you: that is why many discover they are involved through a questionnaire sent by a customer, not through an official notice. Whether it reaches you depends on your sector, your size, your country and who you serve — not something a web page can settle.
Who has to comply, and how you find out
The law splits those in scope into two groups: essential entities and important entities. What counts is the sector — energy, transport, health, banking, digital infrastructure, water, waste, food, manufacturing, postal services, chemicals, space, digital providers and public administration — and the size of the company. You don't decide on your own: Italy's National Cybersecurity Agency (ACN) enters entities on a list and notifies them. Those in scope register on the ACN portal, and the registration is renewed every year between 1 January and 28 February. This page explains the law, it does not establish whether it applies to you: that is settled on your own figures, with the Agency and with whoever advises you legally.
The deadlines that matter
The European directive is 2022/2555. Italy transposed it with legislative decree 138 of 4 September 2024, in force since 16 October 2024, and precise deadlines run from there. Since January 2026, entities in scope must be able to recognise a significant incident and report it to the Agency: an early warning within 24 hours, the actual notification within 72 hours, a final report within one month. And one date is close: by 31 October 2026 the baseline security measures set by ACN must be operational, not planned. From that day the Agency can start inspecting.
If you supply a company that has to comply
This is the part that surprises almost everyone, and it reaches far more companies than the list itself. NIS2 requires those in scope to secure their supply chain: map the relevant IT suppliers, revise contract clauses, monitor them over time. You may not be on the ACN list and still receive a questionnaire, a new clause at renewal, or a request to show how you keep the data they pass you. It isn't the law addressing you: it's your client, who answers for that data including the part sitting with you. Whoever can't answer gets replaced, and it usually happens at renewal, without discussion.
What is at stake
Fines are calculated on turnover, not on a fixed rate: up to 10 million euro or 2% of worldwide annual turnover for essential entities, up to 7 million or 1.4% for important ones, whichever is higher. But one consequence weighs more than money: responsibility sits with the management bodies, which must approve the measures and oversee how they are applied, and in serious cases can be temporarily barred from managerial functions. It is not a fine you hand over to the IT department.
Find a verified professional
Boutique Hacker does not sell tests: it connects those who need security with professionals whose hands-on certifications have been verified. The work, the quote and the contract are agreed directly with the chosen member, following the network's rules of engagement.