Aggiornamento
NIS2: what changes for Italian companies now that Legislative Decree 138/2024 has transposed it
Decree 138/2024 transposes the NIS2 Directive: new obligations on cyber governance, incident notification and the supply chain. A practical guide to working out whether you are an essential entity, an important entity or out of scope.
The new scope
Legislative Decree 138/2024 sharply widens the range of entities required to put cybersecurity measures in place, taking in manufacturing, food, waste management and critical suppliers to public administration. For many sectors the minimum threshold drops to 50 employees or €10 million turnover.
Three categories
- Essential entities: energy, transport, banking, healthcare, digital infrastructure. Ex-ante supervision.
- Important entities: postal services, food, manufacturing, research, non-critical cloud providers. Ex-post supervision.
- Excluded: micro-enterprises below the threshold (save for exceptions).
What to do now
- Map your scope: check your ATECO codes and the size of your organisation.
- Registration with the ACN (National Cybersecurity Agency): by 17 January 2026 (essential entities) / 17 April 2026 (important entities).
- Documented risk assessment in accordance with Article 24 of Legislative Decree 138/2024.
- Incident notification plan: early warning within 24 hours, notification within 72 hours.
- Training for management bodies: NIS2 provides for personal liability.
How Forgest can support you
We work alongside you on classification, gap assessment and the implementation of technical and organisational measures. The ACSIA CRA platform covers detection, response and reporting in an automated way.
NIS2 training is mandatory for management bodies: the NIS2 Directive provides for the personal liability of directors. The recommended training path comprises the privacy and GDPR course for all staff who process data and manager training to build cyber risk management into board-level responsibilities.
Tag