NIS2 in Italy: what D.Lgs. 138/2024 changes for companies and public authorities
3 min read
Italy transposed the NIS2 Directive with Legislative Decree 138/2024, in force since 16 October 2024. Its consequences run far beyond the length of the text: management is personally accountable for cyber risk decisions, security obligations are written down rather than implied, and incidents have to be reported on a clock measured in hours, not weeks.
Most of the coverage has been aimed at the large organisations directly named by the decree. The more interesting effect is one step down the chain — in the supply chain of SMEs that sell to them, and that now have to answer questions they have never been asked before.
What NIS2 asks for
The decree raises the floor for cybersecurity across essential and important sectors — healthcare, finance, transport, energy, digital infrastructure, public administration. In practice it asks organisations for:
- Documented cyber risk management measures, reviewed and kept current
- Supply chain security: knowing, and assessing, who you depend on
- Business continuity, backup and crisis management plans that have been tested
- Ongoing staff and management training
- Direct accountability of board members and senior managers
The reporting clock
Significant incidents follow a three-step timeline, and it is the part organisations most often discover too late:
- An early warning within 24 hours to ACN (Agenzia per la Cybersicurezza Nazionale)
- A full incident notification within 72 hours
- A final report within one month
Meeting the early-warning deadline is not a procurement decision made after the fact. It requires a named contact, a defined escalation path and a rehearsed procedure — all of which have to exist before anything happens.
What non-compliance costs
The decree sets administrative fines by category of entity:
- Essential entities: up to €10 million or 2% of global annual turnover, whichever is higher
- Important entities: up to €7 million or 1.4% of global annual turnover, whichever is higher
Alongside the fines sit the obligations that are harder to price: registration on the ACN portal, which opened in January 2025, the nomination of a point of contact, and keeping the organisation's technical and organisational information up to date as deadlines roll forward.
"Myth buster" of the day
"We are a small company, so NIS2 does not concern us."
Often true in the letter, rarely true in practice. An SME that is not itself in scope still sits in someone else's supply chain, and that customer now has to assess its suppliers. The questionnaire arrives regardless of whether the decree names you.
Key facts recap
- NIS2 applies in Italy through D.Lgs. 138/2024, in force since 16 October 2024
- Fines reach €10M or 2% of global turnover (essential) and €7M or 1.4% (important)
- Incidents: early warning within 24 hours, notification within 72 hours, final report within one month
- Registration on the ACN portal opened in January 2025
- Suppliers feel NIS2 through their customers, not only through the decree