NIS2 Operational Manual

Abstract

This operational manual explains the NIS2 Directive, (EU) 2022/2555, as transposed into Italian law by Legislative Decree No. 138 of 4 September 2024, together with the implementation framework issued by the National Cybersecurity Agency (ACN). It is written for those who have to turn the law into concrete decisions: establishing whether an organisation is in scope, registering on the ACN platform, implementing the baseline security measures and notifying significant incidents.

Each part combines the provisions of the decree with practical guidance, timelines and the ACN determinations in force in June 2026, including the deadlines that matter this year: incident notification obligations fully operational since 15 January 2026 and baseline security measures to be in place by 31 October 2026.

What you will find inside

• Part I — General provisions Introduction to NIS2, the ACN implementation framework and the updated timeline.
• Part II — Definitions and scope The 52 definitions, scope of application, protection of national interests and jurisdiction.
• Part III — National governance ACN, sector authorities, the NIS Table, crisis management and the relationship with the GDPR.
• Part IV — Registration and identification Classification of entities, registration on the ACN platform and the annual update.
• Part V — Security measures and governance Accountability of management bodies, risk-management measures and ACN baseline specifications, plus an addendum on voluntary notification, certifications, technical specifications and proportionality.
• Part VI — Incident notification Significant incidents, notification deadlines and the incident-management process.
• Part VII — Sector analysis Annexes I–IV: 11 highly critical sectors, 7 other critical sectors, public administration and a self-classification flowchart.

Who it is for

Boards and management bodies, CISOs and security teams, compliance officers and DPOs, public administrations and consultants supporting entities within the scope of NIS2.