This article’s text was created with the help of AI systems and reviewed by the WIT ICT team, in accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689) on the transparency of AI-generated content. The featured image was also generated using AI.
By the end of October 2026, one of the most debated cybersecurity windows of the past two years finally closes. The 31st is the date by which the first group of organisations listed by Italy’s National Cybersecurity Agency must have put the baseline measures of the NIS2 directive in place. For many Italian small and medium-sized businesses the deadline lands after months of uncertainty about who was actually in scope. The reach, though, goes well beyond the official register, because it pulls in the companies that supply software and services to those organisations. It is worth understanding what changes in practice, calmly but without shortcuts.
NIS2 reaches the supply chain, not only large players
NIS2 is Directive (EU) 2022/2555, transposed in Italy through Legislative Decree 138/2024, in force since 16 October 2024. Its aim is to raise the minimum level of cybersecurity across sectors deemed critical to the economy and public services: energy, transport, healthcare, water, digital infrastructure, ICT providers and more. Italy widened the scope beyond the European minimum, producing a list of more than 20,000 organisations, over 5,000 of them classified as essential entities. This is no longer a matter for multinationals and state bodies alone. A great many SMEs that operate in these sectors, or that serve them as suppliers, now fall within the directive’s field of application. The rules also separate essential entities from important ones, with tighter supervision for the former, who face proactive checks by the Agency. Working out which category you sit in is therefore the first step in calibrating the effort without wasting it.
The countdown: what is actually due by 31 October
The obligations did not all start at once. They begin from the individual notice through which the Agency tells each organisation it has been added to the register of NIS entities. From that point a staggered calendar runs: incident-notification duties mature roughly nine months later, while adopting the baseline security measures is expected within eighteen months. For the first cohort, those eighteen months converge on late October 2026. Once the threshold passes, the Agency can open its inspection activities. Any company that received the notice and postponed its work now has only weeks to close the gap, a margin that rewards sharp priorities rather than scattered effort. It is worth recalling that registration on the Agency’s digital platform opened in 2025 and, as often happens, sign-ups clustered close to the deadlines: any company that has not yet completed or updated its entry should check it at once, because everything else rests on it.
The measures the Agency expects to find
The decree does not impose one rigid checklist for everyone, but measures proportionate to each organisation’s risk. In practice, a business is expected to have run an up-to-date risk assessment and to have made concrete choices flowing from it. The recurring areas include:
- risk analysis and security policies for information systems;
- vulnerability management and timely patching;
- business continuity, tested backups and recovery plans;
- access control, multi-factor authentication and encryption where relevant;
- incident handling and response procedures.
The goal is not to pile up tools. It is to show that the choices follow the company’s real risk profile and that they are reviewed on a regular basis.
Incident reporting: the hours that count
One of the most operational aspects concerns what to do when something breaks. The directive introduces a multi-stage reporting flow towards the Agency. Industry sources describe an early warning within 24 hours of becoming aware of a significant incident, a more structured notification within 72 hours, and a final report roughly a month later. These timings test smaller organisations without an in-house security function most of all. For an SME, preparation makes the difference: knowing in advance who decides, who drafts the report and what information is needed keeps you from losing precious hours exactly when you are also handling the technical emergency.
Who is actually accountable: responsibility moves to the top
A meaningful shift in Legislative Decree 138/2024 is that it places responsibility on management and governing bodies. This can no longer be delegated wholesale to the IT desk or an outside vendor. Directors approve the measures, oversee their implementation and answer for violations; in several cases cybersecurity training for leadership is also required. For a business owner this means information security belongs among the items tracked at decision level, with a dedicated budget and metrics that make sense to non-specialists. It is a chance to treat the topic as a business risk, alongside financial and legal ones, rather than a technical cost to squeeze. On penalties, the European framework sets high maximum fines, designed as a deterrent rather than a revenue target: the aim is to push firms to act before an incident, not to punish them afterwards.
The ripple effect on suppliers: it matters off the list too
Here lies the reason NIS2 concerns many more companies than appear in the register. Regulated entities must manage supply-chain risk, so they tend to pass security requirements down to their suppliers through contracts, questionnaires and audits. A small software house, an agency that runs client websites or a managed-services provider may suddenly have to demonstrate adequate security practices to keep strategic accounts. In that scenario, being ready becomes a commercial advantage: a supplier who can answer a third-party assessment with orderly documentation starts ahead of one who has to improvise under pressure.
A realistic path to compliance for a small business
Facing NIS2 without being overwhelmed means moving in measurable steps. A sustainable approach starts from checking your own position and builds on the time that remains:
- confirm whether and when the Agency’s notice arrived, and under which classification;
- capture the current state with a gap analysis against the expected measures;
- set a few high-impact priorities, such as backups, strong authentication and patch management;
- write essential incident-response procedures and rehearse them at least once;
- keep tidy evidence of the decisions made, useful both for the Agency and for clients.
You do not need to turn the company into a fortress in a few weeks. You need to show a credible, documented path that fits your real risk, and then keep improving it over time.
Want to know more? Contact us for a free consultation.