Redazione RHC : 21 October 2025 07:36
The European NIS2 directive represents a turning point for cybersecurity in Italy and Europe, imposing new responsibilities on public and private organizations in managing cyber risks. To support the compliance process at all stages, the National Cybersecurity Agency ( ACN ) recently published a guide to reading the ” NIS Guidelines – Basic Specifications,” a document that clarifies the obligations for essential and important NIS entities involved and defines the timeframes and methods for adopting minimum security measures and reporting incidents.
This document provides valuable guidance for companies and public bodies in understanding how to meet the obligations set forth in Legislative Decree 138/2024, which implemented the European NIS2 Directive in Italy.
In this article, we’ll analyze in detail the two central chapters of the ACN guidelines: first, the ” Basic Security Measures,” which must be identified using a risk-based approach and therefore tailored to the context of each organization; then, we’ll review the types of requirements and required documentary evidence. Another key aspect concerns the ” Basic Significant Incidents,” with particular attention to the identified types, the evidence criteria, and the risks associated with privilege abuse. At the same time, we’ll explore the value of relying on an expert partner like ELMI to effectively and comprehensively manage NIS2 risks and compliance.
The first part of the ACN guidelines document covers Basic Security Measures, with a focus on:
NIS entities must implement security measures within 18 months (October 2026) of receiving notification of registration in the national NIS list. The security measures apply to the information and network systems used by the entities in their operations or in providing their services.
These measures, developed in accordance with the National Cybersecurity Framework , are organized into functions, categories, and subcategories, each with specific requirements. In practical terms, each measure indicates what must be implemented and what documentary evidence must be provided to demonstrate compliance.
In total, the ACN guidelines define:
The difference reflects the greater risk exposure and critical role of essential entities; in fact, they must comply with a greater number of measures and requirements than important entities, since the legislation takes into account their greater exposure to risks and the potential social and economic impact of a potential accident.
In this context, the support of a specialized partner like ELMI allows organizations to correctly interpret ACN requirements, translate them into concrete operational plans, and prepare the necessary documentation, reducing the risk of non-compliance.
Basic security measures: risk-based approach
In defining security measures, the ACN applied the provisions of Article 31 of the NIS2 Decree: the obligations are not the same for everyone, but must be calibrated to the degree of risk exposure of information and network systems.
The more complex requirements are modulated through some clauses that guide their application:
To translate security measures into concrete actions, the ACN defines specific requirements that NIS entities must meet to achieve compliance. These requirements are divided into two main categories:
This distinction allows for the combination of organizational and technological controls , ensuring that security measures are not only formally adopted, but actually effective in preventing and mitigating cyber risks.
To demonstrate the effective implementation of security measures, NIS entities must prepare a series of key documents , structured according to their organization and operational context. Among the main ones are:
The organization can decide how to structure the documentation, for example by concentrating multiple contents in a single document or distributing them across multiple files, as long as the documents are easily accessible and consultable by those who need to verify them.
ELMI supports organizations with a document management platform that allows them to map regulatory requirements, centralize and secure documentation, track access and responsibilities, and automate approval processes. It also facilitates the controlled management of policies, plans, and risk analyses, ensuring ongoing updates and supporting staff training.
Thus, companies not only comply with NIS2 obligations, but transform compliance into a simple, secure and easily auditable process.
The ACN guidelines also define the basic types of significant incidents , which are events that can have a significant impact on the data security or continuity of services for NIS entities. Incidents are differentiated based on the type of entity: three major incidents have been identified for important entities , while four major incidents have been identified for essential entities , with the addition of a specific event related to the abuse of granted privileges.
In detail, the main types of significant basic accidents are:
Evidence of the incident is the starting point for fulfilling notification obligations: a significant incident is considered only when the entity has objective evidence confirming that the event actually occurred. The deadlines for pre-notification (24 hours) and official notification (72 hours) to CSIRT Italy begin to run from the moment the evidence is acquired.
Evidence can be gathered through several sources, including:
In practice, having evidence means being able to demonstrate with concrete data that the incident occurred, enabling a timely response and the correct management of regulatory obligations.
For many organizations, the critical element is not just incident detection, but having a constant presence capable of monitoring and blocking cyber threats in real time. With this in mind, ELMI’s Security Competence Center provides 24-hour monitoring and, thanks to advanced threat hunting and incident response tools, drastically reduces the time required to confirm an event and initiate notification in accordance with NIS2 guidelines.
Those included in the NIS entity list must meet specific deadlines, with no room for delay. NIS entities must organize their compliance proactively and promptly to ensure NIS2 compliance and reduce cyber risks.
The regulatory process includes a series of fundamental stages:
In parallel to this calendar, the main activities to plan include:
To effectively address these deadlines, it’s advisable to establish clear operational plans, assign specific responsibilities, implement continuous monitoring systems, and integrate compliance with staff training. This way, organizations not only comply with regulations, but also strengthen digital resilience and reduce the impact of potential incidents.
ELMI supports NIS entities in this crucial phase, supporting them in planning compliance and preparing the required documentation. Through targeted assessments and compliance roadmaps, the company enables them to meet the deadlines set by the NIS2 directive without disrupting internal processes, while ensuring operational continuity and robust defenses.
Relying on a highly qualified partner like ELMI means following a structured path towards compliance with the NIS2 Directive , with customized, integrated, and scalable solutions designed for every phase of the compliance process. Thanks to consolidated expertise in cybersecurity and consulting, ELMI supports organizations in implementing security measures, managing incidents, and completing the documentation required by the regulation.
ELMI supports companies with a structured assessment aimed at evaluating the scope of the directive: analysis of the services provided, IT infrastructure and regulatory constraints, identification of cybersecurity roles and responsibilities, and assessment of the current level of security.
Subsequently, a gap analysis is conducted to identify areas of non-compliance and opportunities for improvement, assessing the risks, vulnerabilities, and operational impact of any incidents. Based on this, an intervention plan is developed, which includes technical and procedural countermeasures to strengthen security and ensure compliance with regulatory requirements.
The Security Competence Center is ELMI’s operations center designed to address cybersecurity challenges with an integrated and proactive approach. The Security Operation Center (SOC) and the Network Operation Center (NOC) ensure the protection of critical information, regulatory compliance, continuous monitoring, and IT infrastructure resilience. Specifically:
Together, the SOC and NOC form the operational heart for protecting critical assets and managing incidents.
Through a 24/7 service and advanced threat intelligence tools and early warning systems, ELMI ensures complete incident management, reducing time to detect and time to respond , guaranteeing constant control over critical networks, systems and applications, in line with the requirements of the NIS2 Directive.
NIS2 compliance doesn’t end with technical and procedural implementation. ELMI supports organizations with targeted training programs focused on incident management, security governance, and the dissemination of cybersecurity culture at all levels of the company.
In parallel, ELMI offers ongoing regulatory support , with updates on new provisions and guidelines, periodic review of policies and procedures, and assistance in the technical interpretation of requirements, ensuring a sustainable and integrated approach to NIS2 compliance.
The European NIS2 Directive and the ACN guidelines establish a clear standard for managing IT risks , from basic security measures to the proper management of significant incidents . For organizations, meeting these requirements means adopting a risk-based approach, with integrated organizational and technological controls, ongoing monitoring, and documented procedures.
Relying on a partner like ELMI and its team of certified specialists allows you to turn NIS2 compliance into a true competitive advantage. Thanks to customized cybersecurity services and regulatory training and support programs, companies can ensure robust information systems, event traceability, reduced time to detect and respond, and full compliance with reporting obligations.
Redazione