// nis2 check-up
NIS2 check-up for your company.
In three weeks you know whether NIS2 applies to you, how far you are from the baseline measures required by Italy's National Cybersecurity Agency (ACN), and what to do first, with priorities and costs.
- 3 weeks
- typical duration
- Fixed price
- set after the first call, based on sites and workstations
- 1 report
- with a remediation plan
// who it affects
Does NIS2 apply to you? Often more than you think.
Essential and important entities
Medium and large companies in the sectors listed by Italian Legislative Decree 138/2024 (energy, transport, health, manufacturing, food, waste, digital services and more) and many public bodies.
Suppliers in the supply chain
Even if you are not directly in scope, NIS2 customers must assess their suppliers' security and are writing it into contracts.
Companies that want to be ready
The required measures are good security practice: adopting them lowers the risk of ransomware and downtime, even without the obligation.
// deadlines
The ACN calendar.
Updated October 2026. Dates may change with new ACN determinations.
-
Jan – Feb 2026
Annual registration or data update on the ACN portal.
-
15 January 2026
Significant incident reporting in force: early warning within 24 hours, notification within 72 hours, final report within one month.
-
October 2026
ACN may start audits and inspections.
-
31 October 2026
Baseline security measures in place, with documentary evidence, for entities registered in 2025.
-
2027
Deferred deadlines for entities registered for the first time in 2026.
// what it includes
A technical check-up, not just paperwork.
Scope assessment
Whether you are in scope, as an essential or important entity, or as a supplier to a NIS2 entity.
ACN portal
Help with registration, data updates and categorisation of activities.
Gap analysis
Point-by-point comparison with the ACN baseline measures that apply to your category.
Technical review
Firewalls, segmentation, access and MFA, patching, backup and restore, critical suppliers.
Remediation plan
Actions in order of priority, with timing, estimated costs and owners.
Board and incidents
A briefing for directors, who must approve the measures, and an incident reporting procedure.
// how it works
Four steps.
-
01
Interview
Half a day with you and whoever runs IT: activities, sites, systems, suppliers.
-
02
Technical review
On-site or remote analysis of real configurations and procedures.
-
03
Report
Written gap analysis and remediation plan, clear for non-technical readers too.
-
04
Briefing
One hour with management to set priorities. If you wish, I can then carry out the remediation.
// faq
NIS2 questions.
How do I know if NIS2 applies to my company?
Sector, size and role in the supply chain all matter. It is the first step of the check-up: usually an hour and your company registration details are enough.
What are the penalties for non-compliance?
Fines reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones. Directors can be held accountable.
Does the check-up replace a legal or privacy adviser?
No, it complements them. I cover the technical and organisational side of security and am happy to work with your adviser on contracts and legal aspects.
After the check-up, do I have to hire you for the work?
No. You get a plan you can carry out with anyone, including your current IT provider.
// next step
From October 2026 ACN can start audits. Do you know where you stand?
In three weeks the NIS2 check-up tells you whether you are in scope, what is missing and where to start.