NIS2 Italy: baseline measures due by 31 October 2026 for entities included in 2025
Entities included in the Italian NIS list in 2025 must adopt the baseline security measures defined by ACN by 31 October 2026, eighteen months after the inclusion notice.
In Italy, the NIS2 directive is transposed by Legislative Decree 138/2024. Entities that received the notice of inclusion in the NIS list in April 2025 have eighteen months to adopt the baseline security measures: the deadline is 31 October 2026.
What the baseline measures are
They are the measures defined by ACN in determinations no. 164179/2025 and no. 379907/2025, proportionate to the entity's category (essential or important). They cover the areas of Article 21 of the directive: risk management, incidents, business continuity, supply chain, access, cryptography, training.
Deadlines already running
- Significant incident reporting: mandatory since 15 January 2026 for entities included in 2025.
- Annual update on the ACN platform: between 15 April and 31 May each year.
What to prepare
For each measure, it should be possible to show who owns it, when it was last reviewed and which evidence shows it is in place. The guide on the ten Art. 21(2) measures goes through them letter by letter.
Related guides
Official sources
Information only, current as of the date shown. Not legal advice: obligations and deadlines should be checked against the official texts.