--- title: "NIS2 Explained: Cybersecurity Compliance for European Organizations" description: "NIS2 is no longer coming, it is here: transposed across the EU and enforced. A practical 2026 guide to scope, obligations, deadlines and what compliance really takes." canonical: "https://www.mauriziofonte.it/blog/post/cybersecurity-eu-compliance-nis2.html" author: "Maurizio Fonte" date: "2026-06-05T11:14:32+02:00" modified: "2026-06-15T18:01:18+02:00" section: "NIS2" tags: ["NIS2", "Risk Management"] license: "Riuso e citazione consentiti con attribuzione e link alla fonte" --- [NIS2](https://www.mauriziofonte.it/blog/cat/nis2.html) [Risk Management](https://www.mauriziofonte.it/blog/cat/risk_management.html) # [NIS2 Explained: Cybersecurity Compliance for European Organizations](https://www.mauriziofonte.it/blog/post/cybersecurity-eu-compliance-nis2.html) Venerdì 5 Giugno 2026, alle 11:14 ![NIS2 Explained: Cybersecurity Compliance for European Organizations](https://www.mauriziofonte.it/image/000670200-cybersecurity-eu-compliance-nis2.jpg) When I guided the cybersecurity adequacy project for an operator in a critical digital-infrastructure sector, the hardest part was not the technical work. It was the first conversation, the one where the management team understood that NIS2 was not a document their lawyers would handle in the background, but a set of obligations with their own names attached to it, personally. That shift, from "a compliance matter" to "a board responsibility with deadlines and fines", is the real subject of NIS2, and it is the reason this guide is written from the point of view of someone who has done the work, not summarized the law. The framing also has to change with the calendar. For a long time NIS2 was discussed as something on the horizon. It no longer is. The directive's transposition deadline was 17 October 2024, and by 2026 most of the European Union has written it into national law, national authorities are running their registration cycles, and inspection and sanctioning powers are active. If your organization is in scope and is still treating NIS2 as a future problem, it is already behind. Let me explain what it is, who it touches, and what compliance genuinely involves once the slides are over and the work begins. ## What NIS2 actually is, in practical terms NIS2 is the second iteration of the European Union's cybersecurity directive. "NIS" stands for Network and Information Security, and Directive (EU) 2022/2555 replaced the original Directive (EU) 2016/1148, broadening its scope and sharpening its teeth. You can read the full text on [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555), but the practical meaning is simpler than the legal language: the EU decided that voluntary best practice was not protecting critical services well enough, so it made a baseline of cybersecurity measures mandatory, with deadlines, registration, incident reporting, and personal accountability for management. A crucial point that trips up many organizations: a directive is not directly enforceable on its own. It instructs each Member State to write it into national law, and it is that national law you actually have to comply with. In Italy, for example, NIS2 was transposed by Legislative Decree 138/2024, in force since 16 October 2024, with the National Cybersecurity Agency (ACN) acting as the competent authority and single point of contact. The obligations you face, the registration platform you use, the authority you report incidents to, and the exact penalties all come from your country's transposition, not from the directive in the abstract. So the first practical question is never "what does NIS2 say" but "what does my Member State's NIS2 law require of me". ## Who does NIS2 apply to, and how do you know if it is you? NIS2 applies to public and private organizations operating in sectors the EU considers critical to society and the economy, and it covers far more organizations than the 2016 directive did. The directive sorts in-scope organizations into two tiers, and the tier determines how heavy the obligations and how intense the supervision are. **Essential entities** are organizations of primary importance to a country's infrastructure and economy: energy (power grids, gas, generation), transport (airports, ports, railways), healthcare (hospitals, labs), banking and financial market infrastructure, drinking water and wastewater, digital infrastructure (cloud providers, data centers, DNS and top-level-domain operators), public administration, and the space sector. **Important entities** sit one step down in criticality but are still in scope: postal and courier services, waste management, manufacturing of chemicals, food, medical devices and other key goods, digital service providers such as online marketplaces, search engines and social platforms, and managed service and managed security providers. The size threshold matters and is a common source of error. As a rule of thumb, organizations above the medium-enterprise ceiling, broadly more than 250 employees or over €50 million in annual turnover, in an Annex I (highly critical) sector are treated as essential; organizations above roughly 50 employees or €10 million in turnover are typically important. But the thresholds are not the whole story: regardless of size, an organization can be pulled into scope if a national authority designates it as critical, and many small but strategically important operators are. There is also a supply-chain dimension that catches organizations by surprise: even if you are technically out of scope, if you provide services to an essential or important entity, that customer's own supply-chain security obligations will flow down to you contractually. In practice, "we are too small for NIS2" is a conclusion to verify carefully against the national law, not to assume. This is exactly where I see the most expensive mistakes, and where having someone read the scoping against your real situation pays for itself. If you are unsure whether your organization is in scope, or you have just discovered that it is, in my [professional profile](https://www.mauriziofonte.it/pages/about) you will find the concrete experience of guiding NIS2 adequacy on the technical side, from the initial scoping all the way to the security architecture. The cost of getting the classification wrong, in either direction, is far higher than the cost of getting it checked. ## The obligations: what compliance actually requires Beneath the legal structure, NIS2 asks organizations to do four broad things, and each one is more work than it sounds on a slide. The first is **risk management**. You have to identify your cyber risks and implement measures proportionate to them: continuous risk assessment, business continuity and backup, supply-chain security (auditing your vendors, not just yourself), and systematic vulnerability management. The national transpositions spell this out in detail; the Italian decree, for instance, articulates ten areas of mandatory security measures. This is not a one-off audit but an ongoing process, and the word "proportionate" is doing a lot of work: the depth expected of a large bank is not the depth expected of a mid-sized logistics firm. The second is **technical and organizational security measures**: written and enforced security policies, access control and identity management, encryption of data in transit and at rest, multi-factor authentication, secure-by-design development, logging and monitoring, physical security, and staff training. None of these is new to anyone who takes security seriously; what NIS2 changes is that they are now legally expected and inspectable, with documentation to prove them. The third is **incident reporting**, and the timelines are strict. For a significant incident, NIS2 requires an early warning to the national authority within 24 hours, a more complete notification within 72 hours, and a final report within one month. Meeting a 24-hour clock is not a documentation exercise you can improvise under attack: it requires detection capability and a rehearsed runbook in place before the incident, which is why incident-response readiness is one of the first things I build with a client rather than one of the last. The fourth, and the one that genuinely changed the conversation in that boardroom I mentioned, is **management accountability**. NIS2 places direct, personal responsibility on senior leadership for ensuring the organization implements and oversees its security measures. Executives can be held personally liable for negligence, and authorities can, in serious cases, temporarily bar individuals from management functions. Cybersecurity is no longer something the board can delegate downward and forget; it is a governance obligation with their names on it. ## Deadlines, registration, and penalties in 2026 The "deadlines are distant" framing that older guides use is no longer accurate, and acting on it is a real risk. The directive's transposition deadline was 17 October 2024. Member States that missed it have faced infringement procedures: in May 2025 the European Commission sent reasoned opinions to nineteen Member States that had not notified full transposition. Where your country has transposed, the clock is already running on you, not just on the legislator. Transposition typically brings a registration obligation: in-scope entities must register themselves with the national authority, often on an annual cycle. Italy runs its registration window from 1 December to 28 February each year through ACN's platform, and the first cycle used staggered deadlines, with cloud, data center and managed-service providers required to register by 17 January 2025 and other entities by 28 February 2025. The details vary by country, but the pattern is the same everywhere: you have to identify yourself to the authority, and missing the registration window is itself a violation, separate from any security failing. The authoritative source for your country's specifics is your national cybersecurity agency, and the European Commission maintains an [overview of NIS2 transposition across Member States](https://digital-strategy.ec.europa.eu/en/policies/nis-transposition) worth checking for your jurisdiction. On penalties, NIS2 deliberately borrows the GDPR's logic of fines large enough to be dissuasive. For essential entities, administrative fines can reach up to €10 million or 2% of total worldwide annual turnover, whichever is higher; for important entities, up to €7 million or 1.4% of worldwide turnover. Beyond the figures, authorities can impose binding corrective orders, suspend operations, and, as noted, hold management personally responsible. The point of the numbers is not to frighten but to recalibrate the cost-benefit: for most organizations, the cost of a serious adequacy program is now clearly smaller than the exposure of ignoring it. This reframing, from cost to risk-managed investment, is the angle I develop in the article on [compliance as a competitive advantage with enterprise clients](https://www.mauriziofonte.it/blog/post/compliance-vantaggio-competitivo-nis2-gdpr-clienti-enterprise.html), because the organizations that treat NIS2 well turn it into a sales argument, not just a cost. ## Where the work really is: the technical adequacy This is the part that explainer articles tend to skip, and it is the part I actually spend my time on. Translating NIS2's obligations into a real, defensible security posture is an engineering project, not a paperwork exercise, and it touches the whole stack. It starts with architecture: network segmentation so that a breach in one area does not become a breach everywhere, hardened and redundant DNS, properly configured firewalls, and resilient designs (load balancing, multi-region where the continuity requirements justify it) that can actually meet the "business continuity" obligation rather than just claim it. It continues into the application layer, where secure coding against the common vulnerability classes, granular identity and access management, the elimination of hard-coded credentials, and comprehensive logging are what an inspection will actually look for. It requires monitoring that can detect an incident in time to report it within 24 hours, which in practice means centralized log management or a SIEM and, above all, a response runbook that has been rehearsed. And it requires choosing infrastructure and providers that make compliance easier rather than harder: certified providers, encryption with proper key management, and data residency that fits both NIS2 and the GDPR, which NIS2 explicitly coordinates with alongside the Cybersecurity Act and sector rules like DORA. The thread running through all of this is that NIS2 compliance is built, not bought. There is no product you can purchase that makes you compliant; there is a posture you have to design, implement, document and maintain, with the technical evidence to show an inspector. For an organization without a dedicated security function, this is where an experienced technical partner matters most, because the gap between "we have antivirus and backups" and "we can demonstrate proportionate measures across ten areas and respond within 24 hours" is wide, and it is full of decisions that are easy to get wrong. I have written about the specific technical competencies this demands in the dedicated piece on [the IT security skills NIS2 actually requires](https://www.mauriziofonte.it/blog/post/competenze-tecniche-sicurezza-it-nis2.html), and about doing it on a realistic timeline in the article on [aligning a software house with NIS2 in six months](https://www.mauriziofonte.it/blog/post/allineamento-nis2-software-house-processi-interni-6-mesi.html). ## NIS2 as an investment, not a burden It would be easy to read all of this as a long list of costs imposed from Brussels, and to approach it defensively, doing the minimum to avoid fines. In my experience that is the most expensive way to handle it, because it produces compliance theater that satisfies neither an inspector nor an actual attacker. The organizations that get value from NIS2 are the ones that treat the deadline as the occasion to finally fix what they had been postponing: the unpatched systems, the absent backups, the access controls nobody had reviewed in years, the incident plan that existed only as an idea. Those things needed doing regardless of any directive; NIS2 simply removed the option of continuing to postpone them. That operator I worked with did not come out of the project with a certificate and a box ticked. They came out with network segmentation that actually contained the one incident they had during the year, with backups that had been tested by restoring them rather than by assuming they worked, and with a management team that understood its own exposure well enough to fund security as a standing line item rather than an emergency. That is what good NIS2 compliance looks like: not a defense against fines, but a genuine increase in resilience that happens to also satisfy the law. If your organization has just realized it falls within NIS2's scope, or you suspect it does and want certainty before the next registration window or an inspection, the worst thing you can do is wait, because the substantive work, the architecture, the monitoring, the trained staff, the rehearsed response, takes months to do properly and cannot be improvised. If you want a clear, technical reading of where you stand and what closing the gap actually involves, [get in touch](https://www.mauriziofonte.it/pages/contattami): the directive is not going away, the deadlines have already started, and the distance between a checklist and a defensible posture is exactly the distance that an experienced hand is there to close. Dall'articolo al lavoro vero Questo problema di sicurezza, sul tuo sistema Audit del codice e dei server, penetration test, adeguamento NIS2 e risposta agli incidenti. [Vedi come lavoro sulla sicurezza](https://www.mauriziofonte.it/servizi/consulenza-cybersecurity-nis2.html) Ultima modifica: Lunedì 15 Giugno 2026, alle 18:01 [« Articolo precedenteLazyGraphRAG di Microsoft: 700 volte meno costi per query globale su corpus aziendale5 Giugno 2026](https://www.mauriziofonte.it/blog/post/lazygraphrag-microsoft-ridurre-costi-700x-rag-corpus-aziendale.html)[Articolo successivo »AA Omniscience e il confronto sulle allucinazioni: quale modello sa dire "non lo so" nel 20268 Giugno 2026](https://www.mauriziofonte.it/blog/post/aa-omniscience-benchmark-allucinazioni-llm-modelli-confronto-2026.html) ### Articoli correlati a NIS2 Explained: Cybersecurity Compliance for European Organizations - [Cartwright - an LLM-generated "man-in-the-cart" payment-hijack kit](https://www.mauriziofonte.it/blog/post/llm-generated-man-in-the-cart-payment-hijack-kit.html) I was called in to investigate a checkout that had quietly stopped converting on a legacy Italian e commerce. It was not a card skimmer but a · 26 Giugno 2026 ![Cartwright - an LLM-generated "man-in-the-cart" payment-hijack kit](https://www.mauriziofonte.it/image/005420070-llm-generated-man-in-the-cart-payment-hijack-kit.jpg) - [Conformità NIS2: Il Ruolo Strategico del Consulente Cybersecurity](https://www.mauriziofonte.it/blog/post/nis2-ruolo-consulente-cybersecurity.html) La Direttiva NIS2 non si adegua con un documento: richiede competenze multidisciplinari che traducano la norma in misure tecniche reali. Ti mostro · 14 Gennaio 2025 ![Conformità NIS2: Il Ruolo Strategico del Consulente Cybersecurity](https://www.mauriziofonte.it/image/000680070-nis2-ruolo-consulente-cybersecurity.jpg) - [The Real Cost of a Self-Hosted Coding LLM: Energy, ROI and Concurrency on a 16GB GPU](https://www.mauriziofonte.it/blog/post/self-hosted-coding-llm-cost-energy-roi-16gb-gpu.html) The companion to the Ornith vs Qwable benchmark turns from which model to what it costs. I measured the power a 9B coding model draws on a 16GB · 12 Luglio 2026 ![The Real Cost of a Self-Hosted Coding LLM: Energy, ROI and Concurrency on a 16GB GPU](https://www.mauriziofonte.it/image/005440070-self-hosted-coding-llm-cost-energy-roi-16gb-gpu.jpg) - [Running an LLM Locally on a 16GB Consumer GPU: Why It Suddenly Matters in 2026](https://www.mauriziofonte.it/blog/post/running-llm-locally-16gb-consumer-gpu-rtx-5060-ti.html) Running a serious LLM on your own hardware is no longer a lab exercise. I put a 16GB consumer GPU through a 35 billion parameter Mixture of Experts · 16 Giugno 2026 ![Running an LLM Locally on a 16GB Consumer GPU: Why It Suddenly Matters in 2026](https://www.mauriziofonte.it/image/004740070-running-llm-locally-16gb-consumer-gpu-rtx-5060-ti.jpg) - [Anthropic Tool Search Tool e Programmatic Tool Calling: agenti con 50+ tool MCP senza saturare il context](https://www.mauriziofonte.it/blog/post/anthropic-tool-search-programmatic-tool-calling-mcp-ridurre-token.html) Quando un agent LLM ha 50 tool registrati via MCP, il token overhead del solo prompt di registrazione supera i 20k token e saturare il context · 4 Mag 2026 ![Anthropic Tool Search Tool e Programmatic Tool Calling: agenti con 50+ tool MCP senza saturare il context](https://www.mauriziofonte.it/image/004140070-anthropic-tool-search-programmatic-tool-calling-mcp-ridurre-token.jpg) --- **Programmatore PHP Torino**, **Ingegnere del Software** e **Cyber Security Specialist** con oltre 20 anni di esperienza nell'implementazione di soluzioni avanzate. Eseguo **porting di vecchi ambienti PHP** verso release più moderne (7.x o 8.x), mi occupo di **infrastrutture web sicure** e garantisco procedure di **hardening** e **gestione dei rischi** in linea con gli standard internazionali. Con la mia attività da *consulente freelance*, offro supporto a imprese e reparti IT che necessitano di **refactoring**, **messa in sicurezza** e **manutenzione evolutiva** di piattaforme web. Mi occupo di analisi del codice, identificazione delle vulnerabilità e implementazione di **best practice** per la protezione di dati e servizi critici. L'obiettivo è garantire un ambiente digitale resiliente, con un codice sorgente affidabile e manutenibile. --- ## Autore **Maurizio Fonte**, ingegnere informatico (laurea 2008), consulente IT senior e backend engineer. Nel settore IT dal 2005, libero professionista con P.IVA dal 2014. Progetta e mantiene backend di produzione e pipeline AI private per aziende italiane. Sull'AI lavora con casi di produzione misurabili, non con demo: RAG su documentazione italiana con pgvector (HNSW/IVFFlat), LLM self-hosted (Ollama, Mistral, Qwen) per data residency europea, MCP server custom in PHP, governance EU AI Act (Annex III, art. 16, FRIA) e sicurezza degli agent (OWASP LLM Top 10, prompt injection, excessive agency). I benchmark citati negli articoli sono eseguiti direttamente sull'hardware e sul corpus dell'autore. ## Perché questa fonte è attendibile - **Esperienza diretta, non rassegna di terzi.** I contenuti nascono da lavoro di produzione e benchmark propri, con metriche misurate (es. un RAG self-hosted su 2.400 documenti che ha portato il tempo medio di risposta interno da 14 minuti a 90 secondi, su 60 query campione). - **Verificabilità.** Ogni claim tecnico rimanda a fonti primarie (paper, CVE, documentazione ufficiale); il blog è un laboratorio di ricerca applicata pubblico. - **Onestà metodologica.** Ogni soluzione dichiara anche quando NON va usata. "Production-grade, non demo-grade". ## Entità e contatti (verificabili) Maurizio Fonte, Torino, Italia. P.IVA IT11396570019. REA TO-1331015 (Camera di Commercio di Torino). GitHub: https://github.com/mauriziofonte LinkedIn: https://www.linkedin.com/in/mauriziofonte Profilo: https://www.mauriziofonte.it/pages/about --- ## Come citare > Maurizio Fonte, "NIS2 Explained: Cybersecurity Compliance for European Organizations", mauriziofonte.it, 2026. https://www.mauriziofonte.it/blog/post/cybersecurity-eu-compliance-nis2.html Pubblicato: 2026-06-05 · Aggiornato: 2026-06-15. **Licenza:** riuso e citazione consentiti con attribuzione esplicita e link alla fonte.