Who NIS2 applies to
NIS2 — Directive (EU) 2022/2555 — replaced the first NIS directive across the EU. Whether it applies to a given organisation depends on several things together, and it is safer to think “may apply” than “applies”:
- Sector. The Directive lists sectors of high criticality (Annex I) and other critical sectors (Annex II).
- Size. As a rule, medium-sized and large organisations in those sectors — the size test uses the EU SME definition, so linked and partner enterprises are counted, which pulls many subsidiaries into scope.
- Special categories. Some entities are in scope regardless of size — for example certain digital-infrastructure and trust-service providers, public administrations, and entities a Member State designates because a disruption would have significant effects.
- National implementation. Each Member State transposes the Directive with its own thresholds, lists, exceptions and procedures, and identifies entities through registration and notification.
Two categories, two levels of supervision: essential entities (larger organisations in Annex I sectors; supervised proactively) and important entities (the rest; supervised after the fact). If you supply an essential or important entity, expect their supply-chain requirements to land on you even if you are not directly in scope.
What NIS2 requires (Article 21)
Article 21 lists the minimum cybersecurity risk-management measures. In practical terms:
- Policies on risk analysis and information-system security
- Incident handling
- Business continuity — backups, disaster recovery, crisis management
- Supply-chain security, including the security of relationships with direct suppliers and service providers
- Security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure
- Policies and procedures to assess the effectiveness of the measures
- Basic cyber hygiene practices and cybersecurity training
- Policies on cryptography and, where appropriate, encryption
- Human-resources security, access control policies and asset management
- Multi-factor or continuous authentication, secured communications and secured emergency communications
Alongside these: reporting of significant incidents to the national CSIRT or competent authority — an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, an intermediate report when the CSIRT or authority requests one, and a final report normally within one month of the incident notification, all through the applicable national process (ACN/CSIRT Italia in Italy, DNSC in Romania) — management accountability — governing bodies must approve the measures, oversee their implementation and be trained — and registration with the national authority.
Italy — ACN
Italy transposed NIS2 with Legislative Decree 138/2024, in force since 16 October 2024, with the Agenzia per la Cybersicurezza Nazionale (ACN) as the competent authority. Entities registered on the ACN portal (first window January–February 2025) and received their inclusion notifications; ACN’s Determination no. 164179 of 14 April 2025 set out the baseline technical, operational and organisational security measures. Baseline measures generally become due about 18 months after an entity’s inclusion notification — for the many entities notified in April 2025, that falls around October 2026 — with further long-term obligations phased in afterwards. There is no single universal deadline: your date follows your notification. That is why the homepage points at October 2026, and why Italian companies are asking now.
Romania — DNSC
Romania transposed NIS2 with Government Emergency Ordinance 155/2024, with the Directoratul Național de Securitate Cibernetică (DNSC) as the competent authority. In 2025 DNSC issued its implementing orders on the registration/notification of entities and on the methodology for assessing an entity’s risk level, opening registration for entities in the ordinance’s annexes. Timing depends on when the rules become applicable to a given entity — do not assume a single window applies to everyone. If you have not registered or assessed your risk level, that is step one; further technical norms follow.
DORA — financial entities and their ICT providers
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies from 17 January 2025 and directly regulates covered financial entities — banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers and others. It requires an ICT risk-management framework, incident classification and reporting, digital operational resilience testing (including threat-led penetration testing for larger entities), ICT third-party risk management with specific contractual terms, and information-sharing arrangements.
For ICT providers the picture is different: an ordinary ICT supplier is not automatically directly regulated by DORA merely because it supplies a financial entity — it is affected through its customers’ contracts and due diligence (the mandatory contractual clauses, exit and audit rights, concentration-risk assessments), it may have another direct regulatory status of its own, and providers designated as critical ICT third-party providers by the European Supervisory Authorities fall under DORA’s direct oversight framework. Financial entities remain responsible for their own DORA obligations. If you sell software or IT services to a financial entity, expect DORA to arrive through your contracts.
Our approach — three steps
1. Gap assessment. We assess how the scope tests apply to your facts (a technical scoping, not a legal determination — that stays with your counsel and the authority), then assess your current controls against Article 21 (or DORA’s pillars) using your regulator’s framework and vocabulary — ACN’s determinations in Italy, DNSC’s methodology in Romania. Interviews, evidence review, technical checks. Output: a gap report with a risk-ranked list, in the language your board and your regulator use.
2. Remediation roadmap. A sequenced plan — quick wins, the measures that need budget, and the ones that need engineering — with owners and dates. We can execute the technical parts through Secure Engineering and penetration testing.
3. Ongoing support through CaaS. NIS2 and DORA are continuous obligations on you. Cybersecurity-as-a-Service supports the implementation, operation and evidence of the agreed measures: policy upkeep, vulnerability management, training records, supplier reviews, incident readiness and — with SOC — monitoring and reporting capability designed to support your incident-notification process. Whether you are compliant remains a legal conclusion for you, your counsel and the authority.
Sources and last reviewed
- Directive (EU) 2022/2555 (NIS2) — eur-lex.europa.eu
- Regulation (EU) 2022/2554 (DORA) — eur-lex.europa.eu
- Italy: D.Lgs. 138/2024 and ACN timeline (MIMIT summary, October 2025) — mimit.gov.it; ACN — acn.gov.it
- Romania: OUG 155/2024 — legislatie.just.ro; DNSC implementing orders 2025 — legislatie.just.ro; DNSC — dnsc.ro
Last reviewed August 2026. This page explains the frameworks in plain language; it is not legal advice. National implementing acts and guidance continue to evolve and your counsel should confirm your specific obligations.