NIS 2 in Italy: Is Your Company Ready? The Cybersecurity Rules You Can't Ignore

Is your organization truly ready for NIS 2? Italy transposed the NIS 2 Directive through
Legislative Decree 138/2024 — but implementation is complex, obligations are strict, and
the criticalities are real.

In this episode of The Legal Break, Giulio Coraggio and the journalist Antonio Ravenna give a clear, practical breakdown of what NIS 2 means for companies operating in Italy today.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📌 KEY TOPICS COVERED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✔ NIS 2 Directive (EU 2022/2555) — what changed vs. NIS 1
✔ Italian transposition via Legislative Decree 138/2024
✔ 18 sectors in scope, including 11 "highly critical" sectors
✔ Essential vs. important entities: how to determine your category
✔ Registration obligations with ACN (Agenzia per la Cybersicurezza Nazionale)
✔ Technical and organizational security measures
✔ Incident notification timelines and requirements
✔ Supply chain and third-party vendor risk
✔ Management body accountability and personal liability
✔ Sanctions up to 0.1% of global turnover for essential entities
✔ Remaining open questions and compliance roadmap

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
👥 SPEAKERS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔹 Giulio Coraggio
   LinkedIn:   / giulio-coraggio 
   Blog: https://www.gamingtechlaw.com

🔹 Antonio Ravenna — Legal Journalist

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔗 USEFUL RESOURCES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 D.Lgs. 138/2024 (Official text): https://www.normattiva.it
🌐 ACN – Agenzia per la Cybersicurezza Nazionale: https://www.acn.gov.it
🌐 DLA Piper Technology & Data practice: https://www.dlapiper.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎙️ ABOUT THE LEGAL BREAK
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The Legal Break is DLA Piper's podcast series where legal experts decode the most relevant regulatory and legal developments for business — clearly, concisely, and without the jargon.

🔔 Subscribe so you never miss an episode.
👍 Like this video if you found it useful.
💬 Have a question about NIS 2 compliance? Drop it in the comments.

Send us Fan Mail

Episode Transcript

SPEAKER_01 (00:00):
Hello everyone, I'm Giulio Coraggio from GLPR.

(00:02):
And I'm Antonio Ravenna, ajournalist.
We're here to talk about theimplementation in Italy of NIST2
where we are at the moment.

SPEAKER_00 (00:10):
And we're gonna make it during the time of a coffee
break.
So, Giulio, let's talk about theimplementation of the NIST2
directive.
Where are we?

SPEAKER_01 (00:21):
Well, uh Antonio, it's kind of um interesting
where we are because it's one ofthe situations where Italy was
uh among the fastestimplementators of NIST II.
And even in this situation, itwas criticized because we were
much faster than France,Germany, all the big um
countries uh across Europebecause um the legislation came

(00:44):
into place more than a year ago,and then we already have um the
first year of registration withthe cybersecurity authority.
We have already in place uh theprovisions on the notification
of um incidents under NIST IIthat uh became applicable from
January of this year.

(01:04):
So companies, if they suffer anincident, already need to report
to ACN, the ItalianCybersecurity Authority, an
incident.
They already need to have inplace a policy in order to
assess incidents.
But then we have otherapproaching deadlines, and we
have uh the cybersecurityauthority that is generating so

(01:25):
much volume of documentation onobligations that need to be
fulfilled.

SPEAKER_00 (01:30):
So, what companies should do and should know
actually about the NIST 2implementation?

SPEAKER_01 (01:34):
Well, first of all, they need to understand whether
they are in and out, which uhafter a year seems a given, but
it's not because we still haveuh clients that um tell us, am I
within the perimeter of uh NIS2?
Then also the fact that uh Dorabecame applicable during the
same period, there are is lotsof confusion of what is covered

(01:56):
by Dora and what is left out andmight be covered by NIS2.
So, first of all, you need tounderstand whether you are
within the perimeter.
Secondly, you need to understandin relation to which services we
are within the perimeter NIST 2,and um, it's relevant that uh
the Italian CybersecurityAuthority required very recently

(02:17):
a categorization of servicesthat the company provides within
the NIST 2 perimeter.
So basically, it's not just aone-off exercise, then you need
to map all your services andunderstand what is covered by
each category of NIST 2services.
So it's a mapping exercise thatneeds to be done on a yearly

(02:39):
basis and it's reallytime-consuming because it
requires to analyze your actualoperations.

SPEAKER_00 (02:46):
So, Julio, you mentioned the dollar regulation.
So, once again, there's a lot ofstratification within Europe
regulations.
Do the digital omnibus actuallyhave any impact also in the NIST
2 directive?

SPEAKER_01 (02:57):
The provisions that have been agreed uh introduced
some minor changes.
There is an attempt by theEuropean Union to create some
kind of uh harmonization acrossNIST 2 as well, because uh what
we've been noticing over thelast months is that uh NIST II
is a directive and it was uhimplemented um quite differently

(03:18):
across the European Union.
The one-stop shop principleapplies uh in very limited
circumstances when there aredigital services, and then the
requirements and uh theguidelines from local
cybersecurity authorities areoften inconsistent.
So having a pan-Europeanapproach to NISTIL in some cases

(03:40):
is not feasible.
It requires to put on the grounddifferent documents, it requires
to give evidence to authoritiesin a different manner.

SPEAKER_00 (03:48):
So let's be practical as always.
I have a company, what should Ido?
I don't know, in the next threemonths.

SPEAKER_01 (03:54):
First of all, if you are not sure whether you are in
or out or in relation to whichservices you are in and out, you
need to do an institutionassessment exercise on your
services.
Secondly, if you reach theconclusion you are in, then you
need to understand whichservices are covered and then
put on the ground the policiesthat shouldn't be just some

(04:17):
additional paper, but theyshould be embedded in the actual
operations.
Let's bear in mind that NIST IIis one of the limited
legislation that in somecountries like Italy provides
for a direct liability of boardmembers, which is in line with
the DNA of the NIST 2 that wantsto create a higher level of

(04:41):
accountability of the topmanagement in relation to
cybersecurity compliance.

SPEAKER_00 (04:45):
Thank you, Giulio.
This was very clear and veryuseful as always.

SPEAKER_01 (04:49):
Thank you, Antonio.
I hope it helps.
Arrivedercies.