As of April 14, the NIS2 program officially entered phase two.
This involves carrying out a number of activities within specific deadlines, and penalties for companies not yet registered with the ACN portal.
So companies need to rely on a technology partner such as Eurosystem to follow them through every procedure for NIS2, from registration to the ACN portal to adjustments in the years to follow.
In this article we will explain:
- What to do after enrolling in the NIS2 portal.
- What are the official deadlines, including that of July 31, 2025
- The concrete risks for those who are non-compliant
- Because the directive also involves suppliers and partners
- How Eurosystem can support you throughout the adjustment journey
NIS2 deadlines: obligations to be met by July 31, 2025
Pursuant to the Legislative Decree. 138/2024, the essential and important entities identified in the regulations must Register with the ACN portal by July 31, 2025
By this date it is mandatory to transmit and update:
- Public IP Addressing and Owned Internet Domains.
- List of member states where they provide services.
- Responsibilities Art.38 paragraph 5.
- Contact substitute.
- Corporate offices in Italy and EU o NIS2 EU contact person
NIS2 compliance: the next 18 months (GV.PO-01)
Many people think that NIS2 ends with formal communication. In reality, the European directive requires comprehensive risk management through documentable processes, policies and controls.
Key cybersecurity policies to be carried out in the next 18 months include:
- Risk management.
- Supply chain cybersecurity risk management.
- Vulnerability management.
- Staff training and awareness.
- Incident response and recovery
All these activities need to be tracked, audited and reviewed over time. This requires dedicated NIS2 consulting done by up-to-date experts.
NIS2 also applies to those who are not directly subject: watch out for the supply chain.
Not only “essential” or “important” organizations: NIS2 also has indirect but concrete effects on those who provide technology, services or infrastructure to obligated entities.
Example of a company involved as a supplier:
A logistics company that manages transportation and warehousing for a national energy operator (classified as a key player by NIS2) may be required to provide assurance on the security of its IT infrastructure and freight tracking systems. Although the logistics company is not directly subject to the directive, it is in fact within the client’s risk perimeter and must therefore take documented cybersecurity measures.
These companies may receive requests for security audits or demonstration of their cyber posture in order not to be excluded from strategic contracts. In the uncertainty due to regulatory updates, companies may find Eurosystem to be the ideal partner for consulting on NIS2.
The real risks for those who stop at enrollment alone
For companies that do not rely on expert consultants, leaving out the NIS2 compliance path exposes them to significant risks, including:
- Administrative penalties (up to 10 million euros or 2% of annual turnover)
- Negative audits from ACN or clients
- Loss of contracts with obligated public or private entities
- Reputational damage in cyber incidents
- Exclusion from European calls, tenders and funds
In addition, in the event of a breach or data breach, the absence of preventive measures can also result in direct liability for top management.
How Eurosystem helps you comply with NIS2
Eurosystem, among the few companies within the CYBER 4.0 competence center, supports you every step of the way on the NIS2 regulation journey, from ACN portal registration to consulting on the directive’s obligations. With experienced certified technicians and a proprietary SOC, we provide companies with comprehensive cybersecurity services and solutions with a Zero Trust approach. We start with asset mapping and attack surface analysis (ASA) to identify vulnerabilities and critical areas.
We continue with technical testing of IT/OT systems, certified training courses for staff, and support in drafting documentation required for audits and controls.
With one partner, you simplify compliance and ensure continuity and security for your organization.
Do you need support for NIS2 compliance? Talk to us.
Fill out the contact form to be contacted by one of our experts:
we will help you build a customized roadmap that meets the requirements of the directive.