Bitwire Home

NIS2 · D.Lgs. 138/2024

NIS2 compliance with the technical work included

We check whether NIS2 applies to you, compare your company with the ACN baseline measures and then fix the gaps: MFA, backups, incident procedures, supplier checks. You end up with documents that describe controls that actually exist.

Book a free auditCall +39 0423 432770
Gap assessment
2 to 3 weeks
Areas covered
All 10 in Art. 21
For
In-scope firms and suppliers

The tools we use

  • SentinelOne

    Detection and response

  • Palo Alto Networks

    Segmentation, logging

  • Microsoft Entra ID

    Identity, MFA

  • Bitwarden

    Credentials

  • Proxmox Backup Server

    Offsite, immutable backup

  • Defense Grid

    Our IP blocklist

The technical controls behind the paperwork. Most of them also count as evidence for ISO 27001 and customer audits.

The problem

NIS2 is reaching companies that never expected it

Italy transposed the NIS2 directive with Legislative Decree 138/2024, in force since 16 October 2024. It covers many more sectors than the old NIS rules, including manufacturing of machinery, electronics, vehicles, food, chemicals, waste management and logistics. Companies in scope registered on the ACN portal and must now apply security measures and report significant incidents.

Smaller companies are not off the hook. In-scope companies must check the security of their suppliers, so a 30-person subcontractor in Veneto may receive the same questionnaire as a large plant. Answering it honestly needs the controls to be in place.

  • Significant incidents must be reported to the CSIRT Italia: early warning within 24 hours, notification within 72 hours
  • Management must approve the security measures and can be held personally responsible
  • Fines reach €10 million or 2% of turnover for essential entities, €7 million or 1.4% for important ones
  • Supplier questionnaires are arriving at companies well below the size thresholds

What a NIS2 engagement includes

We are engineers, so the focus is on controls that work. For legal opinions we work alongside your lawyer or consultant.

Scope check

Sector, size and role in the supply chain: whether you are an essential or important entity, or affected as a supplier.

Gap assessment

Your current state against the ACN baseline measures, area by area, with evidence and a score you can track.

Remediation plan

A prioritised list with effort and cost for each item, so management can approve it with real numbers.

Technical fixes

MFA, EDR, backups, logging, network segmentation, vulnerability management. Done by us, not delegated.

Incident procedure

Who decides, who calls whom, what goes to the CSIRT within 24 and 72 hours. Rehearsed once with your team.

Board and staff training

A short session for management on their obligations, and phishing training for staff.

How we work

From uncertainty to a plan you can defend

Most companies can complete the assessment in two to three weeks with a few hours of their staff's time.

  1. 011 call

    Scope check

    One call and a short questionnaire. You learn whether NIS2 applies directly, indirectly or not at all.

  2. 021 week

    Evidence collection

    We look at systems and existing documents and interview the people who run them. No hundred-page forms.

  3. 031–2 weeks

    Gap report

    Area-by-area findings, a risk rating and a remediation plan with costs. Written to be read by management.

  4. 041–6 months

    Remediation

    We implement the technical measures and draft the policies and procedures together with you.

  5. 05yearly

    Keep it current

    Yearly review, ACN portal updates, supplier questionnaires answered with evidence.

What you receive

A gap assessment you can hand to your board and your customers

Starting point

A short scope opinion: in scope directly, as a supplier, or not at all, with the reasoning written down.

What we did

Findings for each of the ten areas of Article 21, each with evidence, risk and the specific change needed.

Result

A costed remediation plan and a summary you can use to answer customer questionnaires.

10
Areas of measures assessed
24 h
Early warning to the CSIRT
72 h
Full incident notification
1 month
Final incident report

Guide

NIS2 in Italy: what SMBs need to know

Who is in scope

As a rule, NIS2 applies to medium and large companies (from 50 employees or €10 million turnover and balance sheet) in the sectors listed in Annexes I and II of the decree. Some entities are in scope regardless of size, such as DNS providers or sole providers of an essential service. Being below the thresholds does not mean being unaffected: if your customers are in scope, they will pass requirements down to you by contract.

The ten areas of security measures

Article 21 of the directive, taken over by the Italian decree and detailed by ACN, groups the measures into ten areas:

  • Risk analysis and information security policies
  • Incident handling
  • Business continuity, backup and crisis management
  • Supply chain security
  • Security in acquisition, development and maintenance of systems
  • Assessing whether the measures work
  • Cyber hygiene and training
  • Cryptography and encryption
  • Personnel security, access control and asset management
  • Multi-factor authentication and secure communications

Deadlines

Deadlines run from the date ACN notified you of your inclusion in the list of NIS entities, so check the notice on the ACN portal. For most companies notified in 2025, incident reporting is already mandatory and the baseline security measures fall due during 2026. If you are not sure where you stand, the scope check is the first step and it is free.

FAQ

Questions we get most often

We have fewer than 50 employees. Does NIS2 concern us?

Usually not directly, unless you are in one of the special categories. But if you supply an in-scope company, expect security questionnaires and contract clauses. Many of our clients start there.

Are you lawyers?

No. We are engineers and we deliver the technical measures and the evidence. For the legal interpretation of borderline cases we work with your lawyer or consultant.

How much does a gap assessment cost?

It is a fixed price that depends on the number of sites and systems, agreed after the free scope check. The remediation is quoted separately, item by item.

Is ISO 27001 the same as NIS2 compliance?

They overlap a lot and ISO 27001 is a good framework to show compliance, but certification is not required by NIS2 and does not cover everything automatically, such as incident reporting to the CSIRT.

What counts as a significant incident?

Roughly, one that causes or can cause serious disruption of your service or financial loss, or affects others. ACN has published criteria; we include them in your incident procedure so the decision is quick.

Can you answer our customer's NIS2 questionnaire?

We can help you answer it with evidence, and fix what is missing first so the answers are true.

Free first call

Tell us what is not working

An engineer replies, not a sales rep, within one working day. The first on-site visit is free too, anywhere in the provinces of Treviso, Padua and Vicenza.

Via Alberon 19/F, 31030 Castello di Godego (TV), Italy

Write to us

We use these details only to answer you. See the privacy policy.

Related services

Most clients start with one service and add the others when they need them.

All services

Cybersecurity

SentinelOne on every device, a properly configured firewall and backups that restore.

Learn more

Managed IT

Monitoring, patching, backups and a helpdesk that answers, on a fixed monthly fee.

Learn more

Modernisation

An audit, a roadmap you can afford and a migration that does not stop the business.

Learn more