EU NIS2 Directive enters implementation phase across Europe

The European Union's NIS2 Directive has entered its implementation phase, shifting the focus toward practical compliance and organizational resilience. The regulation requires companies to move beyond viewing cybersecurity as a purely technical IT task, instead treating it as a core governance and management responsibility.

Key requirements include implementing documented technical and organizational measures such as risk analysis, incident response, business continuity, and access control. Organizations must also manage supply chain risks by assessing and contractually securing security requirements with providers. A critical component of the directive is the mandatory incident reporting timeline: an initial notification within 24 hours, a follow-up within 72 hours, and a final report within one month.

In Italy, the National Cybersecurity Agency (ACN) is engaging with stakeholders to address practical questions regarding upcoming deadlines and obligations. The directive emphasizes that management must actively oversee risk management measures and participate in regular training to ensure organizational-wide compliance.