Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [QUIET] · [TECHNOLOGY]

3 clusters · 8 sources · 29 days · First seen about 2 months ago · Last updated 22 days ago

EU NIS2 cybersecurity implementation

Overview

In late July 2026, Greece formally incorporated the EU’s NIS2 Directive into national law (Law 5160/2024), creating a broad framework that obliges entities in critical sectors—such as energy, transport, finance, health and public administration—to register with the National Cybersecurity Authority, adopt mandatory risk-management measures and integrate cybersecurity into overall business resilience.

A few days later, the European Union Agency for Cybersecurity (ENISA) released sector-specific procurement guidelines for hospitals, stressing the need to embed security requirements throughout the acquisition process. The guidance cited rising ransomware threats to healthcare, noting low levels of dedicated defence programs and staff awareness. In parallel, Italy’s National Cybersecurity Agency (ACN) updated its FAQ on NIS2, adding clarifications that board members of essential and important entities must approve and oversee cybersecurity measures, reflecting the directive’s governance requirements.

By late August 2026, Italy’s ACN expanded its enforcement strategy to focus on systemic ecosystem resilience and supply chain risks. Under Determination n. 127437/2026, organizations within the NIS2 perimeter must now provide a structured list of their ‘relevant NIS suppliers’ to help the ACN map interdependencies and identify critical nodes in the national supply chain. Furthermore, updated ACN guidance on monitoring, supervision, and enforcement (MVE) has shifted the regulatory focus toward the practical demonstration of compliance during oversight, rather than the mere formal adoption of security measures.

Entities

NIS2 Directive · Italian Government · European Union · Law 5160/2024 · Agenzia per la Cybersicurezza Nazionale (ACN)

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] ENISA released new guidelines for cybersecurity procurement in hospitals and health service providers.
[○ 1 SOURCE] The guidelines emphasize integrating cybersecurity throughout the supply chain and procurement lifecycle.
[○ 1 SOURCE] ENISA’s Threat Landscape 2024 reports the healthcare sector accounts for 8 % of ransomware incidents.
[○ 1 SOURCE] Only 27 % of healthcare organisations have a dedicated ransomware‑defence programme and 40 % lack staff security‑awareness training.
[○ 1 SOURCE] The Italian National Cybersecurity Agency (ACN) updated its FAQ on NIS2 responsibilities on 23 July 2026.
[○ 1 SOURCE] The updated FAQ adds three new clarifications (FAQ ODA 10, ODA 11, ODA 12).
[○ 1 SOURCE] NIS2 requires board members of essential and important entities to approve, supervise, and train on cybersecurity risk‑management measures.
[○ 1 SOURCE] Italy’s implementing decree (d.lgs. 138/2024) incorporates NIS2 governance responsibilities into national law.

Timeline

22 days ago

[TECHNOLOGY] 3 sources
Italy's ACN implements new NIS2 cybersecurity compliance measures
Italy's National Cybersecurity Agency is implementing NIS2 Directive measures, focusing on supply chain risk mapping and new guidelines for monitoring, supervision, and enforcement compliance.
about 2 months ago

[TECHNOLOGY] 4 sources
EU ENISA Issues New Hospital Cybersecurity Procurement Guidelines Under NIS2
ENISA rolled out new hospital procurement cybersecurity guidelines, noting healthcare's 8 % share of ransomware hits, while Italy’s ACN updated NIS2 FAQ clarifying board‑level security duties.
about 2 months ago

[TECHNOLOGY] 2 sources
Greece Adopts NIS2 Cybersecurity Directive, Raising Business Resilience Standards
Greece has enacted the EU NIS2 Directive via Law 5160/2024, broadening cyber‑security obligations for many sectors and mandating registration with the National Cybersecurity Authority.

Sources

banks.com.gr · campaniadih.it · cybersecitalia.it · dalealbo.cl · diritto.it · mononews.gr · protezionedatipersonali.it · vianova.it

This summary has been updated 2 times: see revision history