7 Technical Requirements to Close Before October 2026

What Italian SMEs must have in place before ACN inspections begin — and the sequenced plan to get there in less than five months.

October 1, 2026 is not a discussion date. It is the enforcement deadline for NIS2 technical security measures in Italy. After that date, ACN — Agenzia per la Cybersicurezza Nazionale — will expect documentation, not intentions. Less than five months remain. Fines for important entities reach €7 million or 1.4% of annual global turnover. For essential entities, the ceiling rises to €10 million or 2%. The threshold for falling under the directive: 50 employees or turnover above €10 million. This is not a story about banks and telecoms. It is a story about your company.

What follows is a concrete breakdown of each technical obligation and a sequenced action plan, so that October finds you with a prepared infrastructure rather than a crisis.

Step 1. Determine Whether NIS2 Applies to You

Most Italian SMEs assume NIS2 targets large enterprises. The data says otherwise.

The directive applies when at least one of two criteria is met:

1. Your company has 50 or more employees
2. Your annual turnover exceeds €10 million

Note the logic: “or,” not “and.” A company with 30 employees and €12 million in turnover already qualifies.

Even below both thresholds, NIS2 can still reach you through supply chain obligations. If your client is classified as an essential or important entity, that client must ensure the security posture of its suppliers. Research from the Osservatorio Cybersecurity & Data Protection at Politecnico di Milano indicates that a significant share of Italian SMEs operate within critical supply chains — yet most of them do not recognize cyberattacks as a real operational risk.

A practical checklist:

• Verify your size thresholds (headcount, turnover)
• Identify your sector under the NIS2 classification (energy, transport, healthcare, digital infrastructure, manufacturing, postal services, and others — Annexes I and II of Legislative Decree 138/2024)
• Review contracts with major clients — if cybersecurity clauses have appeared in recent amendments, you are already within scope

If you have not yet registered on the ACN platform, that step should already be in place. The registration window each year runs from January 1 through February 28.

Step 2. Segment Your Network — Start With Architecture

Network segmentation is one of the core risk management measures under Article 24 of Legislative Decree 138/2024. The reason it ranks so high: you cannot solve it by installing a single product. It demands architectural change.

The principle is straightforward. Your network can no longer be an open space where every device reaches every system. You must divide it into risk-based zones and restrict inter-zone traffic to what is strictly necessary.

A common mistake looks like this: a company deploys MFA, buys a next-generation antivirus, and considers the job done. The network remains flat. An attacker who compromises one workstation through a phishing email gains lateral access to every server, every database, every backup.

The scale of the problem comes through in the Clusit 2026 report: 84% of incidents in 2025 were classified as Critical or High severity, and attacks targeting Italy grew 42% year over year (507 serious incidents versus 357 the prior year). A flat network turns each of those incidents into a catastrophe. Basic segmentation contains the damage automatically by limiting lateral movement.

A minimum segmentation scheme for an SME:

• DMZ — web servers, mail gateways, public-facing services
• Server zone — databases, ERP, file servers
• User zone — employee workstations
• Privileged access zone — administrative interfaces, infrastructure management consoles

Between every zone, firewall rules permit only documented traffic. Everything else is denied by default.

Given the remaining timeline, a network architecture audit should launch within weeks. Defining zones and rules takes two to three months. Migration takes another two to three. That is exactly the runway you have before October. The clock is already running.

Step 3. Incident Monitoring and the Three-Stage Reporting Obligation

NIS2 imposes a strict incident reporting regime. Since January 1, 2026, essential and important entities have been required to notify CSIRT Italia of significant cybersecurity incidents. Three stages, three deadlines:

1. Early warning — within 24 hours of detecting a significant incident
2. Detailed notification — within 72 hours
3. Final report — no later than one month

The 24-hour clock starts at detection, not at resolution. You cannot “figure it out first” and then report. This means you need a system that identifies incidents in real time.

The threat landscape makes this even more pressing. According to Clusit data for the first half of 2025, Italy absorbed 10.2% of the world’s serious cyberattacks. Attacks on the government and military sector surged 600% year over year. Manufacturing ranked as the third most targeted sector. DDoS attacks continue to dominate by volume, but ransomware remains the most destructive threat in terms of financial damage.

The minimum technical stack:

• IDS/IPS systems deployed on key network segments
• A SIEM or cloud-based logging platform for event correlation
• A designated response team with pre-established CSIRT Italia contacts
• A documented runbook: who calls whom, in what sequence

A typical mistake is relying on antivirus as a monitoring system. Antivirus blocks known signatures. It does not detect anomalous behavior — lateral movement, unusual database queries, large data exfiltration outside business hours.

Do not wait for an incident. Build the reporting process and assign responsible individuals now. If you lack an internal SOC, consider outsourced monitoring. It costs less than a single fine for late reporting.

Step 4. Vulnerability Management — 48 Hours for a Critical Patch

Vulnerability management under NIS2 is not a monthly “Patch Tuesday.” The directive itself does not prescribe exact hours, but the industry standard increasingly embedded in contracts with large EU clients — and reflected in ACN expectations — is clear: critical patches applied within 48 hours of the vendor publishing a fix.

A crucial nuance: the countdown starts when the vendor publishes the patch, not when your IT manager learns about it. The difference matters. If a vendor releases a fix on Monday morning and your team sees the advisory on Wednesday, you have already missed the window.

Attacks on SMEs account for a significant share of global incidents, yet by various industry estimates, fewer than 20% of Italian SMEs conduct regular vulnerability assessments. The gap is obvious.

A minimum process:

• Subscribe to security advisories for every critical infrastructure component (servers, network equipment, software)
• Run automated vulnerability scans at least weekly
• Define patching windows: critical — 48 hours, high — 7 days, medium — 30 days
• Test patches before deployment (yes, even within the 48-hour window — use a staging environment)

Contracts drafted in 2026 already encode a new norm: remediation of critical vulnerabilities within defined timelines, maintenance of security certifications, and the client’s right to periodic audits. If you are a supplier, these requirements will soon appear in your contracts too.

A common mistake is postponing patching out of fear of service disruption. Compromise through a known vulnerability causes downtime orders of magnitude longer than a planned maintenance window.

Implement automated scanning and define your patching windows now.

Step 5. MFA, Encryption, and Access Control

Three mandatory technical measures against which ACN will audit your documentation:

• MFA (multi-factor authentication) or continuous authentication for all privileged and remote access
• Encryption of confidential data, both at rest and in transit
• IDS/IPS and, where feasible, integration with a 24/7 SOC

The vast majority of Italian SMEs still lack a structured cybersecurity approach. For many companies, even basic MFA remains aspirational rather than operational.

The minimum technical stack:

• MFA via a corporate IdP (Azure AD, Google Workspace, or a dedicated solution)
• Disk encryption on servers and workstations (BitLocker for Windows, LUKS for Linux)
• TLS for all web services and internal APIs
• VPN with mandatory MFA for remote access

A typical mistake: enabling MFA only for VPN while leaving local administrative accounts without a second factor. An attacker who gains physical access or compromises a workstation bypasses the entire defense through a local admin account.

Enable MFA for all administrative and remote access points within the next month. It is the fastest mandatory measure to implement — and it delivers an immediate reduction in risk.

Step 6. Supply Chain Security and Contractual Clauses

NIS2 makes you accountable beyond your own infrastructure. The security of your suppliers — cloud providers, MSPs, contractors — falls within your zone of responsibility.

The readiness gap between large enterprises and SMEs is substantial. Large Italian companies are aggressively revising their security posture in response to geopolitical and regulatory pressures. Among SMEs, the process moves more slowly and remains fragmented.

Minimum contractual clauses to have in place before an inspection:

• Pre-contract security assessment of each supplier
• Supplier obligation to report incidents affecting your services within 24 hours
• Your right to periodic security audits of the supplier
• Requirement to maintain security certifications (ISO 27001 or equivalent)
• Ongoing supplier security monitoring, not a one-time check

Compile a list of all critical suppliers and schedule contract revisions over the next two to three months. Contractual clauses must be in place before any inspection — ACN evaluates processes, not just technical controls.

Step 7. Backup Policy and Recovery Testing

“We have a backup on a NAS” is not a backup policy. Ransomware encrypts production data and backup copies alike when those copies are network-accessible. The “backup next to the server” model no longer works.

NIS2 backup requirements:

• The 3–2–1 model: 3 copies of data, 2 media types, 1 copy off-site
• Extended to 3–2–1–1–0: add an immutable copy and automated integrity verification (zero errors on verification)
• Defined RTO (Recovery Time Objective) and RPO (Recovery Point Objective) for all critical data
• Daily or near-instant backups for critical services; weekly or monthly for archival data

The cost of an adequate backup system is a fraction of the average ransomware incident cost reported across industry surveys.

A typical mistake: performing backups but never testing recovery. A company discovers that a copy is corrupted, or that the restoration process takes 72 hours instead of the expected 4, only after an incident has already struck.

Run a recovery test from backup within the next 30 days. It is the only way to learn your company’s real RTO and RPO.

What to Prioritize First

Less than five months remain before October 1, 2026. That is too little time for a chaotic attempt to do everything at once. It is enough for a sequenced plan — provided you start now.

May–June: Audit current state. Enable MFA for all privileged access. Define the incident reporting process and establish CSIRT Italia contacts. Run a first backup recovery test.

June–July: Design network segmentation. Revise supplier contracts. Deploy automated vulnerability scanning.

July–September: Execute segmentation migration. Implement vulnerability management with defined patching windows. Encrypt data at rest and in transit. Finalize contractual clauses with suppliers.

September–October: Final testing. Prepare ACN documentation. Rehearse incident response procedures.

One fact worth keeping in mind: Italy, representing a small fraction of global GDP, accounts for roughly 10% of the world’s serious cyberattacks. The cause is not the size of the economy. It is structural vulnerability — low cybersecurity investment, a fragmented SME landscape, a high proportion of systems running without a minimum level of protection. NIS2 is not a bureaucratic burden. It is the minimum security baseline that the Italian SME sector should already have had in place.

Security culture is not a budget question. It is a priority question. Before October 1, 2026, you will either have set those priorities — or you will have a paper trail showing that you did not.

If implementing all NIS2 technical measures simultaneously would overwhelm your IT department, reach out to SESINF. We design IT infrastructure with security built in at the architectural level — from the initial audit through to full directive compliance.