NIS2 Assessment & Roadmap
Gap analysis and roadmap for NIS2 compliance. Check the security measures required by ACN and get ready for inspections.
At a glance
NIS2 is the European cybersecurity law, in force in Italy since 2024. From 31 October 2026 the Italian National Cybersecurity Agency (ACN) can inspect companies and impose fines. We help you understand whether you are in scope, what you are missing, and how to comply.
Want to know more?
We analyze your current situation against NIS2 requirements. We deliver a report that explains what you need to do, in what order, and with estimated timelines and costs. We also support you in preparing the documentation required by the regulation.
Why choose this service
Avoid fines
NIS2 fines of up to 10 million euros or 2% of turnover for essential entities, up to 7 million euros or 1.4% for important entities. The assessment lets you identify and close gaps before an inspection.
Clear roadmap
Not a generic report, but a concrete action plan with priorities, timelines, and estimated budgets.
Competitive advantage
NIS2 compliance becomes a business asset: show your clients and partners that you are a reliable supplier.
What is the NIS2 Directive?
The NIS2 Directive (Network and Information Security 2) is the European cybersecurity framework. Italy transposed it with Legislative Decree 138/2024, in force since 16 October 2024, and the competent authority is the National Cybersecurity Agency (ACN).
Compared to the previous NIS, NIS2:
- Expands the scope to more sectors and company sizes
- Increases penalties: up to 10 million euros or 2% of turnover for essential entities, up to 7 million euros or 1.4% for important entities
- Holds management accountable with personal obligations for executives
- Includes the supply chain, making compliance a requirement for working with in-scope companies
Where things stand in Italy
- Incident reporting: mandatory since 15 January 2026 for entities registered in 2025. Early warning to CSIRT Italia within 24 hours, notification within 72 hours, final report within 30 days.
- Baseline security measures: entities registered in 2025 must adopt them by 31 October 2026 (87 requirements for important entities, 116 for essential ones). This date marks the start of the ACN inspection phase.
- Entities registered in 2026: incident reporting from 1 January 2027, security measures by 31 July 2027.
- Annual obligations: registration or update on the ACN portal (1 January - 28 February), information update (15 April - 31 May), categorisation of activities and services (1 May - 30 June).
NIS2 is not a one-off deadline: it is an ongoing process, with yearly obligations and checks by the authority.
Who is subject to NIS2?
Companies operating in critical sectors are subject to NIS2:
- Energy, transport, banking, healthcare
- Digital infrastructure and ICT
- Public administration
- Food production, chemicals, manufacturing
- Postal services, waste management
And that reach certain size thresholds:
- Medium enterprises: at least 50 employees, or turnover and balance sheet total above 10 million euros
- Large enterprises: at least 250 employees, or turnover above 50 million euros and balance sheet total above 43 million euros
Some entities are in scope regardless of size, for example DNS service providers, top-level domain registries and public administrations.
Important: even if your company is not directly in scope, you may be involved as a supplier to a company that is.
Our approach
Scoping
Interviews with management and IT, business perimeter analysis, NIS2 applicability verification, stakeholder identification.
Gap Analysis
Assessment against all NIS2 requirements, review of existing policies and procedures, evaluation of technical measures, critical supply chain mapping.
Roadmap
Detailed report with identified gaps, prioritized remediation plan, estimated timelines and budget, immediate quick wins.
Support (optional)
Implementation of measures, staff training, periodic audits, incident response support.
Deliverables
At the end of the assessment you will receive:
- Executive Summary for management
- Detailed technical report with all identified gaps
- Compliance matrix showing current status vs. NIS2 requirements
- Compliance roadmap with priorities, timelines, and estimated costs
- Document templates (policies, procedures, registers)
Why Ekados
- Experience: 18+ years in IT security
- Pragmatic approach: concrete solutions, not just theory
- Certified team: expertise in ISO 27001, NIST, CIS standards
- Ongoing support: we don’t leave you on your own after the assessment
Other services Cybersecurity & NIS2
Discover our other cybersecurity & nis2 services.
Vulnerability Assessment & Penetration Test
Infrastructure scanning and intrusion testing to identify vulnerabilities before attackers do.
Managed Detection & Response (MDR)
24/7 monitoring of your infrastructure with immediate incident response. Your outsourced SOC.
vCISO - CISO as a Service
A dedicated information security officer for your company, without the costs of a full-time hire.
Security Awareness Training
Anti-phishing training for your employees. 90% of attacks start with an email.
GDPR Compliance
Assessment, alignment, and maintenance of GDPR compliance. Personal data protection, DPO as a Service, and privacy training.
ISO 27001 - Information Security Management System
ISO 27001 implementation and certification. Build an internationally recognized Information Security Management System (ISMS).
ISO 22301 - Business Continuity Management
ISO 22301 implementation and certification. Ensure your company's operational continuity in case of incidents, disasters, or crises.
Ready to get started?
Contact us for a free consultation. We will help you find the best solution for your business.