In brief
For entities added to the list in 2026, the baseline security measures must be adopted by 31 July 2027 and notification of significant incidents is mandatory from 1 January 2027. Before that, by 31 December 2026, the CSIRT contact must be designated. The measures and the incidents are those already defined by ACN Determination 379907/2025, which remains the technical reference.
The dates
| When | What | Source |
|---|---|---|
| By 31 December 2026 | Designation of the CSIRT contact on the ACN platform (by 31 December of the year of inclusion) | ACN Det. 127437/2026 |
| From 1 January 2027 | Notification of significant incidents to CSIRT Italia (Annexes 3 and 4 of Det. 379907/2025): early warning within 24 hours, notification within 72 hours, final report within one month | ACN Det. 127434/2026, Art. 1; Legislative Decree 138/2024, Art. 25 |
| By 31 July 2027 | Baseline security measures (Annexes 1 and 2 of Det. 379907/2025) | ACN Det. 127434/2026, Art. 1 |
| From 1 May to 30 June each year | List of activities and services with their relevance category, on the ACN platform | ACN Det. 127437/2026 |
For those already on the list in 2025, the deadlines remain those of Det. 379907/2025: 9 months from the notice of inclusion for notification and 18 months for the measures, so in many cases already passed.
The baseline security measures
They are those of Annexes 1 and 2 of Determination 379907/2025, the first for important entities and the second for essential entities. They cover governance and roles, risk management, suppliers, asset management, vulnerabilities, business continuity, access control, training, incident management and notification. Writing the policies is not enough: an inspection requires evidence that the measures are applied.
Management bodies approve the arrangements for implementing the measures, oversee their application and are liable for infringements; their members must follow training on cybersecurity (Art. 23 of Legislative Decree 138/2024).
Notification from 1 January 2027
It is the obligation that comes first, and the one that cannot be improvised. From day one you need to know who detects an incident, who classifies it according to the criteria of Det. 379907/2025, who decides on notification and who sends it to CSIRT Italia within 24 hours. The CSIRT contact designated by the end of the year is the person who maintains relations with CSIRT Italia.
What to do now, in order
- November–December 2026: designate the CSIRT contact, write the incident management and notification procedure and test it with an exercise.
- December 2026: gap analysis against the baseline measures of the applicable annex (important or essential), with an inventory of assets, services and suppliers.
- January 2027: compliance plan with priorities, owners and deadlines, approved by the management bodies, and training of the management bodies.
- February–June 2027: implementation of the measures and collection of evidence; in the May–June window, categorisation of activities and services on the ACN platform.
- July 2027: final check of the measures and evidence before 31 July.
How we can help you
We support NIS2 compliance with Prometeo: checklist of the ACN measures filled in by the client, inventory of assets, services and suppliers, incident management with the notification deadlines, resolutions of the management bodies and deadline schedule. For notification we prepare the procedure and test it with a War Room exercise.
The NIS2 service →Sources
Legislative Decree 138/2024, Articles 23, 24 and 25; ACN Determination no. 379907 of 19 December 2025; ACN Determination no. 127434 of 13 April 2026 (signed text), applicable from 30 April 2026; ACN Determination no. 127437 of 13 April 2026, as summarised by CMS and Advant Nctm (April 2026). Sources consulted on 3 November 2026. This article is for information only: the dates apply to entities added to the list for the first time in 2026 and should be checked against the notice received from ACN.