Compliance
All articles
ACN NIS Vademecum 2026: Compliance Calendar and Operational Checklist
ACN's NIS Vademecum 1.0 (September 2026) puts the NIS obligations on one calendar: six obligation families, three recurring annual windows and differ…
NIS Entity List Update: Late Registrations, Reviews and the 2027 Window
On 18 September 2026 ACN announced an update of the NIS entity list after more than 2,000 late registrations and about 2,000 reviews, and confirmed t…
The cloud and cybersecurity voucher and NIS 2 technical measures
Part of the technical measures common to NIS 2 alignment programmes falls within the eligible product and service types: perimeter protection, monito…
Cloud and cybersecurity voucher: disbursement, variations and controls
The grant is not paid in advance: it is disbursed against completion of the plan and its documentation. This guide covers the assessment deadline, th…
Cloud and cybersecurity voucher: who can apply, requirements and de minimis
Eligibility is set by article 4 of the ministerial decree of 18 July 2025 and must be met when the application is submitted. This guide sets out who …
Cloud and cybersecurity voucher: composing the spending plan
The spending plan determines the grant, the completion deadlines and what will have to be reported. This guide explains the 30% limit on macro-catego…
Cloud and cybersecurity voucher: how the application is submitted
The procedure has two phases three weeks apart. From 20 October 2026 the application is filled in, the PDF form generated, digitally signed and the p…
MIMIT cloud and cybersecurity voucher: guide to the measure
The measure supports demand for cloud computing and cyber security services from SMEs and self-employed workers with a non-repayable grant of 50% of …
Cybersecurity Audit: What It Is, How It Works, and How to Prepare
A cybersecurity audit checks whether security governance, controls, evidence and technical practices are suitable for the chosen framework. This guid…
Cybersecurity Frameworks Compared: NIST CSF, ISO 27001, NIS 2, ACN Baseline
NIST CSF, ISO/IEC 27001, NIS 2 and the ACN baseline solve different problems. This comparison explains which are voluntary, mandatory, certifiable, o…
EU AI Act: Cybersecurity Implications for Compliance Teams
Focused guide to the cybersecurity implications of the EU AI Act for compliance teams, including staged application dates, high-risk AI controls, and…
Cyber Resilience Act (CRA): Obligations for Software and Hardware Manufacturers
Explainer on the Cyber Resilience Act for software and hardware manufacturers: scope, application dates, reporting, vulnerability handling, conformit…
NIS 2 vs GDPR: Key Differences and Overlap for Italian Organizations
Comparison guide for Italian organizations: how NIS 2 and GDPR differ, where they overlap, and how to coordinate incident notification when personal …
NIS Activity and Service Categorization: ACN Publishes the 2026 Model
On 24 April 2026, ACN published Determination 155238 with the categorization model for NIS activities and services. The 2026 platform window runs fro…
Italian Cyber Security Perimeter (PSNC): Scope, Obligations, and NIS 2 Coordination
Guide to the Italian National Cyber Security Perimeter: scope, main obligations, incident notification, security measures, ICT supply controls, and c…
NIS Representative in Italy: When It Is Needed and How the Designation Works
The Italy-based NIS representative is a specific cross-border compliance mechanism for legal persons with no EU establishment that perform the inhere…
ACN NIS Platform: Activity and Service Categorization
Articles 20 and 21 of ACN Determinazione 127437/2026 define the procedural side of activity and service categorization on the NIS platform: window 1 …
ACN NIS Platform: Relevant Suppliers and What Organizations Must Submit
The ACN platform requires NIS subjects to submit a filtered list of 'relevant NIS suppliers' during the annual update window (15 April-31 May) - not …
ACN NIS Platform: Registration, Annual Update, and Continuous Update
The ACN NIS platform operates a recurring compliance cycle: registration (1 January-28 February), annual update (15 April-31 May), and continuous upd…
ACN NIS Platform Roles, Access, and User Association
The ACN platform determination defines a governed role model for NIS compliance: point of contact, substitute, CSIRT contact, segreteria, and operato…