--- title: "NIS2 Baseline Obligations: Master Overview" description: "NIS2 baseline obligations master overview: governance, risk management, protection, detection, and response. Complete guide for GRC teams and compliance officers." canonical: https://www.aegister.com/en/cms/insights/nis2-baseline-obligations-master-overview/ url: /en/cms/insights/nis2-baseline-obligations-master-overview/ lang: en --- ![](/static/images/header-contact.webp) # NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations --- ![NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations](/static/images/cms/nis2-requisiti-di-base.webp) ## NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations January 24, 2026 [NIS2](/en/cms/keyword/nis2/) [October 2026](/en/cms/keyword/october-2026/) [ACN](/en/cms/keyword/acn/) [compliance](/en/cms/keyword/compliance/) +6 Italy’s NIS framework requires in-scope entities to implement baseline cybersecurity measures and incident obligations under a legal and technical model centered on Legislative Decree 138/2024 and ACN’s baseline determinations. Operationally, organizations need one integrated program that covers governance duties (Article 23), risk-management measures (Article 24), and incident notification (Article 25), with evidence that can be audited over time. ## Key takeaways - The NIS implementation model is built around Articles 23, 24, and 25 of Legislative Decree 138/2024. - ACN baseline specifications define practical measures and significant-incident categories. - ACN’s first-application timeline states 9 months (January 2026) for significant-incident notification obligations and 18 months (October 2026) for baseline security-measure adoption. - the first-application incident-notification obligation is already live, while the baseline-measure deadline remains October 2026. - Baseline controls are structured across governance and operational functions aligned with GOV/ID/PR/DE/RS/RC logic. - Execution requires one coordinated operating model across legal, cyber, IT, and management functions. ## Compliance architecture at a glance | Layer | What it defines | Why it matters | | --- | --- | --- | | Legislative Decree 138/2024 | Legal obligations and subject model | Determines mandatory duties and accountability | | ACN baseline determination | Baseline technical/organizational specifications | Translates legal duties into control expectations | | ACN operational guides | Implementation methods and evidence orientation | Supports practical rollout and audit readiness | ## What this series covers This series is designed to move from legal framing to implementation details: 1. legal architecture and role model, 2. governance and risk controls, 3. protection, detection, and response operations, 4. significant incident classification and reporting, 5. evidence, audit readiness, and continuous improvement. The goal is to make each obligation actionable with policy/process-level guidance. ## Baseline obligations map ### Governance and accountability Article 23 obligations and related baseline governance controls require explicit responsibilities, management oversight, and documented policy ownership. ### Risk management and protective controls Article 24 obligations require proportionate technical, operational, and organizational measures, including documented risk treatment and control coverage. ### Incident handling and notification Article 25 obligations require incident handling capability and notification execution for significant incidents under ACN baseline taxonomy and procedures. ## Program setup checklist for teams 1. Confirm governance ownership across legal, cyber, IT, and executive stakeholders. 2. Build a single control map from legal obligations to baseline requirements and evidence. 3. Formalize incident lifecycle procedures from detection to notification and post-incident learning. 4. Define audit-ready evidence sets and document update cadence. 5. Track milestone progress against the live incident-notification regime and the October 2026 baseline-measure deadline. ## FAQ ### Is this overview itself the full compliance standard? No. It is a structured operational summary. Binding obligations are defined in legislative and ACN official acts. ### Which subjects are targeted by this framework? The NIS framework distinguishes subjects and obligations in the legal text and subsequent ACN implementation material. Detailed scope classification must follow official criteria. ### What should be prioritized first in implementation? A governance-led control mapping and evidence strategy that integrates Articles 23, 24, and 25 with the ACN baseline specifications. ## Related reading - [NIS2 Article 23 in Practice: Obligations for Management and Governing Bodies](/en/cms/insights/nis2-article-23-governance-obligations/) - [NIS2 Article 24 in Practice: How to Implement Cybersecurity Risk-Management Measures](/en/cms/insights/nis2-article-24-risk-management-measures/) - [NIS2 Article 25 in Practice: Incident Notification Obligations and Operating Timeline](/en/cms/insights/nis2-article-25-incident-notification/) - [Aegister NIS2 Compliance Service](/en/solutions/compliance/nis2/) - [Free NIS2 Assessment](/en/assessment/) ## Official sources - [Gazzetta Ufficiale – Legislative Decree 138/2024](https://www.gazzettaufficiale.it/eli/id/2024/10/01/24G00155/SG) - [ACN – Baseline obligations determination](https://www.acn.gov.it/portale/documents/d/guest/detacn_obblighi_2511-v3_signed) - [ACN – Guide to reading baseline specifications](https://www.acn.gov.it/portale/documents/d/guest/guida-alla-lettura-specifiche-di-base) - [ACN – Incident management guidance](https://www.acn.gov.it/portale/documents/d/guest/acn_linee_guida_csirt) - [ACN – Allegato 1 (baseline measures)](https://www.acn.gov.it/portale/documents/d/guest/allegato-1-v2) - [ACN – Allegato 2 (baseline measures)](https://www.acn.gov.it/portale/documents/d/guest/allegato-2-v2) - [ACN – Allegato 3 (significant incidents)](https://www.acn.gov.it/portale/documents/d/guest/allegato-3-v2) - [ACN – Allegato 4 (significant incidents)](https://www.acn.gov.it/portale/documents/d/guest/allegato-4-v2) Share this post ## Related News [![NIS2 baseline deadline October 2026: 8-month implementation roadmap](/static/images/cms/nis2-piano-implementazione-18-mesi.webp)](/en/cms/insights/nis2-baseline-deadline-october-2026-implementation-roadmap/) [NIS2 baseline deadline October 2026: 8-month implementation roadmap](/en/cms/insights/nis2-baseline-deadline-october-2026-implementation-roadmap/) [With the NIS2 baseline adoption deadline set for October 2026, organizations have roughly 8 months left. This guide provides a compressed, phased roadmap with governance checkpoints and evidence milestones to reach compliance on time.](/en/cms/insights/nis2-baseline-deadline-october-2026-implementation-roadmap/) [NIS2](/en/cms/keyword/nis2/) [October 2026](/en/cms/keyword/october-2026/) +7 [![NIS2 KPIs and continuous improvement: operational metrics for resilient compliance](/static/images/cms/nis2-requisiti-di-base.webp)](/en/cms/insights/nis2-kpis-continuous-improvement/) [NIS2 KPIs and continuous improvement: operational metrics for resilient compliance](/en/cms/insights/nis2-kpis-continuous-improvement/) [ACN guidance frames improvement as a continuous phase across the full incident lifecycle. This guide provides a practical KPI framework, governance review model, and time-bound controls to track through the October 2026 baseline deadline.](/en/cms/insights/nis2-kpis-continuous-improvement/) [NIS2](/en/cms/keyword/nis2/) [October 2026](/en/cms/keyword/october-2026/) +7 [![Common NIS2 compliance mistakes: practical gaps that delay baseline readiness](/static/images/cms/nis2-requisiti-di-base.webp)](/en/cms/insights/nis2-common-compliance-mistakes/) [Common NIS2 compliance mistakes: practical gaps that delay baseline readiness](/en/cms/insights/nis2-common-compliance-mistakes/) [Most NIS2 delays are operational: missing evidence, unclear ownership, untested notification workflows, and late governance decisions. A practical guide to the most common mistakes and how to fix them before the October 2026 deadline.](/en/cms/insights/nis2-common-compliance-mistakes/) [NIS2](/en/cms/keyword/nis2/) [October 2026](/en/cms/keyword/october-2026/) +6 ### NIS 2 Compliance with Aegister Complete solutions for NIS 2 Directive compliance: expert consulting, implementation and ongoing support. [Discover](/en/solutions/compliance/nis2/)