The baseline security measures are what the NIS 2 risk management obligations mean in practice for essential and important entities in Italy. They are set by ACN Determination 379907/2025 of the Italian National Cybersecurity Agency (ACN), which applies from 15 January 2026 and replaces Determination 164179/2025. This guide explains what the four annexes contain, how many measures apply to each category of entity and when the eighteen months to adopt them start.
In brief
- ACN Determination 379907/2025 sets the baseline specifications for the obligations of articles 23, 24, 25, 29 and 32 of Legislative Decree 138/2024 (D.Lgs. 138/2024). It applies from 15 January 2026 and replaces 164179/2025 (art. 9).
- There are 37 baseline security measures for important entities (Annex 1) and 43 for essential entities (Annex 2). Annexes 3 and 4 describe the baseline significant incidents to notify.
- The deadline is eighteen months for the measures and nine months for incident notification, counted from receipt of the communication of inclusion in the list of NIS entities (art. 3). For those who received it on 12 and 13 April 2025, ACN indicates October 2026.
- Entities first included in the list in 2026 adopt the measures by 31 July 2027 and notify incidents from 1 January 2027 (ACN Determination 127434/2026).
- Each measure has a code and a description taken from the Italian National Framework for Cybersecurity and Data Protection, 2025 edition, and one or more requirements. The measures cover six functions: govern, identify, protect, detect, respond and recover.
- Six measures apply to essential entities only: ID.AM-03, PR.AT-02, PR.IR-03, PR.PS-01, PR.PS-03 and RC.CO-03.
ACN Determination 379907/2025 and its four annexes
The determination is adopted under article 40, paragraph 5, letter l) and article 42, paragraph 1, letter c) of D.Lgs. 138/2024. For the first application phase, the latter sets nine months for incident notification and eighteen months for the obligations of articles 23, 24 and 29, and allows ACN to set baseline procedures and specifications. Hence the name: according to ACN, "baseline" refers to the measures NIS entities adopt in the first application phase of the decree (FAQ MSB.4).
Article 2 of the determination splits the specifications into four annexes:
| Annex | Content | Applies to |
|---|---|---|
| Annex 1 | Baseline security measures: 37 measures | Important entities |
| Annex 2 | Baseline security measures: 43 measures | Essential entities |
| Annex 3 | Baseline significant incidents | Important entities |
| Annex 4 | Baseline significant incidents | Essential entities |
The measures turn the obligations of the management bodies (art. 23) and the risk management obligations (art. 24) into requirements: many requirements ask for a policy, a plan or an assessment to be approved by the management bodies. The reading guide maps each measure to the minimum elements listed in article 24, paragraph 2 (appendix A); the obligations of that article are explained in our guide to NIS 2 article 24 and the risk management measures.
The determination also defines relevant network and information systems: those whose compromise would have a significant impact on the confidentiality, integrity and availability of the activities and services for which the entity falls within NIS (art. 1, letter l)). Many requirements apply "at least" to these systems, and the first measure of the annex, GV.OC-04, asks for an up-to-date list of them.
Two special regimes complete the picture. Top-level domain name registries and domain name registration service providers also have eighteen months for the obligations of article 29 of the decree (art. 4). Former operators of essential services (OSE) and telecom operators meanwhile keep, on the systems concerned, the measures already adopted under the previous rules (arts. 5 and 6).
The ACN page on baseline procedures and specifications also publishes Annexes 1 and 2 in xlsx format, together with two guidelines: the reading guide to the baseline specifications and the guidelines for defining the incident management process (both in Italian).
Deadlines: 18 months for the measures, 9 months for notifications
Article 3 of the determination sets two deadlines, both counted from receipt of the communication of inclusion in the list of NIS entities: eighteen months to adopt the measures of Annexes 1 and 2, nine months to notify the significant incidents of Annexes 3 and 4. The communication is the one provided for by article 7, paragraph 3, letter a) of the decree (art. 1, letter h)). The deadlines published by ACN, as of 12 October 2026, are these:
| Entities | Baseline security measures | Significant incident notification | Source |
|---|---|---|---|
| Included with the communications of 12 and 13 April 2025 | Eighteen months from the communication: ACN indicates October 2026 | Nine months from the communication: ACN indicates January 2026 | ACN Det. 379907/2025, art. 3; ACN page on the baseline specifications; FAQ ELN.1 |
| Included later in 2025 | Eighteen months from their own communication | Nine months from their own communication | ACN Det. 379907/2025, art. 3; FAQ MSB.3 |
| First included in 2026 | By 31 July 2027 | From 1 January 2027 | ACN Det. 127434/2026, art. 1, paragraphs 1 and 2 |
October 2026 is the month ACN indicates for those who received the communication on 12 and 13 April 2025. The legal deadline remains eighteen months from receipt, so it is worth retrieving the date the communication reached your certified email address. Entities included in 2025 that remain in the 2026 list keep the deadlines of Determination 379907 (ACN Det. 127434/2026, art. 1, paragraph 3). For entities that joined in 2026, we have gathered deadlines and steps in our article on deadlines for new NIS entities in 2026, and the work phases towards the deadline in the baseline measures implementation roadmap. What to notify and when is covered in the guide to article 25 and incident notification.
How the measures are organised
The measures are developed in line with the Italian National Framework for Cybersecurity and Data Protection, 2025 edition, produced by Sapienza University of Rome and the Italian National Interuniversity Consortium for Informatics (CINI) in collaboration with ACN. They are organised into functions, categories, subcategories and requirements (art. 1, letter j)):
- Function: one of the six areas of the framework, for example GV (govern).
- Category: a group of outcomes within the function, for example GV.PO (policy).
- Measure: a code and a description taken from a subcategory of the framework, for example GV.PO-01. The code has the form XX.YY-NN: function, category, subcategory (reading guide, section 2.1).
- Requirements: the numbered points under each measure, stating what is required to implement it.
Compliance work is measured against the requirements, not against the titles of the measures. Two examples from Annex 1 show the level of detail.
GV.PO-01: security policies
The first requirement of measure GV.PO-01 (Annex 1, point 1.4.1) asks for documented information security policies covering at least the following areas (our translation):
- risk management;
- roles and responsibilities;
- reliability of human resources;
- compliance and security audit;
- supply chain information security risk management;
- asset management;
- vulnerability management;
- business continuity, disaster recovery and cyber crisis management;
- management of authentication, digital identities and access control;
- physical security;
- staff training and awareness;
- data security;
- development, configuration, maintenance and decommissioning of network and information systems;
- protection of networks and communications;
- security event monitoring;
- incident response and recovery.
The other two requirements specify that the policies cover at least the requirements listed in table 1 of the annex's appendix, and that they are approved by the management bodies and shared with the relevant units on a need-to-know basis. The next measure, GV.PO-02, asks for them to be reviewed at least once a year.
GV.RR-02: the security organisation
Measure GV.RR-02 asks for four things: an information security organisation defined and approved by the management bodies; an up-to-date list of staff with specific roles; the inclusion in this organisation of the point of contact and their substitute, the CSIRT contact person and any substitutes; a review of the roles at least every two years, and in any case after significant incidents, organisational changes or changes in threat exposure. The duties and appointment of these roles are covered in the guide to the NIS 2 point of contact and the CSIRT contact person.
The risk-based approach
Not every requirement applies to every system in the same way. The reading guide (section 2.3) names four clauses through which the measures follow risk:
- "at least for the relevant network and information systems": the requirement can be limited to those systems;
- "in line with the results of the risk assessment under measure ID.RA-05": how and where the requirement applies depends on your risk assessment;
- "save for justified and documented regulatory or technical reasons": an exception is allowed only for legal or technical constraints, justified and documented;
- "supplies with potential impact on the security of network and information systems": supply chain requirements can be limited to these supplies.
An exception does not remove the work. When a requirement is not implemented for regulatory or technical reasons, measure ID.RA-06 asks for compensating mitigation measures, where applicable, described in the risk treatment plan together with the residual risk; the plan is approved by the management bodies. The guide's example is endpoint protection (DE.CM-09) on medical devices whose certification would be invalidated by installing protection software.
The six functions and how many measures each
The count follows the measure codes in Annexes 1 and 2 as published by ACN.
| Function | Categories in the measures | Important entities | Essential entities |
|---|---|---|---|
| Govern (GV) | Organisational context, risk management strategy, roles and responsibilities, policy, supply chain | 11 | 11 |
| Identify (ID) | Asset management, risk assessment, improvement | 9 | 10 |
| Protect (PR) | Identity management, authentication and access control; awareness and training; data security; platform security; technology infrastructure resilience | 12 | 16 |
| Detect (DE) | Continuous monitoring | 2 | 2 |
| Respond (RS) | Incident management, incident response reporting and communication | 2 | 2 |
| Recover (RC) | Incident recovery plan execution; for essential entities also recovery communication | 1 | 2 |
| Total | 37 | 43 |
The weight sits in govern and protect: 23 of 37 measures for important entities, 27 of 43 for essential ones. Many govern and identify measures call for documents approved by the management bodies: the policies (GV.PO-01), the risk assessment (ID.RA-05), the risk treatment plan (ID.RA-06), the vulnerability management plan (ID.RA-08) and the business continuity, disaster recovery and crisis management plans (ID.IM-04).
The six extra measures for essential entities
Annex 2 contains every measure of Annex 1 and adds six:
- ID.AM-03: an up-to-date inventory of network flows between the entity's network and information systems and the outside, approved internally.
- PR.AT-02: dedicated training for staff in specialised roles, system administrators included, on secure configuration and operation of the systems, known threats and conduct during security events, with an up-to-date register.
- PR.IR-03: protected emergency communication systems, in line with the results of the risk assessment.
- PR.PS-01: secure (hardened) reference configurations for the relevant systems, documented in an up-to-date list.
- PR.PS-03: procedures for the physical transfer and secure disposal of devices that store data, and maintenance registers for the hardware of the relevant systems.
- RC.CO-03: procedures for communicating recovery activities after an incident to the internal parties concerned.
The differences do not end there: several shared measures have more requirements in the version for essential entities. For example PR.DS-11, on backups, adds protection of the confidentiality and integrity of backups, through physical protection of the media or encryption, and periodic checks of their usability through restore tests. The other differences between the two categories, from notifiable incidents to inspections, are in our guide to NIS 2 essential and important entities.
After the deadline: ACN supervision
Once the deadline has passed, ACN can check how the measures are implemented with the tools of chapter V of the decree. It can request a report, "including self-assessments and implementation plans" (art. 35, paragraph 3). Essential entities can be inspected also through random checks; important entities only when ACN has evidence suggesting possible violations (art. 36). For breaches of the obligations of articles 23, 24 and 25, fines reach EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and EUR 7 million or 1.4% for important ones, public administrations excluded (art. 38, paragraph 9). The full process, from document requests to formal notices, is in our guide to ACN supervision: inspections, orders and fines.
The baseline measures are not the last step. On 18 September 2026 ACN opened a consultation with the sector working groups on reinforced security measures, which are to supplement and replace the baseline measures (ACN news of 18 September 2026). The state of the consultation is in our article on NIS reinforced security measures. Until a new act is adopted, the reference remains the annexes of Determination 379907/2025.
For each requirement in your annex it pays to be able to show three things: the reference document, who approved it and when, and the evidence of implementation. The method to check this is in the operational checklist for the NIS 2 documentation audit. We support you in NIS 2 compliance, and if you lack someone to prepare the assessments, policies and plans to put before the management bodies, our vCISO works with you on the activities and documents NIS 2 requires.
If you want to know which requirements of your annex are already covered by the documents you have, we review them with you in the NIS 2 documentation audit, with the findings and a remediation plan.
