Italy's NIS implementation architecture is defined by Legislative Decree 138/2024 and ACN implementation acts. For governance teams, the critical point is not only which controls to apply, but which internal functions are legally and operationally accountable for decisions, evidence, incident escalation, and authority interactions.
Sources: Legislative Decree 138/2024, ACN baseline determination, ACN baseline reading guide
Key takeaways
- Legislative Decree 138/2024 is the primary legal basis for NIS obligations in Italy.
- ACN, as competent authority, defines implementation specifications in phase-one baseline acts.
- The operational model distinguishes legal accountability (organs and management), execution accountability (security organization), and reporting accountability (incident and notification chain).
- NIS subjects are categorized and obligations are calibrated by framework rules and implementing specifications.
Sources: Legislative Decree 138/2024, ACN baseline reading guide
Normative stack at a glance
| Layer | Function | Governance impact |
|---|---|---|
| Legislative Decree 138/2024 | Defines obligations, scope, and authority model | Sets mandatory accountabilities and obligations |
| ACN determinations (baseline phase) | Defines modalities and baseline specifications | Converts legal duties into concrete controls and notification expectations |
| ACN operational guidance | Supports interpretation and implementation sequencing | Helps teams build auditable operating procedures |
Sources: Legislative Decree 138/2024, ACN baseline determination, ACN baseline reading guide
Role model to implement internally
Based on legal text and ACN implementation material, organizations should structure at least three accountability layers.
1. Strategic and governance accountability
Organs of administration and top management are responsible for oversight and governance duties tied to NIS obligations.
2. Operational cybersecurity accountability
A defined cybersecurity organization must maintain roles, responsibilities, policies, and evidence, including recurring updates and review cycles.
3. Notification and external interface accountability
The incident-reporting and notification chain must be assigned, documented, and operationalized through designated roles and procedures interacting with CSIRT/authority channels.
Sources: Legislative Decree 138/2024, ACN baseline determination, ACN incident-management guidance
Scope and subject classification
The framework distinguishes NIS subjects and provides differentiated baseline specifications. Governance programs should maintain a documented rationale for subject classification and obligation mapping, including traceability to the applicable baseline annexes.
Details are defined in the official legal and ACN documents.
Sources: Legislative Decree 138/2024, ACN baseline determination, ACN - Allegato 1, ACN - Allegato 2
Governance checklist for immediate execution
- Confirm legal scope and subject classification with documented rationale.
- Define a formal role-responsibility matrix for governance, cyber operations, and notifications.
- Map each obligation to an accountable owner, process, control, and evidence item.
- Align policy approval and review cadence with baseline expectations.
- Establish an authority-facing reporting chain with tested escalation paths.
FAQ
Is the legal decree enough to execute compliance without ACN acts?
No. The decree sets the legal framework; ACN implementing acts and baseline specifications are required for operational execution. Sources: Legislative Decree 138/2024, ACN baseline determination
Which roles must be formally assigned first?
At minimum, organizations should formalize governance ownership, cybersecurity operational roles, and the incident-notification interface chain according to applicable legal and ACN requirements. Sources: ACN baseline reading guide, ACN incident-management guidance
Do important and essential subjects follow the same baseline annexes?
No. Baseline specifications are differentiated by subject category in dedicated annexes. Sources: ACN - Allegato 1, ACN - Allegato 2, ACN - Allegato 3, ACN - Allegato 4
Related reading
- NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations
- NIS2 Article 23 in Practice: Obligations for Management and Governing Bodies
- NIS2 Essential vs Important Entities: Compliance Differences in Baseline Obligations
- Aegister NIS2 Compliance Service
- Aegister Virtual CISO Service