Governance
Roles, responsibilities and board approvals: what NIS 2 asks of the people who run the company, and how to prove it.
All articles
NIS 2 assessment: a self-assessment checklist for SMEs
Your company has just found out it falls under NIS 2. A self-assessment to run before an ACN review or an external audit: confirm scope, find the mea…
NIS 2 vs ISO 27001: what certification covers and the gaps
Your company holds or plans ISO/IEC 27001 and falls under NIS 2. What the certification already covers, the obligations D.Lgs. 138/2024 adds (registr…
ACN NIS Vademecum 2026: Compliance Calendar and Operational Checklist
ACN's NIS Vademecum 1.0 (September 2026) puts the NIS obligations on one calendar: six obligation families, three recurring annual windows and differ…
NIS Entity List Update: Late Registrations, Reviews and the 2027 Window
On 18 September 2026 ACN announced an update of the NIS entity list after more than 2,000 late registrations and about 2,000 reviews, and confirmed t…
NIS 2 Executive Board Reporting: How to Turn Audit Outputs into Governance Decisions
Practical executive reporting model for NIS 2 audit outcomes with minimum KPI set, traffic-light escalation, and evidence-based closure visibility fo…
Prioritizing NIS 2 Audit Findings: From Gap List to Remediation Execution
Severity-to-execution model for NIS 2 audit findings with dependency-aware sequencing, triage criteria, and evidence-based closure tracking for remed…
UNI/PdR 174:2025 for NIS Organizations Certified to ISO 27001: What It Changes Operationally
ACN published UNI/PdR 174:2025 as an operational bridge between ISO/IEC 27001 and NIST CSF 2.0 for NIS-scoped organizations. It helps ISO-certified e…
NIS 2 Compliance Documentation Audit: Interview and Evidence Collection Workflow
Structured interview and evidence collection workflow for NIS 2 documentation audits, with a 6-domain model, evidence maturity scale, and gap-to-reme…
Cross-Document Coherence in NIS 2 Documentation: Audit Method and Controls
Five-dimension coherence audit model for NIS 2 documentation sets covering terminology, roles, cross-references, review cycles, and incident flow con…
NIS 2 point of contact and CSIRT contact: designation, duties and deadlines
ACN Determination 127437/2026 sets four roles for NIS entities: point of contact, substitute, CSIRT contact and optional substitutes of the CSIRT con…
NIS 2 Evidence Matrix and Board-Approval Readiness: Practical Audit Method
Practical method for building an NIS 2 evidence matrix with maturity scoring and board-approval readiness checks for baseline compliance audit.
NIS 2 Requirement-to-Document Mapping: Building a Defensible Audit Structure
Practical method for mapping NIS 2 baseline requirements to primary documents, supporting evidence, and governance controls to build a defensible aud…
NIS 2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof
ACN baseline guidance requires documentary evidence as a core compliance element. Practical guide to evidence families, obligation-to-evidence mappin…
Compliance Documentation Audit for NIS 2 Baseline Obligations: Method Overview
A Compliance Documentation Audit maps NIS 2 documents to baseline requirements, scores maturity on a 0-4 scale, verifies evidence traceability, and c…
NIS 2 baseline deadline October 2026: 8-month implementation roadmap
With the NIS 2 baseline adoption deadline set for October 2026, organizations have roughly 8 months left. This guide provides a compressed, phased ro…
NIS 2 KPIs and continuous improvement: operational metrics for resilient compliance
ACN guidance frames improvement as a continuous phase across the full incident lifecycle. This guide provides a practical KPI framework, governance r…
Common NIS 2 compliance mistakes: practical gaps that delay baseline readiness
Most NIS 2 delays are operational: missing evidence, unclear ownership, untested notification workflows, and late governance decisions. A practical g…
NIS 2 incident management and CSIRT notification plan: practical guide for an approvable RS.MA-01 document
The incident management plan is mandatory under NIS 2 Appendix C (RS.MA-01). This guide covers what an approvable plan must include, a practical temp…
NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document
The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa…
NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document
The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem…