NIS 2 baseline measures
The baseline security measures ACN set for NIS entities: what they require, how to document them and how to prepare for the adoption deadlines.
All articles
ACN supervision under NIS 2: inspections, orders and fines
For entities placed on the NIS list in April 2025, ACN gives October 2026 as the deadline for the baseline measures. How ACN supervises after that: m…
NIS 2 assessment: a self-assessment checklist for SMEs
Your company has just found out it falls under NIS 2. A self-assessment to run before an ACN review or an external audit: confirm scope, find the mea…
NIS 2 vs ISO 27001: what certification covers and the gaps
Your company holds or plans ISO/IEC 27001 and falls under NIS 2. What the certification already covers, the obligations D.Lgs. 138/2024 adds (registr…
NIS Reinforced Security Measures: ACN Opens the Consultation
On 18 September 2026 ACN opened a sector consultation on reinforced NIS security measures, meant to supplement and replace the baseline measures. The…
NIS Supply Chain Security: What ACN's FAQs MSB.13 to MSB.19 Clarify
On 24 July 2026 ACN published seven FAQs on NIS supply chain security. The four-phase process, the five minimum criteria for supply risk, why not eve…
ACN NIS Vademecum 2026: Compliance Calendar and Operational Checklist
ACN's NIS Vademecum 1.0 (September 2026) puts the NIS obligations on one calendar: six obligation families, three recurring annual windows and differ…
NIS Entity List Update: Late Registrations, Reviews and the 2027 Window
On 18 September 2026 ACN announced an update of the NIS entity list after more than 2,000 late registrations and about 2,000 reviews, and confirmed t…
NIS 2 point of contact and CSIRT contact: designation, duties and deadlines
ACN Determination 127437/2026 sets four roles for NIS entities: point of contact, substitute, CSIRT contact and optional substitutes of the CSIRT con…
NIS 2 Supply-Chain Security: Managing Critical Suppliers and High-Impact Procurements
NIS 2 supply-chain security is a governance obligation covering supplier identification, risk assessment, contractual integration, and lifecycle moni…
NIS 2 Compliance Documentation Audit: How the Scoring Methodology Works
Aegister’s scoring methodology evaluates NIS 2 documents at requirement-point level across 5 dimensions on a 0-4 scale. This guide covers the scoring…
NIS 2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof
ACN baseline guidance requires documentary evidence as a core compliance element. Practical guide to evidence families, obligation-to-evidence mappin…
NIS 2 Significant Incident IS-3: Violation of Expected Service Levels
IS-3 in the ACN baseline model covers service-level violation incidents affecting entity services and activities. Practical guide to qualification, s…
Compliance Documentation Audit for NIS 2 Baseline Obligations: Method Overview
A Compliance Documentation Audit maps NIS 2 documents to baseline requirements, scores maturity on a 0-4 scale, verifies evidence traceability, and c…
NIS 2 Significant Incident IS-2: Integrity Loss Affecting Digital Data
IS-2 in the ACN baseline model covers integrity loss affecting digital data under entity ownership or control. Practical guide to qualification, evid…
NIS 2 baseline deadline October 2026: 8-month implementation roadmap
With the NIS 2 baseline adoption deadline set for October 2026, organizations have roughly 8 months left. This guide provides a compressed, phased ro…
NIS 2 KPIs and continuous improvement: operational metrics for resilient compliance
ACN guidance frames improvement as a continuous phase across the full incident lifecycle. This guide provides a practical KPI framework, governance r…
NIS 2 Significant Incident IS-1: Confidentiality Loss Affecting Digital Data
IS-1 in the ACN baseline model covers confidentiality loss affecting digital data under entity ownership or control. Practical guide to qualification…
Common NIS 2 compliance mistakes: practical gaps that delay baseline readiness
Most NIS 2 delays are operational: missing evidence, unclear ownership, untested notification workflows, and late governance decisions. A practical g…
NIS 2 Incident Typology Model: Condition, Compromise, and Affected Object
ACN baseline guidance classifies significant incidents through condition, compromise, and object of compromise. Practical guide to using the typology…
NIS 2 operational registers for logs, backups, and recovery: practical guide to auditable evidence
NIS 2 baseline requires operational evidence beyond policies. This guide covers how to build auditable registers for logs, backups, restore tests, an…