NIS 2 baseline measures
The baseline security measures ACN set for NIS entities: what they require, how to document them and how to prepare for the adoption deadlines.
All articles
NIS 2 Recovery Controls (RC): Operational Resilience and Service Restoration
The NIS 2 Recovery (RC) domain defines how entities restore operations after incidents and sustain resilience. Practical guide to restoration procedu…
NIS 2 crisis management plan: practical guide for an approvable ID.IM-04 document
The crisis management plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must contain, a practical templa…
NIS 2 Response Controls (RS): Containment and Eradication in Incident Handling
Containment and eradication are iterative response steps that limit damage and remove attacker persistence. Practical guide to strategy selection, ev…
NIS 2 disaster recovery plan: practical guide for an approvable ID.IM-04 document
The disaster recovery plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable DR plan must contain, a practical tem…
NIS 2 Response Controls (RS): Signaling and Investigation Operating Model
The NIS 2 Response (RS) domain requires structured incident response through signaling, investigation, and iterative decision loops. Practical guide …
NIS 2 business continuity plan: practical guide to build an approvable ID.IM-04 document
The business continuity plan is mandatory under NIS 2 Appendix C (ID.IM-04). This guide covers what an approvable plan must include, a practical temp…
NIS 2 Detection Controls (DE): Event Monitoring and Adversarial Signal Handling
The NIS 2 Detection (DE) domain requires monitoring networks, services, and endpoints to identify adverse events early. Practical guide to log readin…
NIS 2 Protection Controls (PR): Technical and Organizational Measures in Execution
The NIS 2 Protection (PR) domain translates risk decisions into safeguards over identities, data, platforms, and infrastructure. Practical guide to P…
NIS 2 inventory of relevant systems and assets: practical guide to build an auditable register
NIS 2 baseline compliance requires auditable inventories of systems, assets, and network flows. This guide covers what a NIS 2-ready register must co…
NIS 2 Identification Controls (ID): Inventories, Risk Assessment, and Improvement Cycle
The NIS 2 Identification (ID) domain covers asset visibility, risk assessment, treatment planning, vulnerability processes, and improvement cycles. P…
NIS 2 remediation roadmap (Piano di Adeguamento): practical guide for ID.IM-01 approval
The remediation roadmap is mandatory under NIS 2 Appendix C (ID.IM-01). This guide covers how to consolidate gaps, prioritize actions, align mileston…
NIS 2 Governance Controls (GV): Policies, Roles, and Accountability Model
The NIS 2 Governance (GV) domain defines cybersecurity direction, accountability, and oversight. Practical guide to implementing GV controls: context…
NIS 2 Article 24 in Practice: How to Implement Cybersecurity Risk-Management Measures
Article 24 of Italy's NIS decree requires proportionate cybersecurity measures. Practical guide to implementing control families (GV/ID/PR/DE/RS/RC) …
NIS 2 mandatory documents master guide: what must be approved by the board and what to prepare now
Appendix C lists 11 documents requiring board-level approval under NIS 2 baseline obligations. With incident notification already live and baseline m…
NIS 2 baseline obligations in practice: master overview for governance, controls, and incident operations
A structured operational overview of Italy’s NIS 2 baseline obligations: governance (Art. 23), risk management (Art. 24), and incident notification (…
NIS 2 essential and important entities: who they are and what changes
Who is an essential and who an important entity under articles 3 and 6 of D.Lgs. 138/2024: Annex I and II sectors, the cases regardless of size, how …
NIS 2 baseline security measures: ACN's 37 and 43 measures and deadlines
ACN Determination 379907/2025 sets the NIS 2 baseline security measures: 37 for important entities and 43 for essential ones, organised into six func…