Many owners of professional offices and small businesses have heard about NIS2 and concluded: “It does not concern me, I am too small.” Strictly speaking, that is often true. In practice, however, NIS2 also reaches SMEs and suppliers through their larger clients. Let’s see how.
What is NIS2?
NIS2 is Directive (EU) 2022/2555, which sets common cybersecurity rules for companies and public bodies carrying out activities that are important for the economy and society. In Italy it was transposed by Legislative Decree no. 138 of 4 September 2024, published in the Gazzetta Ufficiale (Italy’s Official Journal) on 1 October 2024 and in force since 16 October 2024. The competent authority is ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
Compared with the first NIS Directive, NIS2 greatly widens the number of sectors and organisations covered (energy, transport, healthcare, water, digital, manufacturing of certain products, waste, food, postal services and others) and divides them into essential entities and important entities.
Does NIS2 apply to small businesses?
Generally not directly: the main criterion is size, and the thresholds exclude most micro and small businesses. There are, however, exceptions for certain activities considered critical regardless of size.
For an SME, the real point lies elsewhere. Among the measures that entities in scope must adopt is supply chain security (Article 24 of the decree). In practice, NIS2 entities must:
- map their critical suppliers;
- include security clauses and incident notification obligations in contracts;
- check suppliers periodically, often through questionnaires and requests for evidence.
If your office or company works for a healthcare organisation, a multi-utility, a manufacturer, a transport operator or a digital provider, you are likely to receive, or may already have received, one of these questionnaires.
Key dates to remember
| What | When |
|---|---|
| Legislative Decree 138/2024 comes into force | 16 October 2024 |
| Registration of entities on the ACN platform | Every year from 1 January to 28 February |
| Adoption of basic security measures | Within 18 months of being notified of inclusion in the NIS list: for entities notified in spring 2025, by October 2026 |
| Notification of significant incidents | Early warning within 24 hours, notification within 72 hours, final report within one month |
In plain terms: right now many companies in scope are completing their basic measures, and checking suppliers is one of them.
What do supplier security questionnaires usually ask?
Every company has its own template, but the typical questions are similar:
- Do you have a contact person for cybersecurity?
- Do you use multi-factor authentication for email and remote access?
- Do you make regular backups that are kept separate and tested?
- Are your systems updated regularly?
- Do you have a firewall and a monitoring system?
- How do you manage access to our data? Who can see it?
- Do you have an incident procedure? How quickly would you notify us?
- Do your staff receive security training?
- Where is the data stored (Italy, EU, outside the EU)?
- Can you provide evidence: reports, logs, policies?
Answering “yes” is no longer enough: more and more often, proof is requested.
How to prepare, in practice
You do not need to be a NIS2 entity to behave like a good supplier. Here is a realistic path:
- Take stock with our 10-question checklist: it gives you your priorities.
- Sort out the basics: two-factor authentication, a disconnected and tested backup, updates.
- Protect and monitor the network: a firewall that watches and alerts, not just the router.
- Write the incident procedure: whom to call, how to inform clients, and within what timeframes. → Cyberattack: what to do
- Gather the evidence: activity log, periodic reports, signed policies. These are the documents to attach to your answers.
- Coordinate with the GDPR: many measures serve both. → GDPR security measures and data breaches
Beware of “NIS2 compliant” promises
No product makes an organisation “NIS2 compliant”: compliance involves processes, responsibilities, people and technology together. A good tool helps demonstrate that you have certain measures in place; be wary of anyone selling a device as if it were a certificate.
How Strega Defence helps
Strega Defence was created for professional offices and small businesses that receive security questionnaires without having an in-house technician. It protects the network, alerts you in plain language when something that matters happens, and keeps a Log of events and decisions from which a periodic report is produced: concrete material to attach when a client asks “show me what you do about security”. Discover Strega Defence.
This article is for general information only and does not constitute legal advice. To check whether your organisation falls within the scope of NIS2, consult the ACN portal or a professional.
Frequently asked questions
Does NIS2 apply to professional offices?
In most cases not directly, because professional offices do not fall within the sectors and size thresholds covered. They can, however, be drawn in as suppliers to NIS2 entities, which must check the security of their own supply chain.
What happens if I do not answer a client’s security questionnaire?
A client subject to NIS2 must manage the risk linked to its suppliers: a supplier that does not answer or offers no assurances may be considered high-risk, with the risk of losing the contract or having stricter conditions imposed.
What are the incident notification deadlines under NIS2?
Entities in scope must send an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month, to CSIRT Italia at the ACN.
How do I know whether my company is a NIS2 entity?
You need to check your sector of activity, your size and any special cases provided for by Legislative Decree 138/2024. The ACN publishes information, FAQs and the registration platform on its portal; registration is open every year from 1 January to 28 February.
Can a product make me NIS2 compliant?
No. Compliance concerns the whole organisation: governance, responsibilities, processes, training and technical measures. A security product can help implement and document certain measures, but it does not replace the compliance process.
Are the measures required by NIS2 different from those required by the GDPR?
They partly overlap: backups, access control, incident management and training serve both. The GDPR protects personal data; NIS2 protects the continuity and security of services. It makes sense to tackle them together.
Sources and further reading
- Decreto legislativo 4 settembre 2024, n. 138 (recepimento NIS2) (in Italian) — Gazzetta Ufficiale, General Series no. 230 of 1 October 2024. Legislative Decree 138/2024 transposing NIS2.
- NIS portal — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
- NIS: date e informazioni utili per un’implementazione efficace (in Italian) — ACN. Dates and useful information for effective implementation.
- FAQ NIS: misure di sicurezza e notifica di incidenti (in Italian) — ACN. FAQs on security measures and incident notification.
- NIS2 e D.Lgs. 138/2024 (in Italian) — ICT Security Magazine.
- Consigli utili per i professionisti IT delle PMI (PDF) (in Italian) — ACN. Practical advice for IT professionals working with SMEs.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
