NIS2 compliance, made practical
Gap analysis, security measures, incident reporting and documentation to meet NIS2 and Italy’s Legislative Decree 138/2024, delivered by engineers who can also implement the fixes.
Overview
From obligation to a stronger company.
- Gap analysis against Legislative Decree 138/2024
- Incident reporting in 24 h, 72 h and one month
- Basic security measures due by October 2026
NIS2 (EU Directive 2022/2555), implemented in Italy by Legislative Decree 138/2024 and supervised by ACN, the National Cybersecurity Agency, requires essential and important entities to adopt security measures, report significant incidents within 24 and 72 hours and keep evidence of what they do. Fines reach up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities.
We help you understand exactly what applies to you, close the gaps with real technical measures rather than paperwork, and keep the documentation ready for ACN and for your customers’ supplier checks.
What we do
NIS2 compliance services
01
Scope check
Whether NIS2 applies to you, as an essential or important entity, and how it affects you as a supplier.
02
NIS2 gap analysis
Your current measures compared with the requirements, with a prioritised list of gaps.
03
Security measures roadmap
A realistic plan with priorities, owners, costs and deadlines aligned with the ACN timelines.
04
Incident reporting procedure
Roles, channels and playbooks for the 24-hour early warning, the 72-hour notification and the final report.
05
Policies & documentation
Security policies, risk analysis, asset inventory and records, written to be used, not filed away.
06
Supply chain security
Requirements, questionnaires and checks for the suppliers that access your systems and data.
07
Technical implementation
Multi-factor authentication, backups, logging, hardening and vulnerability management, done by our engineers.
08
Management & staff training
Cybersecurity training for management bodies, as required by NIS2, and awareness sessions for staff.
Why SetExe
What NIS2 compliance brings you
Clear obligations
You know which rules apply, which deadlines matter and what to do first.
Lower risk of fines
Measures and evidence that show ACN you take security seriously.
Real security
Fewer incidents and faster recovery, not just documents for an audit.
One partner end to end
Analysis, implementation and ongoing support from the same team.
How we work
How we deliver NIS2 compliance
Phase 01
Scope
Check of sector, size and services to confirm how NIS2 applies.
Phase 02
Assess
Gap analysis of organisation, processes and technical measures.
Phase 03
Plan
Prioritised roadmap aligned with the deadlines that apply to you.
Phase 04
Implement
Technical measures, procedures, documentation and training.
Phase 05
Maintain
Periodic reviews, tests of the incident procedure and annual updates.
Frameworks & tools
Standards and tools we work with
The regulations and frameworks we map you against, and the security tools we use to put the measures in place.
- NIS2 Directive
- Legislative Decree 138/2024
- ACN guidelines
- Italian National Cybersecurity Framework
- ISO/IEC 27001
- NIST CSF 2.0
- CIS Controls
- Microsoft Entra ID
- EDR
- SIEM
- Vulnerability scanning
- Immutable backups
Ways to work together
Fixed-scope gap analysis
Fixed scope and price: scope check, gap analysis and a prioritised roadmap in a few weeks.
Compliance programme
We implement the measures, procedures, documentation and training, and prepare the evidence for ACN.
Ongoing support
Periodic reviews, incident drills, annual ACN updates and help when a real incident happens.
FAQ
Questions about NIS2 Compliance
Does NIS2 apply to our company?
It mainly covers medium and large organisations in the sectors listed by the directive, and it can also reach smaller companies that are critical suppliers. A short scope check gives you a clear answer.
What are the deadlines?
Incident notification has applied since January 2026. Basic security measures must be in place within 18 months of the ACN notice of inclusion, which for most entities listed in 2025 means October 2026; after that ACN can carry out inspections. Information on the ACN portal must also be updated every year. We check which dates apply to you.
How quickly must incidents be reported?
A significant incident requires an early warning within 24 hours, a notification within 72 hours and a final report within one month.
What are the fines?
Up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher.
Do we need ISO/IEC 27001 certification?
It is not mandatory, but an ISO/IEC 27001-based management system is an excellent basis for NIS2, and we can help you build it.
Registration and updates on the ACN portal are carried out by your organisation; we help you prepare the information. This page is general information, not legal advice.
Related services
Services that complement NIS2 compliance
Cybersecurity
Security assessments, penetration testing, secure development and cloud protection that reduce your risk and help you meet NIS2, GDPR and ISO/IEC 27001 requirements.
AI Security & Governance
Security testing for LLM applications and AI agents, AI governance and practical support for the EU AI Act, so you can use AI with confidence.
Maintenance & Support
Updates, monitoring, fixes and continuous improvements for your applications and SAP systems, with clear service levels and a team that knows your software.
Contact
Talk to a NIS2 specialist
Share a few details and we will get back to you with next steps.
What happens next
- 1 · Tell us about your needs with the form
- 2 · Free consultation with one of our experts
- 3 · Proposal with scope, timeline and estimate