Cybersecurity & AI

We Front-Run Risk

Who is covered and what NIS2 requires

Directive (EU) 2022/2555 – NIS2, transposed in Italy by Legislative Decree 138/2024 (in vigore dal 16 ottobre 2024), estende gli obblighi di cybersecurity ad 18 settori tra “altamente critici” e “critici”, con adempimenti su registrazione ACN, gestione del rischio, continuità operativa e notifica degli incidenti.
Per essere certi di avere una elevata sicurezza informatica e di essere in regola con le normative sull’intelligenza artificiale, è essenziale una analisi di assoggettabilità per definire con certezza entità e qualifiche (essential/important), applicando i criteri di legge, per ciascuna società del perimetro dei gruppi di società.

What we do for NIS2 compliance (4-phase method)

Phase 1 — Governance & ACN Registration
Definition of governance, roles and responsibilities; mapping of NIS2 scope across parent company/subsidiaries; registration on the ACN portal; high-level plan and channels with ACN.
Deliverables: Kick-off minutes, Governance framework, ACN registration confirmation, Initial project plan.
Phase 2 — Gap Analysis & Risk Assessment
Detailed assessment against NIS2 requirements and standards (e.g., ISO/IEC 27001, National Framework); risk assessment of IT/OT assets and essential services; verification of business continuity/disaster recovery.
Deliverables: Gap Analysis Report, Risk Assessment Report (with preliminary Treatment Plan), Executive Summary for management.
Phase 3 — ISMS & Documentation
Design/update of Group ISMS in line with ISO/IEC 27001:2022: policies, procedures (e.g., incident response, access management, classification & configuration management), BCP/DR plans, SoA (control mapping vs ISO/National Framework), training and supervision of technical implementation.
Deliverables: ISMS Manual, Policies & Procedures, Updated risk register & Treatment Plan, Training materials, Progress reports.
Phase 4 — Ongoing Support
Periodic internal audits; security committee and minutes; annual NIS2 compliance report; incident response assistance (including initial notification within 24h and report within 72h to the Authority, according to decree); updates on threats and ACN developments.
Deliverables: Audit reports, Governance minutes, Annual NIS2 report, Document updates.

Model for groups and multi-company structures

Scalable approach: guided reuse of parent company policies/procedures, adaptation to subsidiary risk profiles, clarity on centralized vs local roles/controls.

Scope and exclusions

The project covers legal and organizational compliance and supervision of technical aspects; software/hardware procurement or specialized penetration testing are not included (can be activated through separate assignments/partners).

Why this approach is required by the legislator

Top management accountability and adoption of minimum measures;
Tested and documented incident notification and response processes;
Alignment with standards (ISO/IEC 27001) to measure control effectiveness;
Evidence and deliverables for audits and interaction with ACN.