NIS2 regulation: They told us we fall under it, how can I verify this in Italy?

Before rushing into hiring expensive consultants, go through the checklist sent by your client with your IT team. Typically they're looking for MFA, routine backups, endpoint protection, and encryption. That's just standard baseline security hygiene anyway, and most of it can be sorted out on a reasonable budget.

The biggest focus areas for suppliers under NIS2 are access management and incident response plans. They'll likely expect you to have a mechanism in place to detect and report any breach on your network within 24 hours. If your shop-floor CNC machines share the same local network as your office PCs, getting network segmentation in place should be your very first step.

We're a parts supplier with 55 employees and around 11 million euros in revenue. Our main client in Italy demanded a similar audit six months ago. Getting external help to bring our systems up to standard cost us about 18,000 euros and took three months of work, but it saved us from losing the master agreement.

Big corporate clients are panicking over NIS2 right now and trying to offload their own legal liabilities onto subcontractors. Not every item on that form they sent you is necessarily mandatory by law. The Italian decree states that suppliers must be evaluated based on the principle of proportionality. Try to negotiate by proposing alternative security measures for requirements that exceed your capacity.

acn put out a survey-style guide on their official site, u put in your ateco code and it tells u straight up if you're in scope... like but if the client is pushing for it, that code doesn't really matter tbh if they don't want to they just won't renew the contract.

With 68 employees and a revenue of 14 million euros, your company clearly falls into the medium-sized enterprise category. Entities supplying critical parts to the energy sector are expected to comply indirectly with supply chain security regulations, even if they fall outside direct scope. We advise you to complete the form thoroughly and ensure your corporate records are readily accessible.

Here are the steps you should take right now: 1) Confirm your official scope on the ACN portal using your ATECO code, 2) List the missing items from the client survey by priority and draft a budget, 3) Instead of outright rejecting the client's request, buy some time by presenting a six-month roadmap outlining your planned security improvements.

We went through something similar two years ago with a German manufacturer during a quality certification process. It felt completely unnecessary and overwhelming at first, but once we implemented those changes and tightened internal security, we not only prevented internal data loss but also used it as a strong credential when bidding for other large corporations.

Youre right. Most incidents start with a leaked password, not a vulnerability.

If its your first time, start small; scaling comes later. anyway thats all sorry if I went on too long.

You're right.

Correct in theory, but it doesn't work that way in practice. Payment information changes are never verified through the channel they came from.

I'm also curious if anyone does it differently.

Here's how it went for us. When you try to change everything at once, nothing settles.

An automated scan report is not the same as a penetration test. If you post the result here, it will help others too.

Heres how it went for us. like if 2FA is on, a stolen password alone is useless.

Good luck with that.

I went through the same thing.

Let me share my experience. Most incidents start with a leaked password not a vulnerability.

Just leaving this note it might be useful.

I cant fully agree with this. I mean most incidents start with a leaked password not a vulnerability.

I think it's hard to be that definitive about nis2 regulation. When you try to change everything at once nothing settles.

That's all, sorry if I went on too long.