NIS2: who it applies to, and what it asks of the suppliers of in-scope companies

Edited by Solucom · 22 October 2026

NIS2 applies to medium-sized and large companies operating in one of the 18 sectors listed in the decree, plus some digital activities that are in scope regardless of size. In Italy the rule is Legislative Decree 138/2024, in force since 16 October 2024, and the authority is the National Cybersecurity Agency (ACN).

Many SMEs are therefore out of scope. Yet in 2026 quite a few of them still received a security questionnaire, a new clause in their contract or a request for “NIS2 compliance”. The reason is that their clients are in scope, and NIS2 requires those clients to also look after the security of their own suppliers.

Here we explain who is in scope, why the request also reaches those who are not, and what to prepare as a supplier. We cover the technical and operational side: for the legal assessment of your company you need a lawyer or a specialist consultant.

Who is in scope of NIS2

The decree covers 18 sectors: 11 classed as highly critical and 7 as critical. The first group includes energy, transport, health, water, digital infrastructure and business-to-business ICT service management (managed service and managed security service providers). The second includes postal and courier services, waste management, chemicals, food, manufacturing of various products, digital service providers and research.

Within these sectors, size decides, according to the EU definition of SMEs:

• large enterprises (from 250 employees, or with turnover above €50 million and balance sheet above €43 million): essential entities in highly critical sectors, important in the others;
• medium-sized enterprises (from 50 employees, or with both turnover and balance sheet above €10 million): usually important entities;
• small and micro enterprises: out of scope, with exceptions.

The exceptions are in scope whatever their size: providers of public electronic communications networks and services, trust service providers, top-level domain registries, DNS service providers and domain registrars. Public administrations listed in the decree are also in scope, and ACN can designate individual organisations it considers critical.

Two details that matter in the calculation. For groups of companies the figures are added to those of linked companies, so a small company controlled by a large group may count as medium-sized or large. There is a safeguard clause (Prime Ministerial Decree 221/2024) that in some cases allows them not to be added up, but it has to be requested and justified.

The safest way to find out is the self-assessment offered by ACN, with its sector-by-sector FAQs.

What in-scope companies must do

NIS entities have a set of obligations with precise deadlines:

• register on the ACN platform, and update the registration from 1 January to 28 February each year;
• update their information by 31 May each year;
• notify significant incidents to CSIRT Italia, an obligation in force since January 2026;
• adopt the baseline security measures set by ACN by October 2026: one list for important entities and a longer one for essential entities.

Then there is a point that concerns management: the management bodies approve the measures, oversee their implementation and are liable for breaches. Fines go up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important ones.

Why the request also reaches suppliers

Among the measures the decree requires of NIS entities is supply chain security: relationships with direct suppliers and service providers have to be assessed and managed as a risk.

Since 2026 this has become concrete. In their annual update, NIS entities also report to ACN the list of relevant suppliers (ACN determination 314287/2026, which replaced determination 127437 of 13 April 2026). That list includes, for example, providers of cloud and data centre services, companies that run systems or security on an outsourced basis, and in general anyone supplying something whose interruption would stop the client’s services.

That is why the distributor’s management software, the agency running the online shop, the firm handling payroll and the technician with remote access to the servers are getting questions nobody used to ask. Not because NIS2 applies to them, but because the client must show that it knows who they are and how secure they are.

What a NIS2 client will ask you, in practice

Questionnaires vary from company to company, but the questions recur. It pays to have the answers ready and, above all, to actually have the things they describe.

1. Who has access to our systems, and how?

A list of the people and accounts that access the client’s systems, with two-factor authentication. No shared accounts, no credentials exchanged by email. When someone leaves the project, their access is closed the same day.

2. Where is our data?

Which cloud services you use, in which region, with which sub-suppliers. The client has to map its own supply chain, and you are part of it.

3. Do you make backups, and have you ever restored them?

A backup that has never been tested is a hope. You should know how often it runs, where it is kept, how long it takes to get back up and running, and when the last restore test was done.

4. How do you update systems and software?

A written rule on who applies security updates and how quickly: operating systems, CMS, plugins, libraries. This is the question where WordPress sites left to themselves struggle most. We discuss it in WordPress mission-critical.

5. If you have an incident, when will you tell us?

A NIS client must send an early warning to the CSIRT within 24 hours of becoming aware of a significant incident, and a notification within 72 hours. If the incident starts with you, their deadlines depend on yours. You need a reachable contact and a written commitment on how quickly you will inform them.

6. Who is your security contact?

Even a small company needs a name: someone who answers the questions, keeps the documentation up to date and coordinates when something happens.

Where to start, if you are an SME supplier

You do not need a certification to answer a questionnaire well. You need to know what you have and be able to show it.

• Take stock of what you supply to each client: services, access, data that passes through you.
• Fix the simple things: two-factor authentication everywhere, personal rather than shared accounts, backups with a restore test, updates following a rule.
• Write two pages, not a hundred: who the contact person is, how you manage access, backups and updates, what happens in case of an incident and how quickly you notify.
• Check your own suppliers: hosting, cloud, software. The client will ask you about them too.
• Read the clauses carefully that arrive in contracts, with your lawyer: commitments on notification times, audits and sub-suppliers have to be honoured over time, not just signed.

Much of this is good maintenance before it is compliance. Those who already have it in order answer the questionnaire in an afternoon; those who do not discover they have a security problem, not just a paperwork problem.

Frequently Asked Questions

Sources: Italian National Cybersecurity Agency, pages Scope, Baseline measures and specifications and NIS FAQ; Legislative Decree no. 138 of 4 September 2024. Checked on 11 November 2026.

Have you received a NIS2 questionnaire from a client? We can help you answer the technical part and fix what is missing: access, backups, updates, procedures. See how we work in our projects.