{"id":4724,"date":"2025-05-21T08:00:00","date_gmt":"2025-05-21T06:00:00","guid":{"rendered":"https:\/\/web-preprod.retelit.it\/news-events\/uncategorized\/2025\/nis-2-phase-2-second-implementation-phase-launched\/"},"modified":"2026-07-20T19:27:51","modified_gmt":"2026-07-20T17:27:51","slug":"nis-2-phase-2-second-implementation-phase-launched","status":"publish","type":"post","link":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/","title":{"rendered":"NIS 2 Phase 2 – Second Implementation Phase Launched"},"content":{"rendered":"

The Working Group for the implementation of NIS2 met on April 10 to launch the second phase of this structured and gradual process for the adoption of EU Directive 2022\/2555 (NIS2), which aims to raise the level of cybersecurity within the national production system and Public Administrations.<\/p>\n

The National Cybersecurity Agency (ACN) has precisely defined\u2014based on and in alignment with the National Cybersecurity and Data Protection Framework<\/b><\/a>\u2014the measures that entities (organizations and businesses operating in sectors vital to the economy and society) will be required to comply with.<\/p>\n

The 16 areas required by the directive<\/b><\/p>\n

Specifically, essential entities must comply with 116 requirements, while important entities are subject to “only” 87. In both cases, the requirements are divided across the following areas: <\/p>\n

    \n
  1. Risk management<\/b>: identifying, assessing, and addressing cybersecurity risks by integrating them into organizational processes and regularly updating them according to emerging threats<\/li>\n
  2. Roles and responsibilities<\/b>: must be formally defined, approved by management, and periodically updated to ensure accountability and efficiency in cybersecurity<\/li>\n
  3. Personnel reliability<\/b>: staff must be selected based on experience, skills, and trustworthiness, with contractual security obligations even after the employment ends<\/li>\n
  4. Compliance and security audits<\/b>: security policies and measures must be regularly reviewed and audited to ensure compliance with current regulations<\/li>\n
  5. Cybersecurity risk management in the supply chain<\/b>: security requirements must be included in contracts with suppliers, compliance must be monitored, and risks must be assessed throughout the supply chain<\/li>\n
  6. Asset management<\/b>: all relevant assets must be identified, inventoried, and managed according to their importance to business objectives and risk strategy<\/li>\n
  7. Vulnerability management<\/b>: structured processes must be defined for identifying, resolving, and monitoring vulnerabilities, with prompt corrective actions implemented<\/li>\n
  8. Operational continuity<\/b>: disaster recovery and crisis management. Documented plans must be developed, maintained, and tested to ensure operational resilience and quick recovery<\/li>\n
  9. Authentication, digital identity, and access control<\/b>: identities and access must be managed using the principles of least privilege, separation of duties, and multi-factor authentication<\/li>\n
  10. Physical security<\/b>: facilities must be protected from unauthorized access through controls consistent with risk levels<\/li>\n
  11. Staff training and awareness<\/b>: all personnel, including administrators, must receive continuous training to increase awareness of cybersecurity risks and protection measures<\/li>\n
  12. Data security<\/b>: data must be protected both at rest and in transit through secure encryption and appropriate backup measures<\/li>\n
  13. Development, configuration, maintenance, and decommissioning of information and network systems<\/b>: all activities must follow secure practices throughout the system lifecycle, ensuring timely updates and secure disposal of obsolete technologies<\/li>\n
  14. Network and communications protection<\/b>: networks and infrastructure must be protected using adequate perimeter security measures and strict remote access controls<\/li>\n
  15. Security event monitoring<\/b>: continuous monitoring systems must be implemented to detect anomalies and incidents in a timely manner<\/li>\n
  16. Incident response and recovery<\/b>: an operational incident management plan must be in place, including clear procedures for notification, response, and recovery<\/li>\n<\/ol>\n

    The breadth and variety of these areas are immediately apparent. This ensures comprehensive coverage of all aspects related to cybersecurity\u2014as it should. However, it also introduces a high level of complexity that requires a heterogeneous mix of expertise: the requirements are not only technological in nature but also organizational, procedural, governance-related, and regulatory.<\/p>\n

    Identifying the involved entities<\/b><\/p>\n

    ACN has already identified the institutions, companies, and organizations that qualify as \u201cNIS2 entities\u201d and must therefore comply with the directive. ACN has started informing these entities of their new \u201cselected status.\u201d<\/p>\n

    It is known that there are more than 20,000 entities, including 5,000 classified as Essential\u2014those operating in highly critical sectors and providing fundamental services for society and the economy. The remaining 15,000 are Important entities, operating in critical sectors and providing significant services that, while not essential, are key to the resilience and security of operations.<\/p>\n

    Additionally, as identified during the first phase of the NIS2 adoption, all companies within the supply chain of either an Important or Essential entity are also impacted. While these companies are not required by ACN to comply with the directive nor are they subject to sanctions,<\/p>\n

    Essential and Important entities are (there are 7 related requirements) obligated to manage risks arising from their supply chain and define security requirements that align with their own. Therefore, supplier companies will be directly involved in risk management processes and must periodically demonstrate compliance with the agreed-upon security measures.<\/p>\n

    The entry into force of the NIS2 directive is expected to significantly boost the cybersecurity posture of companies of all sizes. Medium and large enterprises\u2014most of which naturally fall into the Important and Essential categories\u2014will be primarily affected, but smaller businesses will also feel the impact because of their roles in supply chains.
    According to the     CYBER INDEX SME REPORT 2024<\/a> \u201c[…] 48% of Italian SMEs report that they operate within strategic value chains\u2014that is, those that involve critical infrastructures, multinational companies, or public administrations, or are active abroad in geopolitically unstable countries<\/em>.\u201d<\/p>\n

    So what should be done? Timeline and responsibilities<\/b><\/p>\n

    NIS entities must implement the necessary measures and requirements by October 2026. That leaves about a year and a half to define, deploy, and operationalize all procedures and technological components required to secure their organizations.
    It will therefore be necessary to carefully plan all actions to be taken, identifying areas for improvement and aligning them with the requirements. A thorough analysis must be conducted, considering both organizational and governance aspects, as well as the technological ones essential for implementing effective protection, defense, and monitoring mechanisms. For all other companies: it is essential to recognize that investing in cybersecurity is no longer optional\u2014it is a fundamental requirement to remain competitive. In a market where large and medium-sized enterprises (especially those subject to NIS2) demand increasingly higher levels of data protection and security, companies\u2014particularly SMEs\u2014that fail to upgrade their defenses risk being excluded from business opportunities and strategic partnerships.<\/p>\n

    How Retelit supports companies on the NIS2 journey<\/b><\/p>\n

    Addressing NIS2 compliance is not just about fulfilling a European directive\u2014it\u2019s an opportunity to rethink one\u2019s security posture in a modern and structured way. Retelit positions itself as a true competence hub, offering continuous support to organizations in tackling NIS2 complexity through integrated services, combining internal expertise with that of highly specialized strategic partners (especially in the areas of compliance and governance), and with selected solutions from leading technology vendors.
    We can assist customers in the preliminary phase with a Gap Analysis to define the shortest and most effective path to compliance, as well as during implementation, supporting the organization in deploying the necessary measures to cover the 16 areas outlined above.<\/p>\n

    Analysis by Andrea Priviero \u2013 Product Marketing, Retelit<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    The Working Group for the implementation of NIS2 met on April 10 to launch the second phase of this structured and gradual process for the adoption of EU Directive 2022\/2555 (NIS2), which aims to raise the level of cybersecurity within the national production system and Public Administrations. The National Cybersecurity Agency (ACN) has precisely defined\u2014based […]<\/p>\n","protected":false},"author":4,"featured_media":2870,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","footnotes":"","_retelit_schema_faq":""},"categories":[123],"tags":[],"class_list":["post-4724","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-insights"],"retelit_translations":{"it":null,"en":4724,"de":null,"trid":2849},"yoast_head":"\nNIS 2 Phase 2 - Second Implementation Phase Launched - Retelit<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NIS 2 Phase 2 - Second Implementation Phase Launched - Retelit\" \/>\n<meta property=\"og:description\" content=\"The Working Group for the implementation of NIS2 met on April 10 to launch the second phase of this structured and gradual process for the adoption of EU Directive 2022\/2555 (NIS2), which aims to raise the level of cybersecurity within the national production system and Public Administrations. The National Cybersecurity Agency (ACN) has precisely defined\u2014based […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/\" \/>\n<meta property=\"og:site_name\" content=\"Retelit\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-21T06:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-20T17:27:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Paolo Annoni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Paolo Annoni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/\"},\"author\":{\"name\":\"Paolo Annoni\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/#\\\/schema\\\/person\\\/e7e7c4399205e865ae7e6d465888fba4\"},\"headline\":\"NIS 2 Phase 2 – Second Implementation Phase Launched\",\"datePublished\":\"2025-05-21T06:00:00+00:00\",\"dateModified\":\"2026-07-20T17:27:51+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/\"},\"wordCount\":1083,\"image\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/retelit.it\\\/wp-content\\\/uploads\\\/r_NIS-2.jpg\",\"articleSection\":[\"Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/\",\"url\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/\",\"name\":\"NIS 2 Phase 2 - Second Implementation Phase Launched - Retelit\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/retelit.it\\\/wp-content\\\/uploads\\\/r_NIS-2.jpg\",\"datePublished\":\"2025-05-21T06:00:00+00:00\",\"dateModified\":\"2026-07-20T17:27:51+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/#\\\/schema\\\/person\\\/e7e7c4399205e865ae7e6d465888fba4\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#primaryimage\",\"url\":\"https:\\\/\\\/retelit.it\\\/wp-content\\\/uploads\\\/r_NIS-2.jpg\",\"contentUrl\":\"https:\\\/\\\/retelit.it\\\/wp-content\\\/uploads\\\/r_NIS-2.jpg\",\"width\":800,\"height\":450,\"caption\":\"NIS 2 Phase 2 - Zweite Umsetzungsphase gestartet\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/magazine\\\/insights\\\/2025\\\/nis-2-phase-2-second-implementation-phase-launched\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/retelit.it\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NIS 2 Phase 2 – Second Implementation Phase Launched\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/retelit.it\\\/en\\\/\",\"name\":\"Retelit\",\"description\":\"Born to B2B\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/retelit.it\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/retelit.it\\\/en\\\/#\\\/schema\\\/person\\\/e7e7c4399205e865ae7e6d465888fba4\",\"name\":\"Paolo Annoni\",\"url\":\"https:\\\/\\\/retelit.it\\\/en\\\/author\\\/paolo-annoni\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NIS 2 Phase 2 - Second Implementation Phase Launched - Retelit","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"NIS 2 Phase 2 - Second Implementation Phase Launched - Retelit","og_description":"The Working Group for the implementation of NIS2 met on April 10 to launch the second phase of this structured and gradual process for the adoption of EU Directive 2022\/2555 (NIS2), which aims to raise the level of cybersecurity within the national production system and Public Administrations. The National Cybersecurity Agency (ACN) has precisely defined\u2014based […]","og_url":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/","og_site_name":"Retelit","article_published_time":"2025-05-21T06:00:00+00:00","article_modified_time":"2026-07-20T17:27:51+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg","type":"image\/jpeg"}],"author":"Paolo Annoni","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Paolo Annoni","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#article","isPartOf":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/"},"author":{"name":"Paolo Annoni","@id":"https:\/\/retelit.it\/en\/#\/schema\/person\/e7e7c4399205e865ae7e6d465888fba4"},"headline":"NIS 2 Phase 2 – Second Implementation Phase Launched","datePublished":"2025-05-21T06:00:00+00:00","dateModified":"2026-07-20T17:27:51+00:00","mainEntityOfPage":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/"},"wordCount":1083,"image":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#primaryimage"},"thumbnailUrl":"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg","articleSection":["Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/","url":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/","name":"NIS 2 Phase 2 - Second Implementation Phase Launched - Retelit","isPartOf":{"@id":"https:\/\/retelit.it\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#primaryimage"},"image":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#primaryimage"},"thumbnailUrl":"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg","datePublished":"2025-05-21T06:00:00+00:00","dateModified":"2026-07-20T17:27:51+00:00","author":{"@id":"https:\/\/retelit.it\/en\/#\/schema\/person\/e7e7c4399205e865ae7e6d465888fba4"},"breadcrumb":{"@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#primaryimage","url":"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg","contentUrl":"https:\/\/retelit.it\/wp-content\/uploads\/r_NIS-2.jpg","width":800,"height":450,"caption":"NIS 2 Phase 2 - Zweite Umsetzungsphase gestartet"},{"@type":"BreadcrumbList","@id":"https:\/\/retelit.it\/en\/magazine\/insights\/2025\/nis-2-phase-2-second-implementation-phase-launched\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/retelit.it\/en\/"},{"@type":"ListItem","position":2,"name":"NIS 2 Phase 2 – Second Implementation Phase Launched"}]},{"@type":"WebSite","@id":"https:\/\/retelit.it\/en\/#website","url":"https:\/\/retelit.it\/en\/","name":"Retelit","description":"Born to B2B","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/retelit.it\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/retelit.it\/en\/#\/schema\/person\/e7e7c4399205e865ae7e6d465888fba4","name":"Paolo Annoni","url":"https:\/\/retelit.it\/en\/author\/paolo-annoni\/"}]}},"_links":{"self":[{"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/posts\/4724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/comments?post=4724"}],"version-history":[{"count":1,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/posts\/4724\/revisions"}],"predecessor-version":[{"id":4870,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/posts\/4724\/revisions\/4870"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/media\/2870"}],"wp:attachment":[{"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/media?parent=4724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/categories?post=4724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/retelit.it\/en\/wp-json\/wp\/v2\/tags?post=4724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}