Share This Article
The new framework on NIS2 categorization in Italy introduces significant compliance obligations for entities falling within the scope of the Italian NIS2 regime. The purpose of the categorization exercise is to enable ACN to determine which additional cybersecurity measures will apply depending on the services provided by the relevant entity.
With the adoption of the 13 April 2026 determination by the Italian National Cybersecurity Agency (ACN), issued pursuant to Article 30(2) of Legislative Decree No. 138 of 4 September 2024 (the Italian NIS Decree), essential and important entities are now required to identify, characterize, and categorize their activities and services.
In addition to the so-called “basic security measures,” ACN will progressively introduce further “long-term” cybersecurity obligations that companies will need to implement for their network and information systems based on the relevance category assigned to their activities and services.
Why NIS2 Categorization in Italy Matters
The categorization exercise is not merely an administrative obligation. Instead, it represents the basis upon which future cybersecurity compliance obligations under the Italian NIS2 framework will be built.
As a result, companies falling within the NIS2 perimeter must carefully assess not only their services and activities, but also the operational impact that a compromise of those services may have on their overall operations.
ACN’s Categorization Models and Relevance Categories
The Determination introduces two separate categorization models, both structured around ten homogeneous macroareas designed to cover all organizational functions.
Each macroarea is associated with a predefined relevance category intended to measure the impact that a compromise of a specific activity or service could have on the entity’s ability to operate correctly.
The categorization model set out in Annex 1 of the Determination applies to entities operating in sectors such as:
- energy;
- transport;
- healthcare;
- public administration;
- wastewater and drinking water;
- postal and courier services;
- waste management;
- manufacturing;
- production and distribution of chemicals;
- food production, processing, and distribution;
- manufacturing of medical devices and in vitro diagnostic medical devices; and
- ICT service management providers.
The categorization model set out in Annex 2 instead applies to the remaining NIS entities, including:
- cloud providers;
- data centers; and
- online marketplaces.
The Ten Macroareas Identified by ACN
ACN identifies the following ten macroareas for the NIS2 categorization in Italy framework:
- Monitoring and control;
- Production of goods and services;
- Research, development, and design;
- Financial management;
- Customer management;
- Human resources management;
- Logistics;
- Communication and marketing;
- Administrative management; and
- Other services and activities.
Interestingly, the macroareas are substantially identical in both categorization models under Annexes 1 and 2. The only material difference concerns the logistics area, which ACN considers slightly more impactful for entities covered by Annex 1.
For each macroarea, the Determination identifies a possible relevance category. The Determination establishes four levels:
- high impact;
- medium impact;
- low impact; and
- minimal impact.
The scale reflects the effect that a compromise of the relevant service would have on the overall operations of the NIS entity. However, companies are not strictly bound by the predefined categories.
Entities may modify the assigned relevance level based on their own internal assessment and operational realities. Nevertheless, where companies deviate from ACN’s predefined relevance categories, they should carefully document the rationale supporting their assessment.
Compliance Challenges for NIS Entities
The framework on NIS2 categorization in Italy requires companies not only to map all their activities and services but also to determine the operational impact associated with each of them.
This creates a significant compliance burden for companies within the NIS2 perimeter. Businesses must:
- catalog all services and activities;
- conduct a concrete risk assessment;
- evaluate operational dependencies; and
- justify the assigned relevance levels.
Importantly, while the Determination expressly allows entities to adapt the categorization to their actual operational environment, it is highly likely that ACN will request evidence of those assessments during supervisory or audit activities relating to NIS2 compliance.
As a result, companies should approach the categorization process as a formal governance and risk assessment exercise rather than as a simple reporting obligation.
What Companies Must Do
Under the Determination, NIS entities must identify and categorize all activities performed and services provided, both internally and externally, and allocate them to the relevant macroareas under the applicable model.
For each activity or service, companies must specify:
- the relevant macroarea;
- the name and description of the activity or service; and
- the assigned relevance category.
Importantly, ACN does not require entities to adopt a specific methodology for identifying activities and services. Therefore, companies are free to use the methodology most appropriate for their organizational structure and operational context.
Nevertheless, the exercise remains particularly demanding because entities must comprehensively map their services and carry out a concrete operational risk assessment.
Key Deadline for NIS2 Categorization in Italy
The categorization exercise must be completed and submitted to ACN through the dedicated portal by 30 June of each year with the first deadline being 30 June 2026. For 2026, this represents the first implementation of the obligation. Consequently, it is particularly important for companies to begin the process as soon as possible.
Final Considerations on NIS2 Categorization in Italy
Companies should not underestimate the significance of NIS2 categorization in Italy.
The categorization framework is not a standalone compliance obligation. Instead, it constitutes the basis for the application of cybersecurity and organizational measures under the Italian NIS2 regime and will likely become a central element of ACN’s supervisory and enforcement activities.
For many organizations, this will require close coordination among cybersecurity, legal, compliance, risk management, and operational teams to ensure that the categorization accurately reflects the entity’s actual operational exposure and can withstand regulatory scrutiny.
On the matter, you can read the article NIS2 Supply Chain Management in Italy: New ACN Rules Changing Supplier Management.