Who does NIS2 apply to?
Directive (EU) 2022/2555 covers essential and important entities identified by sector, size and exceptions. Italy implements it through Legislative Decree 138/2024. Being an SME or supplying a NIS2-regulated customer does not automatically put you in scope.
Suppliers may still receive requests for security evidence. Check your status and applicable duties with the competent authority and a qualified adviser; national implementation matters.
Which technical evidence can you collect?
Article 21 requires a range of cybersecurity risk-management measures. The following information supports selected activities, without fully covering any measure.
- Assets — Article 21(2)(i): an updated inventory of servers and installed software, including containers.
- Vulnerabilities — Article 21(2)(e): daily checks, update priorities and vulnerability decisions with the person, time and reason recorded.
- Assessing measures — Article 21(2)(f): decision history can inform assessment, but is not a complete evaluation of effectiveness.
- Cyber hygiene — Article 21(2)(g): unsupported operating systems and expiring SSL certificates flagged.
- Incidents — Article 21(2)(b): availability and threshold alerts, with start, acknowledgement and resolution history. AI explanations depend on the plan and describe likely causes.
- Continuity — Article 21(2)(c): availability monitoring, disk and memory forecasts and status pages. These do not replace backups, recovery or crisis management.
- Suppliers — Article 21(2)(d): separate customer areas and monthly operational reports on availability, incidents and certificates. These are not NIS2 or security reports.
NIS2 reporting: incident history is a starting point
Article 23 addresses significant incidents: generally an early warning within 24 hours of awareness, an incident notification within 72 hours and a final report within one month of that notification. Special cases apply, including ongoing incidents; not every technical alert is a significant incident.
Available timestamps, errors and analysis in Obermon help reconstruct events. Obermon does not generate or submit notifications to Italy’s ACN: classification, deadlines and submission remain the organisation’s responsibility.
Start with evidence, not a compliance promise
Connect Linux servers, check the inventory and assign responsibility for priority vulnerabilities. Record decisions and verify update outcomes. Use these records alongside your risk-management processes.
Obermon is not antivirus or a firewall. MFA, SSO, audit logs, evidence exports and customer security reports are not part of the capabilities described in this guide.
Sources and further reading
This information does not replace a technical or legal assessment of your circumstances.