Resources
NIS2
Comparison
Updated 23 September 2026
by Alessandro Monego
Epic Assess or Excel for NIS2?
When a spreadsheet is enough, when it stops being enough, and what changes with a platform built on the ACN measures.
You can do NIS2 with Excel: ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) itself publishes the basic measures in xlsx format too. Excel holds up while there are few of you, the systems are few and someone has the time to keep it up to date. It stops holding up when the evidence is scattered across folders, the deadlines sit in another diary and the approvals of the management bodies live in emails.
The comparison in one table
Updated 23 September 2026.
| Excel (or Google Sheets) | Epic Assess | |
|---|---|---|
| Software cost | Already included in the office licence | Subscription, price tailored to each company |
| Catalogue of ACN measures | The xlsx files published by ACN, to copy and maintain by hand | Built-in catalogue: 43 measures and 116 requirements for essential entities, 37 and 87 for important entities |
| Status of a requirement | A cell that someone fills in | Calculated from linked documents and evidence, not self-declared |
| Evidence | Links to folders or attached files, to keep aligned | Uploaded and linked to the requirement, with an owner and a renewal date |
| ACN deadlines | To copy into a calendar and remember | Calendar of the ACN windows and the first-application deadlines, with notifications |
| Approval by the management bodies | Outside the file (emails, minutes) | Approval workflow by role and an internal electronic signature with an audit trail (it is not a qualified signature) |
| Incident notification | A template to fill in at the worst possible moment | Incident register with the 24-hour, 72-hour and one-month windows, and pre-filled notification drafts to send on the ACN portal |
| Relevant suppliers | A sheet to reformat every year | VAT number check on VIES, questionnaire via link, export in line with the ACN template |
| Change history | The version history, if enabled | Audit log of the relevant actions |
| Ready for an inspection | To be assembled when needed | Exportable pack with documents, evidence, notifications and ACN data |
| Where the data lives | Wherever you put it | On the platform, in the cloud |
When Excel is enough
- You are a small important entity, with a single person in charge who knows the whole scope.
- The relevant network and information systems are few and rarely change.
- You already have an orderly way to keep approved documents and minutes.
- Someone takes responsibility for reviewing the file at every deadline.
To get started, use our free checklist of the ACN measures.
When it stops being enough
- More people, more files. The measures touch IT, human resources, purchasing and senior management. With several authors, the "real" file becomes hard to find.
- Evidence goes stale. Policies to review every year, roles and the risk assessment at least every two years (measures GV.PO-02, GV.RR-02, ID.RA-05). A spreadsheet does not remind you.
- Approvals matter. Eleven documents must be approved by the management bodies. In an inspection, what counts is being able to show who approved what and when.
- Incidents do not wait. With 24 hours for the pre-notification (pre-notifica), hunting for the right template is time lost.
Further reading
- How to choose NIS2 software for an SME
- ACN basic measures for NIS2: what they are and how to tackle them
The other comparisons:
- Epic Assess or an international GRC platform for NIS2?
- NIS2 consultant or platform? What each one does, and what it does not
Sources
The sources are published in Italian.
- ACN, "Modalità e specifiche di base" (basic procedures and specifications; measures in PDF and xlsx)
- ACN, Guide to reading the basic specifications (Appendix C, documents to approve)
- D.Lgs. 138/2024, Articles 23 to 25, Normattiva
- Epic Assess features: status as of 23 September 2026, internal product documentation.