NIS2
Glossary
Det. ACN 379907/2025, Allegati 1 e 2
Updated 23 September 2026
by Alessandro Truffo
Basic security measures (misure di sicurezza di base)
The basic security measures are the list of technical and organisational measures that ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) requires of NIS2 entities to meet Articles 23 and 24 of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition: 43 measures with 116 requirements for essential entities, 37 measures with 87 requirements for important entities.
Where they come from
They are the technical annexes to ACN Determination 379907/2025 (the "basic obligations determination"), which replaced 164179/2025: Annex 1 for important entities, Annex 2 for essential entities. Each measure carries a code from the National Framework for Cybersecurity and Data Protection (Framework nazionale), in the format function.category-number: GV (govern), ID (identify), PR (protect), DE (detect), RS (respond), RC (recover). For example, PR.AA-03 is multi-factor authentication.
The 6 extra measures for essential entities are ID.AM-03, PR.AT-02, PR.PS-01, PR.PS-03, PR.IR-03 and RC.CO-03; another 10 have additional requirements.
In practice
The measures are proven with documents: inventories, plans, policies, procedures, registers. Eleven documents must be approved by the management bodies, including the security policies, the risk assessment and the incident management plan. Many requirements apply "to at least the relevant network and information systems", and some allow exceptions for "justified and documented regulatory or technical reasons", to be covered with compensating measures.
Deadlines: for entities added to the list in 2025, 18 months from ACN's notice (October 2026, according to ACN); for entities added in 2026, 31 July 2027.
Legal reference
ACN Determination 379907/2025, Annexes 1 and 2; Articles 23, 24, 31 and 42 of D.Lgs. 138/2024; ACN Determination 127434/2026 for the deadlines of the new 2026 entities.
Related terms
Further reading
- ACN basic measures for NIS2: what they are and how to tackle them
- NIS2 deadline of October 2026: what you need to have ready
Sources
The sources are official texts, published in Italian.
- ACN, "Modalità e specifiche di base" (basic procedures and specifications, annexes and xlsx versions)
- ACN, reading guide to the basic specifications (Guida alla lettura delle specifiche di base, v2.1, April 2026)
- ACN, FAQ on basic measures and notifications (MSB.3)
- D.Lgs. 138/2024, Articles 24 and 42, Normattiva