NIS2 scope (perimetro NIS2)

The NIS2 scope (perimetro NIS2) is the set of organisations to which Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, applies: as a rule, medium-sized and large enterprises in the sectors listed in Annexes I and II, plus some categories included regardless of size.

The rules

Article 3 combines two criteria, sector and size:

Sector: Annex I (highly critical: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, B2B managed ICT services, space) or Annex II (postal services, waste, chemicals, food, manufacturing, digital providers, research). Annexes III and IV cover public administrations and other types of entity.
Size: you exceed the ceilings for a small enterprise, that is at least 50 employees, or turnover and balance sheet both above €10 million, as a rule also counting partner and linked enterprises.

Regardless of size, the scope includes, among others, electronic communications operators, trust service providers, TLD name registries and DNS service providers, critical entities and those that ACN (Italy's National Cybersecurity Agency) identifies (Article 3(5) to (10)). Within the scope, you are either essential or important.

Common mistakes

Confusing it with the National Cyber Security Perimeter (Perimetro di sicurezza nazionale cibernetica, Decree-Law 105/2019): it is a different law, for a small number of entities designated by the State. The NIS decree governs how the two interact in Article 33.
Thinking ACN does the registration: it is up to you to register on the ACN portal between 1 January and 28 February. ACN then draws up the list and notifies you.
Believing you are out because you are small: a relevant supplier of a NIS entity will still receive contractual requests, and ACN can include a systemic element of the supply chain.

Legal reference

Articles 3, 6 and 7 and Annexes I to IV D.Lgs. 138/2024; Recommendation 2003/361/EC.

Related terms

Sources

The sources are official texts, published in Italian.

The whole glossary