Essential entity (soggetto essenziale)

An essential entity (soggetto essenziale) is an organisation that falls under Italy's NIS2 law in the most demanding category: it must adopt 43 basic security measures and faces fines of up to €10 million or 2% of worldwide turnover.

Who is essential

Under Article 6 of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, the following are essential:

enterprises in the sectors of Annex I (highly critical sectors: energy, transport, health, water, digital infrastructure, B2B ICT service management and others) that exceed the ceilings for a medium-sized enterprise: in practice at least 250 employees, or turnover above €50 million and a balance sheet total above €43 million;
regardless of size, critical entities identified under Directive (EU) 2022/2557, qualified trust service providers, top-level domain name registries and DNS service providers;
providers of public electronic communications networks and publicly available electronic communications services that are at least medium-sized enterprises;
the central public administrations of Annex III;
entities that ACN designates as essential under Article 6(2).

In practice

Compared with an important entity, an essential entity has more measures (43 against 37) and more requirements (116 against 87), notifies one more type of incident (IS-4, unauthorised access or access that abuses privileges) and can be inspected by ACN (Agenzia per la Cybersicurezza Nazionale, Italy's National Cybersecurity Agency) ex ante too, that is without any sign of an infringement. The fines have a minimum equal to one twentieth of the maximum.

Common mistake: counting only your own company's figures. For size, the figures of partner and linked enterprises are, as a rule, added together (Article 3(4), which refers to Recommendation 2003/361/EC).

Legal reference

Article 6(1), D.Lgs. 138/2024; size thresholds: Article 2 of the annex to Recommendation 2003/361/EC; measures: Annex 2 of ACN Determination 379907/2025.

Related terms

Sources

The sources are official texts, published in Italian.

The whole glossary