Nispo is an Italian NIS2 compliance management platform, designed for organisations subject to NIS2 in Italy. Nispo helps organisations map the NIS2 requirements and the ACN basic security measures to their own controls, collect and keep evidence, track the remediation of gaps, manage policies and suppliers, and prepare the documentation for the management body and for inspections.
Modules
The modules share the same requirements, assets, evidence and owners: data entered once counts everywhere.
The list of controls to satisfy, structured on the ACN basic security measures with National Framework codes (e.g. GV.SC-07).
What you get: You know which requirements apply, who owns them and where you stand, control by control.
Compares the status of each control with the requirement and ranks gaps by priority and impact.
What you get: A realistic work plan instead of an undifferentiated list of non-conformities.
A repository of compliance proof linked to controls: automated check results, uploaded documents, approved policies, service reports.
What you get: When someone says "prove it", the proof is already where it should be.
Turns every gap and every finding into an action with an owner, a due date and closure verification.
What you get: Measurable progress and proof that problems get closed, not just listed.
Templates for the required policies and plans (e.g. information security, access control, business continuity, incident response, supplier risk management, acceptable use), with versions, approvals and review status.
What you get: Consistent documents, always in their valid version.
An ICT supplier register with criticality, data processed, internal owner, security questionnaires and deadlines for contracts, DPAs and certifications.
What you get: Proof that supply chain assessment is being done, and with what outcome.
Generates the files to upload to the ACN portal for the annual obligations: the categorisation of activities and services and the list of relevant NIS suppliers.
What you get: The portal obligations prepared without re-entering anything, consistent with the compliance documentation.
Risks linked to assets and controls, with likelihood, impact, treatment and residual risk.
What you get: Proportionality choices that are justified and documented.
An inventory of hardware, software and services with owners; a list of the people involved in security with roles and permissions.
What you get: You know what you own and who is responsible for it.
A compliance status dashboard by area and reports for the management body and for IT, with PDF and CSV export.
What you get: An up-to-date picture to present, without building reports by hand.
Security alerts and bulletins published by CSIRT Italia (ACN), synced into the platform.
What you get: One less place to check every day.
Automation
Nispo only checks on its own what it can read from a connected system. A control’s status follows the latest automated check or the evidence uploaded by its owner; decisions stay with the organisation.
A 30-minute demo on your Microsoft 365 tenant: control register, evidence and your first real gaps.