What inspectors can ask for and how to be ready.
- In Italy NIS supervision belongs to ACN: ex ante and ex post for essential entities, ex post only for important entities.
- Being prepared means being able to show, for each requirement, what was done, by whom, when and with what proof.
- In Nispo this material sits in a single exportable register. “Audit-ready” means complete, findable documentation, not a guaranteed outcome.
Who inspects, and what they ask for
ACN can request information and documentation and carry out inspections. For essential entities checks can happen even without an incident; for important entities they are triggered, for example, by an incident or by signs of non-compliance.
In practice you are asked to prove that the basic measures are implemented: the documentation ACN specifies (which), management approval, supplier assessment, incident procedures and technical evidence on the relevant systems.
Preparation checklist
- The entity’s category and the scope of relevant systems are documented.
- Every requirement has an owner, a status and dated evidence, or an open task with a due date.
- Policies and plans are in their approved version.
- Inventories and the supplier register are up to date.
- Whoever must notify an incident to CSIRT Italia knows the procedure and deadlines (24 hours, 72 hours, one month).
- Management has received and approved the status of the measures.
- The effectiveness of the measures has been assessed, for example with a penetration test and retest.
- Everything can be found quickly, without reconstruction.
How Nispo helps
The checklist can be read straight from the register: requirements, owners, dated evidence, versioned policies and suppliers are in one place, exportable to PDF and CSV for the inspector. Penetration testing and vulnerability assessment bring findings and retests into the register. Nispo does not represent the company before the authority and does not guarantee the outcome.