NIS2 does not end with a project: people, systems, suppliers and rules change.
Key facts
- ACN requires documentation to reflect the current state and be updated whenever something changes: NIS2 compliance is not reached once and for all.
- In Nispo automated checks repeat, documents and suppliers have deadlines, and every new gap becomes a task tracked until it is closed.
- When ACN changes the measures (as in December 2025, with Determination 379907/2025) Nispo updates the control mapping.
What changes during the year
| What changes | Example | Effect |
|---|---|---|
| People | A new IT admin without MFA | A control becomes non-compliant again |
| Systems | A new cloud service | Inventory and scope to update |
| Suppliers | A new ERP supplier | Assessment and contract requirements to define |
| Deadlines | A supplier’s DPA or certification expires | Evidence no longer valid |
| Documents | Annual review of a policy | To review and re-approve |
| Rules | ACN updates the basic measures | Requirements to re-read |
| Threats | A CSIRT Italia bulletin on software you use | Assessment and, if needed, remediation |
The cycle in Nispo
- Check: automated checks repeat, owners update manual controls.
- Detect: a worse result, an expiring document or an unassessed supplier becomes a gap.
- Assign: every gap becomes a task with an owner and a due date.
- Close: with evidence or with the new check result.
- Report: the dashboard and reports show the trend to management.
Recurring deadlines
- 1 January – 28 February: registration or update on the ACN portal.
- 15 April – 31 May: annual update with relevant NIS suppliers (Nispo generates the file from the supplier register).
- Periodically: supplier verification, review of policies and plans, update of inventories and risk analysis.
- Always: the ability to notify a significant incident to CSIRT Italia within 24 hours.
An annual assessment describes the state of a single day. Continuous compliance does not mean more work: it spreads it over time instead of concentrating it before an inspection.