Two interlocking clock mechanisms, one amber and one electric blue, meshing at the centre of a dark architectural hall filled with a network of glowing nodes, representing a compliance deadline and a funding window that align.
|

The October Deadline: What NIS2 Basic Measures Really Require — and the €20,000 Voucher That Can Fund Them

ByFulvio Domenico Marchetti

If you run a small company in Italy and your name is on the NIS2 list, two clocks are ticking on you right now. Hardly anyone has looked at them side by side.

The first is a legal deadline. Organisations that Italy’s national cybersecurity agency, ACN, placed on the list in 2025 have 18 months from that notice to put the basic security measures in place. ACN’s own portal puts that point in October 2026. The second clock is about money. On 20 October, the Ministry of Enterprises and Made in Italy (MIMIT) opens the first phase of its Cloud & Cybersecurity voucher: €150 million, paying half of what small businesses spend on exactly the kind of tools the measures call for.

Put together, they change the question. It is no longer only “what do we have to do?” but “what should we buy, and in what order, so that the money works for both?”

The deadline, in plain terms

Italy transposed the NIS2 Directive with Legislative Decree 138/2024, in force since 16 October 2024. The technical detail sits in ACN Determination 379907/2025, which sets out both the basic security measures and the rules for reporting significant incidents.

The deadline is not one date for everyone. It depends on when ACN told you that you were on the list. From that notice you have 18 months, and ACN’s portal places the point in October 2026. Important entities follow Annex 1 of the determination, essential entities Annex 2. The first notices went out during 2025, so the first group is reaching the line about now, while organisations notified later have correspondingly more time.

You may have seen 31 October quoted as a fixed date. Some secondary sources use it, but ACN’s own page does not. The rule ACN states is the 18-month count from your notice, so look at the date on yours instead of relying on a round number.

Incident reporting ran on a shorter clock: nine months from the notice, which brought that duty into force in January 2026 for the 2025 group. If you are on the list, you should already be reporting significant incidents to the national CSIRT. The staged timeline (early warning, notification, final report) comes from Article 23 of the Directive, and the exact terms for you are in ACN’s annexes on significant incidents. In practice, the basic measures are the second half of a two-part obligation, and the first half is already live.

On the stakes, Article 34 of the Directive sets the ceiling for administrative fines: at least €10 million or 2 per cent of worldwide annual turnover for essential entities, and at least €7 million or 1.4 per cent for important ones. The Italian penalty regime is in Legislative Decree 138/2024, which is the text to read for the exact amounts that apply to you. For most small organisations, though, the everyday risk is not the fine. It is being unable to show a customer, an auditor or ACN that the measures are in place.

Timeline from 15 October 2026 to 20 January 2027: the MIMIT webinar on 15 October, pre-filing opening on 20 October, the submission window opening on 10 November and closing on 20 January 2027, with the NIS2 basic-measures deadline shown as a band in October 2026.

What “basic measures” means in practice

The measures are built on Italy’s National Framework for Cybersecurity and Data Protection (2025 edition). ACN organises them into functions, categories, subcategories and requirements: each measure has an identifier, a description and one or more requirements that spell out what “implemented” means.

The most useful distinction for a small organisation is between what is documentary and what is technical. A good part of the list is about how you work: knowing what assets you have, assigning responsibilities, deciding how incidents are handled, keeping an eye on suppliers, keeping evidence. That costs time and attention more than licences. Another part is technical: protecting networks and devices, controlling access, patching and handling vulnerabilities, logging and monitoring, backup and recovery. That is where software, hardware and cloud services come in.

ACN has published a reading guide and a guide to building an incident-management process alongside the determination. Both are worth reading before you sign a single purchase order, because they show how much of the baseline is organisational.

What the voucher pays for, and what it does not

MIMIT created the scheme with a ministerial decree of 18 July 2025, and fixed the application rules with a director’s decree of 4 August 2026. The €150 million comes from the 2014–2020 Development and Cohesion Fund, and €71,065,813.34 of it is reserved for plans carried out in Abruzzo, Basilicata, Calabria, Campania, Molise, Puglia, Sardinia and Sicily.

The voucher is a non-repayable grant of up to 50 per cent of eligible costs, capped at €20,000, under the de minimis rules. Your spending plan must be worth at least €4,000, so the smallest grant is €2,000, and you reach the €20,000 ceiling with a €40,000 plan. MIMIT’s press release words the lower figure loosely, so read the scheme page rather than a summary: the €4,000 floor applies to the plan, not to the grant.

Four kinds of spending qualify. The first is cybersecurity hardware: firewalls, next-generation firewalls, routers and switches, intrusion detection and prevention devices. The second is cybersecurity software: antivirus and antimalware, network monitoring, data encryption, SIEM, vulnerability management. The third is cloud infrastructure and platform services, such as virtual machines, storage and backup, network and security services, and databases. The fourth is cloud software, from accounting and HR to ERP, CMS, e-commerce and CRM. Configuration, monitoring and ongoing support count too, up to 30 per cent of the plan. Training is explicitly excluded.

Three conditions shape what you can actually put in a plan:

  • Approved suppliers only. Products and services must come from suppliers on MIMIT’s list, fixed by decree on 29 July 2026.
  • New or better, not more of the same. The rules exclude solutions equivalent to what you already have, version upgrades without a substantial improvement, and extra licences or seats for tools you already own.
  • A clock of its own. Outright purchases must be completed within twelve months of the grant notice. Subscriptions must run for at least 24 months, and the eligible cost is capped at the first 24.

You also need an internet connection of at least 30 Mbps download, and a declaration that you have the mandatory catastrophe-risk insurance required by Law 213/2023. The scheme is for micro, small and medium-sized enterprises and for self-employed professionals, and each applicant can file only one application.

One point is easy to get wrong. The voucher is not a NIS2 measure, and nothing in MIMIT’s rules refers to the directive. It pays for cybersecurity and cloud tools. It does not certify that you comply with anything.

Matching the obligation to the spend

Because the obligation and the grant come from different authorities, nobody connects them for you. The map below shows the logic: which areas of the baseline you can cover with tools the voucher will pay for, and which need work that no voucher funds. Treat it as an illustration of the reasoning, not as a reading of specific ACN measure codes, which you should take from the annex that applies to you.

Map linking six areas of the NIS2 baseline to tools the voucher can fund, such as firewalls, scanning software, SIEM, cloud backup and encryption, and to activities it cannot fund, such as policies, ownership, procedures and training.

The right-hand side of that map is the part people miss. Roughly speaking, the voucher covers the tools, not the decisions, and the baseline is about both.

A sequence that works

Start with a gap analysis. Check your situation against the annex that applies to you before you go shopping. It tells you which measures you already meet, which need a tool, and which need only a procedure. Your shortlist for the voucher should come out of that exercise, not the other way round.

Check the supplier list. MIMIT has published it through Invitalia’s portal. Offers must come from listed suppliers and carry the identifiers of the listed products. A plan that is excellent in substance but built on an unlisted product is not eligible.

Follow the calendar. MIMIT holds a webinar on how the filing platform works on 15 October, from 10:00 to 12:00. Pre-filing opens at 12:00 on 20 October. The formal submission window runs from 12:00 on 10 November 2026 to 12:00 on 20 January 2027. Access is through SPID, the national services card or the electronic identity card, by the legal representative or a delegate, and the supplier offers go in with the application.

File early, but do not treat it as a race. Applications are examined in chronological order, and the desk closes as soon as the money runs out. It is not a click day, but 20 January is a ceiling, not a promise. A prepared company that files in the first weeks is better placed than one that files at the last minute.

Keep the evidence. Invoices and proof of payment must carry the project code and the identifier of the funded product, and you cannot ask for payment earlier than three months after the grant is notified. Those same documents are what you will show if anyone asks how you met the baseline.

What to take from it

For an Italian SME on the NIS2 list, October 2026 is a starting line, not a finish. Customers’ supply-chain questions will keep coming, and the duty to report incidents is already in force. But the overlap of the two calendars is real, and it is unusual for a compliance deadline and a grant to point at the same set of purchases.

The risk is buying to fit the grant. A firewall bought for the voucher is not a measure; a firewall that is configured, monitored and documented is. Start from the obligation, let it define the plan, and treat the 50 per cent as what it is: a way to pay for the part of the baseline that comes in a box.

Related reading

Sources

Relevant OneSynergy service

EU AI Act Readiness and AI GovernanceExplore →

Similar Posts

Leave a Reply

Your email address will not be published. Required fields are marked *