NIS2 Cybersecurity Directive: What Italian SMEs Actually Need to Know

The EU's NIS2 Directive (2022/2555), transposed into Italian law via D.Lgs. 138/2024 and effective from October 16, 2024, raises cybersecurity obligations for companies operating in 18 critical sectors. Direct compliance requirements apply mainly to medium and large enterprises in those sectors, meaning most small and micro businesses face no mandatory obligations under the law. However, SMEs that supply software or services to regulated companies may still feel the directive's impact indirectly through contractual demands from their clients. Regulated firms must secure their supply chains, leading them to request security guarantees — such as incident notification procedures and vulnerability management practices — from their vendors. While failing to meet these requests carries no legal penalty for suppliers, it can result in the loss of business contracts, making NIS2 a practical commercial concern even for companies outside its formal scope.