In recent weeks many entrepreneurs have asked me the same question in different words: “What must we have in the drawer if an inspection comes?” Behind it is an understandable idea: NIS2 is a file, and files are closed with documents.
I have bad news and good news. The bad: a drawer full of documents is useless if the documents do not describe what the company really does. The good: ACN is far more concrete than people think, and for an SME the work is feasible in a few weeks.
What ACN asks, in plain terms
In its FAQ on the baseline measures (question MSB.11), the National Cybersecurity Agency (ACN) lists six families of documents needed to attest that the measures have been implemented:
Lists
The personnel of the cybersecurity organisation and systems accessible remotely (for essential entities also reference configurations).
Inventories
Physical devices, services, systems and software applications, services provided by suppliers and the suppliers themselves (for essential entities also network flows).
Plans
Risk management and treatment, business continuity and recovery, vulnerability management, compliance, training and incident response.
Policies
Defined at least for the requirements in the tables in the appendix to annexes 1 (important entities) and 2 (essential entities) of ACN determination 379907 of 19 December 2025.
Procedures
For the requirements that call for them.
Registers
Outcomes of policy reviews, employee training, maintenance carried out.
Three details of the FAQ deserve emphasis, because they reassure more than people think.
You do not need a tome for each item. An entity may decide how to organise its documentation, for example by grouping content in a single document or spreading it across several, on paper or digitally, as long as it is easy to consult for those who need it.
There is no mandatory template for risk assessment. Each entity may use the one already in use or the one it considers most appropriate (MSB.9).
The scope can be delimited. Where a requirement refers to “relevant network and information systems”, the entity may limit application to the systems whose compromise would have a significant impact on the services for which it falls within NIS2 (MSB.7). Delimiting the scope well is half the work.
And the deadlines? A reminder
The deadline is not the same for everyone. For entities added to the NIS list in 2025, the baseline measures must be adopted within 18 months of receiving the notice of inclusion, and for the notification of significant incidents the term is 9 months. For entities added for the first time in 2026, the measures are due on 31 July 2027 and notification applies from 1 January 2027. The first step is always the same: find the date of your own notice.
The real risk: “on paper” documentation
Working with companies, the most common problem is not missing documents. It is documents detached from reality. An inventory frozen three years ago. A continuity plan nobody has ever tested. A password policy signed by the owner that nobody in the company knows.
ACN’s FAQ say it plainly: documents must reflect the current situation and be updated when the facts change. This is not a detail. It is the difference between evidence and risk.
A policy that is written but not applied is not evidence: it is an admission.
What public cases teach us
There is no need to look far. Two cases reported in the press show the value of living documentation.
Autonomous Province of Bolzano, June 2025. After the attack that disabled the telephone systems of some civil-protection centres, operations continued manually, with extra staff at the emergency centre, and emergency calls stayed active (source: MB Time, reporting official communications). This does not happen by chance: it happens because there is an emergency plan known to those who must apply it.
Lazio Region, August 2021. The analysis published by Cybersecurity360 observes that the body, although among critical infrastructure, did not appear to have an adequate incident response plan, that public communications were imprecise and that the backups were not isolated. There too, the problem was not the quantity of documents, but the distance between what was written and what happened in practice.
The comparison speaks for itself: the same type of attack, two very different outcomes, and the difference lies in preparation.
My advice: six weeks, one file, two people
For an SME it is not an enormous project. It is an orderly path. Here is how we set it up with our clients.
Week 1: people and perimeter
Appoint the point of contact and the CSIRT representative, with deputies. Decide which are the “relevant systems”, those without which the company stops. Produce the first list: who belongs to the security organisation and which systems are remotely accessible.
Week 2: inventories
Devices, software, suppliers’ services and suppliers. A table is enough, as long as it is true. For each row: what it is, who is responsible, what happens if it stops.
Week 3: approved policies
A few pages, in understandable language, formally approved by management with date and signature. Remember ACN’s indication to make policies known to the competent departments, on a “need to know” basis.
Week 4: plans
Continuity and recovery, incident response, vulnerability management, training. For incidents remember that the pre-notification to CSIRT Italia must be sent without delay and in any case within 24 hours of becoming aware, and the full notification within 72 hours. The cause of the incident is irrelevant: human error or a malfunction also fall under the obligation.
Week 5: test
A one-hour simulation with management: tonight we lost our files. Who calls whom? Where is the backup? Who notifies, and within what terms? Note everything in the register.
Week 6: registers and review
Close the loop: register of training, of maintenance, of policy review. Set a date for the next review.
Two points on suppliers that reduce anxiety a great deal. First: the FAQ clarify that it is not mandatory to retroactively adapt all existing contracts. Security requirements must be included in contracts concluded, renewed or extended from the deadline for the measures, according to the outcome of the supply risk assessment (MSB.12, MSB.14). Second: the requirements need not reproduce the measures verbatim, it is enough that they incorporate their substantive content (MSB.16).
What I do not recommend: relying on a consultant who hands you a binder of ready-made documents. A good consultant builds the documents with you, because only then do they reflect the real company. And do not spend on a “NIS2 certificate”: it does not exist.
What I think, in conclusion
Documentary evidence is not the aim. It is the way a company proves, first to itself and then to an authority, that it knows what it has, who is responsible and what to do when something goes wrong. Done well, it becomes an advantage: in tenders, with German and Austrian customers, with the bank.
In South Tyrol reputation is built over decades and lost in a day. The security file is the way to protect it, with the same seriousness with which we are used to safeguarding a balance sheet.
A document not approved by management and not known to those who must apply it is not evidence: it is a risk.
Three questions for management
Do we have an up-to-date inventory of critical systems, services and suppliers, and do we know who updates it?
Without an inventory, risks cannot be assessed and priorities cannot be set.
Who in management approved the policies, on what date, and do the staff who must apply them really know them?
Management approval is part of the evidence.
Have we tested the incident response plan at least once, and do we know who sends the pre-notification to CSIRT Italia within 24 hours?
The initial notification has very tight deadlines: the people who must carry it out need to know the procedure.
Sources
ACN, NIS FAQ – Security measures and incident notification (MSB.7, MSB.9, MSB.11, MSB.12, MSB.14, MSB.16, ISB.G.2, ISB.G.4; in Italian); ACN determination 379907 of 19 December 2025 (in Italian); MB Time, Attacco informatico alla Provincia di Bolzano (25.06.2025); Cybersecurity360, Regione Lazio e ransomware, lieto fine amaro (08.08.2021). The information was checked on the ACN website on 23 October 2026: always consult the latest version.