UNI/PdR 174:2025 for NIS Organizations Certified to ISO 27001: What It Changes Operationally

ACN published UNI/PdR 174:2025 as an operational bridge between ISO/IEC 27001 and NIST CSF 2.0 for NIS-scoped organizations. It helps ISO-certified e…

SECURE First Open Call 2026: What mSMEs Need to Submit Before 29 March 2026

The SECURE First Open Call (28 Jan – 29 Mar 2026) offers up to EUR 30,000 per project at 50% co-financing to help mSMEs achieve Cyber Resilience Act …

NIS2 Point of Contact and CSIRT Contact Role: Accountability and Operating Duties

NIS2 implementation guidance distinguishes the legal Point of Contact from the operational CSIRT contact role. Practical guide to role formalization,…

NIS2 Supply-Chain Security: Managing Critical Suppliers and High-Impact Procurements

NIS2 supply-chain security is a governance obligation covering supplier identification, risk assessment, contractual integration, and lifecycle monit…

NIS2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof

ACN baseline guidance requires documentary evidence as a core compliance element. Practical guide to evidence families, obligation-to-evidence mappin…

NIS2 Significant Incident IS-3: Violation of Expected Service Levels

IS-3 in the ACN baseline model covers service-level violation incidents affecting entity services and activities. Practical guide to qualification, s…

NIS2 Significant Incident IS-2: Integrity Loss Affecting Digital Data

IS-2 in the ACN baseline model covers integrity loss affecting digital data under entity ownership or control. Practical guide to qualification, evid…

NIS2 Significant Incident IS-1: Confidentiality Loss Affecting Digital Data

IS-1 in the ACN baseline model covers confidentiality loss affecting digital data under entity ownership or control. Practical guide to qualification…

NIS2 Incident Typology Model: Condition, Compromise, and Affected Object

ACN baseline guidance classifies significant incidents through condition, compromise, and object of compromise. Practical guide to using the typology…

NIS2 Recovery Controls (RC): Operational Resilience and Service Restoration

The NIS2 Recovery (RC) domain defines how entities restore operations after incidents and sustain resilience. Practical guide to restoration procedur…

NIS2 Response Controls (RS): Containment and Eradication in Incident Handling

Containment and eradication are iterative response steps that limit damage and remove attacker persistence. Practical guide to strategy selection, ev…

NIS2 Response Controls (RS): Signaling and Investigation Operating Model

The NIS2 Response (RS) domain requires structured incident response through signaling, investigation, and iterative decision loops. Practical guide t…

NIS2 Detection Controls (DE): Event Monitoring and Adversarial Signal Handling

The NIS2 Detection (DE) domain requires monitoring networks, services, and endpoints to identify adverse events early. Practical guide to log readine…

NIS2 Protection Controls (PR): Technical and Organizational Measures in Execution

The NIS2 Protection (PR) domain translates risk decisions into safeguards over identities, data, platforms, and infrastructure. Practical guide to PR…

NIS2 Identification Controls (ID): Inventories, Risk Assessment, and Improvement Cycle

The NIS2 Identification (ID) domain covers asset visibility, risk assessment, treatment planning, vulnerability processes, and improvement cycles. Pr…

NIS2 Governance Controls (GV): Policies, Roles, and Accountability Model

The NIS2 Governance (GV) domain defines cybersecurity direction, accountability, and oversight. Practical guide to implementing GV controls: context,…

NIS2 Article 25 in Practice: Incident Notification Obligations and Operating Timeline

Article 25 of Italy's NIS decree requires notification of significant incidents to CSIRT Italia. Practical guide to the 24h/72h notification timeline…

NIS2 Article 24 in Practice: How to Implement Cybersecurity Risk-Management Measures

Article 24 of Italy's NIS decree requires proportionate cybersecurity measures. Practical guide to implementing control families (GV/ID/PR/DE/RS/RC) …

NIS2 Article 23 in Practice: Obligations for Management and Governing Bodies

Article 23 of Italy's NIS decree requires governing bodies to formalize cybersecurity governance, approve policies, oversee implementation, and maint…

NIS2 Baseline Obligations in Practice: Master Overview for Governance, Controls, and Incident Operations

Master overview of Italy's NIS2 baseline obligations covering governance (Art. 23), risk management (Art. 24), and incident notification (Art. 25). A…