The Italian NIS framework distinguishes essential and important entities and calibrates baseline obligations accordingly. For compliance planning, the practical objective is to map entity classification to the correct annexes, control depth, and incident-typology obligations.
Sources: ACN baseline reading guide, ACN baseline obligations determination
Key takeaways
- Essential and important entities follow different baseline annexes.
- Security-measure depth is generally higher for essential entities.
- Incident typologies are differentiated by entity category, with additional scope for essential entities.
- Classification must be documented because it drives control selection and audit scope.
Sources: ACN baseline reading guide
Baseline annex mapping
1. Security measures
- Annex 1: baseline security measures for important entities.
- Annex 2: baseline security measures for essential entities.
2. Significant incidents
- Annex 3: baseline significant incidents for important entities.
- Annex 4: baseline significant incidents for essential entities.
Sources: ACN baseline reading guide, ACN baseline obligations determination
Operational implications for compliance teams
| Area | Important entities | Essential entities |
|---|---|---|
| Measure baseline | Baseline set per Annex 1 | Extended/deeper baseline per Annex 2 |
| Incident typologies | Typologies per Annex 3 | Typologies per Annex 4 (including additional scope) |
| Program planning | Standard baseline rollout | Enhanced control depth and evidence coverage |
| Audit preparation | Annex-specific evidence mapping | Broader evidence set due to expanded obligations |
Sources: ACN baseline reading guide
90-day implementation checklist
- Confirm and document entity classification rationale.
- Map applicable annexes and obligations to control owners.
- Re-baseline evidence requirements according to entity category.
- Validate incident-classification workflow against the correct annex set.
- Run governance review on classification-dependent compliance gaps.
FAQ
Can one control set be applied unchanged to both categories?
Not reliably. Baseline obligations are differentiated by category and should be mapped to the applicable annexes.
Sources: ACN baseline reading guide
Do essential entities have additional incident scope?
Official baseline guidance indicates differentiated incident typologies, with additional scope for essential entities.
Sources: ACN baseline reading guide
What is the first audit risk in this area?
Using the wrong annex mapping for entity classification, which leads to incomplete controls and evidence.
Sources: ACN baseline obligations determination, ACN baseline reading guide