Incident-notification obligations are already live in first application. Baseline security-measure adoption remains due by October 2026. For most organizations, the immediate task is to close the mandatory Appendix C document package and complete board-level approvals in time.

Key takeaways

• Appendix C identifies 11 documents that require approval by governing and management bodies.
• The incident-notification obligation is already live; documentary governance cannot remain in draft-only status.
• The baseline-measure implementation milestone remains October 2026, so approval and evidence cycles should be completed before that date.
• A template-driven approach accelerates consistency, but accountability remains with the organization.

Live timeline status (first application)

Appendix C matrix: mandatory documents requiring board-level approval

How to structure the mandatory package without exposing sensitive implementation details

1. Keep approval governance explicit

Each document should include owner, approver, approval date, review cadence, and version history.

2. Keep scope and boundaries explicit

State which systems, services, and organizational units are covered and which are out of scope with rationale.

3. Keep evidence hooks embedded

For each policy/plan, define required records and where evidence is stored (registers, logs, reports, minutes).

4. Keep operational dependencies mapped

Link each document to procedures, inventories, and responsible teams so approval is not detached from execution reality.

Minimum content blocks to standardize across all 11 documents

1. Purpose and legal/reference basis.
2. Scope and applicability conditions.
3. Roles and responsibilities (including substitutes where relevant).
4. Required controls or operational steps.
5. Evidence and record-keeping requirements.
6. Exceptions and risk-based rationale fields.
7. Review/approval/update cycle.

30-day board-ready activation checklist

1. Build one consolidated register of the 11 mandatory documents and assign owners.
2. Align template versions and remove contradictory definitions across documents.
3. Add approval blocks and review cadence to all mandatory documents.
4. Run legal/compliance quality review before board submission.
5. Schedule board/management approval sessions and track decisions in minutes.
6. Link approved documents to execution procedures and evidence registers.

FAQ

Are all Appendix C documents required to be approved by governing bodies?

Yes. Appendix C explicitly lists the documents and references the specific requirements requiring approval.

Is the incident-notification obligation still a future milestone?

No. In ACN first application, the 9-month milestone is January 2026, and the obligation is already live.

How can organizations accelerate this phase without lowering quality?

A standardized template library with controlled data collection, versioning, and approval workflow usually reduces rework and governance friction while preserving accountability.

Conclusion and next steps

The most effective sequence is: lock the Appendix C mandatory package, complete board approvals, and connect each approved document to operational evidence flows before October 2026. Aegister’s template-driven compliance workflows are designed to support this transition with structured collection, controlled drafting, and governance-ready outputs.

Related reading

• NIS2 baseline obligations in practice: master overview for governance, controls, and incident operations
• NIS2 operational templates for GRC teams: what to prepare and why it matters
• NIS2 Documentary Evidence and Audit Readiness: How to Structure Compliance Proof
• Aegister NIS2 Compliance Service
• Aegister Virtual CISO Service

Official sources

• ACN – Guida alla lettura delle specifiche di base
• ACN – Determinazione obblighi di base 379907/2025
• ACN – Modalità e specifiche di base
• Gazzetta Ufficiale – Decreto Legislativo 138/2024