NIS2 in Italy: what it requires of PLCs, HMIs and remote support
For companies added to Italy's NIS list in April 2025, the security measures were due by mid-October. They also cover PLCs, operator panels and the routers machine builders use for remote support.
In this article
People have been talking about NIS2 for two years, almost always about the office: email, passwords, servers, data backups. But the decree that brought it into Italian law, Legislative Decree 138 of 2024, and the measures issued by Italy's National Cybersecurity Agency (ACN) also reach the shop floor.
We mean PLCs, operator panels, supervisory PCs and the routers machine builders use to connect to their machines: the things we work on every day. Below is what the rules ask for, with the reference for each point, checked against the texts in force on October 15, 2026: the decree, unchanged since 2024, and ACN Determination 379907 of December 19, 2025.
This article covers Italy. Every EU country transposes the same directive, but with its own law, its own agency and its own timetable.
A different deadline for every company
Companies covered by NIS2 register on ACN's platform. The Agency draws up the list and sends each one a notice of inclusion. For companies added to the list in 2025, two clocks start that day, set in the decree (Article 42) and in the determination: nine months to start notifying incidents, eighteen months to adopt the security measures.
The first notices went out by certified email (PEC) on April 12 and 13, 2025. ACN does not give the exact day; it says “by October 2026.” The math is simple, though: for those companies the eighteen months ran out on October 12 or 13, 2026.
The “October 31” you see in many guides does not appear in any of the Agency's texts. If ACN's notice reached you in April 2025 and you were counting on October 31, your deadline has already passed.
- ACN sends its first notices of inclusion in the NIS list, by certified email.
- For those companies, the obligation to notify significant incidents starts.
- The current version of the basic measures applies (ACN Determination 379907/2025).
- The eighteen months for the security measures run out for the first companies on the list.
- Window to register, or to update an existing registration.
- Deadline to adopt the measures for companies added to the list in 2026 (ACN Determination 127434/2026).
Companies added later in 2025 count the eighteen months from the date of their own notice. Those added in 2026 have a fixed deadline: July 31, 2027.
After the deadline, the Agency does not carry out surprise inspections at “important” entities, which is what almost all factories are. It can inspect when there are signs of a violation, for example after an incident or a report (Article 36). For an important entity, penalties for not applying the measures go up to €7 million or 1.4% of total worldwide annual turnover (Article 38).
Who is covered, industry by industry
Medium and large companies with an activity listed in the decree's annexes are covered. For ACN, doing it even in part is enough, and what the company actually does matters more than its ATECO code (Italy's version of the NACE codes) in the business register. Medium-sized means 50 or more employees, or turnover and balance sheet total both above €10 million, including linked companies.
For factories, Annex II is the one that matters. In 2025 the list had more than 21,800 entities: over 4,000 in manufacturing, over 3,000 in food, over 1,000 in chemicals. Almost all of them are “important” entities, even the large ones. Here is where the industries we work in stand, from medium-sized companies up.
| Industry | Covered by NIS2? | Why |
|---|---|---|
| Cable and fiber optics | Yes | Manufacture of electrical equipment, division 27 (ATECO 27.31 and 27.32). |
| Machine builders | Yes | Division 28, including packaging machinery and food processing machinery. |
| Control panels | Yes | Division 27 (ATECO 27.12). |
| Food and beverage | Yes, if industrial | Industrial production and processing, wholesale distribution. |
| Chemical | Yes | Manufacture of substances and distribution of substances or mixtures, for companies subject to REACH. |
| Rubber, packaging, metalworking | To be assessed | Not among the manufacturing activities in Annex II; they may come in through chemicals as “producers of articles.” |
The last row is the least certain. Under chemicals, the decree also includes companies that produce articles from substances or mixtures, using the REACH definition. Read literally, it could cover tires, packaging or molded parts. The European Commission proposed narrowing it in January 2026, but it is still a proposal before the European Parliament. It needs to be assessed case by case.
Legally, a PLC is an information system
NIS2 requires measures for “network and information systems,” and the Italian decree uses the directive's definition:
“Any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data.”
Directive (EU) 2022/2555, Article 6, point (1)(b)
A PLC runs a program on digital data, and so do the operator panel, the supervisory PC, the networked drive and the router. On the fiber-optic towers we automated, for example, each tower's operator panel is networked with the rest of the machine.
In its FAQs, ACN writes that the measures apply, in principle, to all of a company's systems. Some can be limited to “relevant” systems: those that, if compromised, would significantly affect the activity the company is listed for. In a factory, that activity is production.
ACN's reading guide to the measures never mentions PLCs or SCADA. In the 37 measures for important entities, the acronym OT, the operational technology that runs the lines, appears only once, in the inventory measure:
“An up-to-date inventory is maintained of the physical equipment (hardware) making up the network and information systems, including IT, IoT, OT and mobile devices […].”
ACN Determination 379907/2025, Annex 1, measure ID.AM-01 (our translation)
When downtime becomes an incident
Companies on the list notify significant incidents to CSIRT Italia, the ACN unit that collects reports: an early warning within 24 hours of becoming aware of the incident, a notification within 72 hours, a final report within one month of the notification (Article 25).
For an important entity there are three kinds of significant incident. The third is a breach of the expected service levels. The company sets those levels itself for its activities, usually as availability, and production is one of the activities the ACN guide gives as an example.
For ACN the cause doesn't matter: malfunctions and human error count too. But it takes an event that hits the network and information systems. A failed bearing is not a NIS incident. A PLC locked up by an attack, or by a bad configuration, that stops the line beyond the set level can be.
So by writing those levels, the company decides on its own when a stoppage will have to be reported. It pays to write them together with the people who look after the lines on the floor.
What the measures ask of machines
There are 37 measures for important entities and 43 for essential ones. These are the ones that show up on the shop floor.
The inventory
Two inventories have to be kept up to date: hardware, OT included, and software, custom software included (ID.AM-01 and ID.AM-02). For a line, that means every CPU, panel, PC, switch, router and modem, with model and version. PLC programs, written for that specific machine, count as custom software.
The starting point is up-to-date electrical drawings. If we built the line, the job number gets you drawings, PLC backups and bills of materials. If the drawings no longer match the panel, they are redrawn from a survey, terminal by terminal: that's the first step in every revamp we do.
Software that no longer gets updates
Based on the risk assessment, only software with guaranteed security updates is installed, operating systems included (PR.PS-02). Microsoft stopped updating Windows Embedded CE 6.0 in 2018, yet it still runs panels that are on sale today, such as the Siemens TP700 Comfort. Support for Windows 10 2016 LTSB ended on October 13, 2026.
Siemens dropped the S7-300 from its price list on October 1, 2025. For one known vulnerability in the family, it states that no fix is currently planned, and it advises protecting network access to the PLC.
The measure allows an exception for justified, documented regulatory or technical reasons. The compensating measures and the residual risk go into the risk treatment plan, approved by top management (ID.RA-06). ACN's example is medical devices, which could lose their certification with antivirus software installed. Whether that holds for a panel validated by the machine builder has to be assessed case by case.
The exception does not cover the remote access log, the list of systems reachable from outside, the inventory or the backups.
For systems that can't be updated, a January 2026 guide from the British, American, German and Dutch security agencies lists the compensating measures: separate the machine from the rest of the network, give access only to those who need it, when they need it, and log who gets in. The guide treats them as stopgaps until the device is replaced.
Replacing the parts that no longer get updates, while keeping the rest, is what we do in a revamp: we change the CPU and the panel, and the field devices and wiring usually stay where they are.
Backups and USB drives
Data and configurations have to be backed up regularly, with offline copies for relevant systems (PR.DS-11). On a line, the configurations are the PLC program, the HMI project, the recipes and the drive parameters. When we finish commissioning, we leave backups of the PLC, the HMI and the drives, with the version left in the machine and the date on them.
USB drives have to be scanned before use, with autorun disabled (PR.DS-01). That includes the one an outside technician plugs in to load an update onto the panel.
Remote support, point by point
This is the part that matters most to anyone who builds or maintains machines. There are four measures to look at, three on remote access and one on authentication:
- accounts used for remote access are inventoried, approved and individual, unless there are documented technical reasons (PR.AA-01);
- multi-factor authentication is used on relevant systems, based on the risk assessment (PR.AA-03);
- all remote access is logged, with no filters and no exceptions (PR.PS-04);
- there is an up-to-date list of the systems that can be reached remotely, with how each one is accessed (PR.IR-01).
On production lines you still find the machine builder's router, always on, with one password shared by all its technicians and no access log. Under these measures the log is always required, and a shared password is allowed only with a written technical reason.
Every remote support session has to leave a written record of who logged in, when and with which account.
On August 19, 2026, five U.S. federal agencies, including CISA, the NSA and the FBI, published an advisory: attackers are searching the internet for Siemens S7 PLCs that can be reached from outside, including the S7-300 and S7-400 series, and building tools to get into them. The cases described involve U.S. facilities; ACN picked up the advisory in its August bulletin.
The advisory recommends multi-factor authentication for all remote access to the machine network. And it warns that companies working with integrators who connect remotely may not know they are exposed.
If an incident starts from a supplier's remote support, notifying CSIRT Italia is still the customer's job. That is why ACN says the contract should require the supplier to report security events right away.
Contracts change at renewal
The decree requires companies to manage supply chain security (Article 24). Among ACN's measures, three closely affect the people who supply and maintain machines: an inventory of the suppliers that can affect security, a risk assessment of the supplies, and security requirements in requests for quotes and in contracts (GV.SC-04, 05 and 07).
Existing contracts don't have to be renegotiated. Once the deadline for the measures has passed, though, every new, renewed or extended contract with that kind of supplier has to include the requirements, unless there are written technical or regulatory reasons. For companies added to the list in April 2025, that obligation started in mid-October 2026.
This can apply to an order for a line, a revamp or a service contract with remote access. Requirements have to be proportionate, and not all of them get passed on to the supplier. If your next line or revamp is coming to us, put the requirements in your technical request: we'll tell you point by point what we do and what we don't, before we quote.
From 2026 on, every year between April 15 and May 31, companies on the list also report their relevant suppliers to ACN, with name and tax ID: ICT suppliers and “non-fungible” ones, which are hard to replace. From these, the Agency can choose suppliers to bring under NIS2, even small ones, as long as their activity is already listed in the annexes.
For ACN, a company that works on a customer's systems with its own connected devices, remote support included, can be a “managed service provider,” in a sector of high criticality. A medium or large machine builder or integrator that updates customers' PLCs through its own router could fall into that category. ACN warns that these clarifications are provisional: it needs to be assessed case by case.
Machine builders also have rules of their own: from January 20, 2027, the new EU Machinery Regulation requires safety software to be protected against corruption and kept traceable.
Where to start
If your company is on the list, or you think you'll need to register in January or February, these are the first steps for your machines:
- Find ACN's certified email and mark your deadline: eighteen months from that date if it arrived by the end of 2025, July 31, 2027 if it arrived in 2026.
- Walk the lines with the drawings in hand and write down every PLC, panel, PC, switch, router and modem, with model and firmware or operating system version.
- Write down who connects remotely to each machine, with which account and from which device, and turn on access logging.
- Back up every PLC program and every HMI project, dated, and keep one copy off the network.
- For every system that no longer gets updates, decide: replace it, or write up the exception with the compensating measures and have top management approve it.
The company writes the risk treatment plan and the exceptions that need approval, with its security consultant. For the machines, what's needed is the inventory, the versions and the backups: the part inside the control panel, which is where we work. Since 1996 we've been writing PLC and HMI software and building the control panels that house them, on Siemens, Rockwell and Schneider.
