INDUSTRIES, TECHNOLOGY | ACN publishes new FAQs on monitoring, supervision and enforcement under NIS2

On 11 August 2026, the Italian National Cybersecurity Agency (ACN) updated its FAQs concerning monitoring, supervision and enforcement under Legislative Decree No. 138 of 4 September 2024 (the NIS 2 Decree), introducing new FAQs MVE.1, MVE.2, MVE.3, MVE.4 and MVE.5.

The new FAQs clarify that ACN’s supervision and enforcement activities cover four main areas: monitoring, analysis and support; verifications and inspections; enforcement measures; and administrative fines and ancillary measures. These activities are carried out through a gradual, risk-based approach, in accordance with the principles of effectiveness, proportionality and dissuasiveness and considering the specific circumstances of each case.

In particular, monitoring, analysis and support activities are conducted on a systematic and continuous basis to assist entities in complying with their obligations under the NIS 2 Decree. Through monitoring, ACN gathers information on the implementation of the obligations; through analysis, it assesses the information collected; and through support, it assists entities by providing, inter alia, recommendations, guidelines and awareness-raising initiatives. ACN also clarifies that ex ante inspections may be carried out only towards essential entities.

Finally, ACN may adopt enforcement measures requiring entities to comply with their obligations, remedy identified issues or cease conduct that infringes the applicable requirements, including by issuing formal orders and warnings. The amount of administrative fines and the scope of ancillary measures vary depending on whether the relevant entity is classified as an essential entity, an important entity or a public entity.

Newsletter n. 121 – August/September 2026