Just over ten months since the entry into force of Legislative Decree No. 138/2024, which implements the NIS 2 Directive in Italy, businesses are now facing a real transition toward a new model of digital security. While initially perceived by many as yet another regulatory burden, NIS 2 is beginning to be seen for what it truly represents: an opportunity to strengthen IT infrastructure, protect operational continuity, and position oneself as a reliable partner in an increasingly interconnected ecosystem.
First figures: adoption and challenges for italian companies
At the national level, over 6,000 companies registered by the February 28, 2025 deadline on the platform of the National Cybersecurity Agency (ACN), according to data published in the initial technical reports. Of these, 38% have already launched structural adaptation programs that include mandatory training, continuous system updates, and incident response simulations. According to Clusit, cybersecurity spending grew by 21% in the first half of 2025, with particular focus on industrial enterprises and regulated digital sectors. The first audits, scheduled for June 2026, will primarily involve companies deemed “essential,” such as telecommunications, energy, and healthcare. However, the entire industrial landscape is already embracing the principles of the directive, clear signs that NIS 2 is evolving from a legal obligation into a driving force for the country’s digital resilience.
Practical applications: from factory floor to cloud
The changes introduced by NIS 2 are now well-known: mandatory registration on the ACN platform, prompt incident notifications, ongoing staff training, and the implementation of technical and organizational risk management measures. However, the real challenge for businesses is applying these measures in a way that aligns with their specific operational context. A manufacturing company operating automated facilities and OT (Operational Technology) networks, for example, will need to focus its efforts on network segmentation and continuous monitoring of industrial endpoints. Conversely, a software house or Managed Service Provider (MSP) will need to invest in security-by-design solutions, data encryption, and supply chain protection.
Digital services and operational continuity: the case of logistics
Even in the service sector, the impact of NIS 2 is evident. Consider a logistics company operating nationwide and using digital platforms to manage shipments. In such a case, the resilience of IT systems is directly tied to customer service quality. A disruption caused by a cyberattack could severely damage the company’s reputation and lead to significant financial losses. Implementing an incident response plan, conducting attack simulations (red teaming), and continuously updating security patches is no longer optional, it’s a strategic necessity.
Fiber networks and integrated security: the role of operators
For companies operating in the telecommunications sector or as fiber optic network providers, like ours, NIS 2 also entails a responsibility toward the entire ecosystem. The networks we design, install, and maintain serve as the backbone for the critical digital services used by dozens or even hundreds of clients. That’s why today, more than ever, it is essential to offer solutions that embed high security standards from the design phase (Security by Design) and are prepared for centralized management with proactive threat detection systems and advanced segmentation between the core, edge, and access layers.
Beyond compliance: an opportunity to strengthen the business
The NIS 2 Directive is not merely a checklist to avoid fines. It is a real opportunity to evolve toward more robust and sustainable security management models. Companies that manage to turn this obligation into a competitive advantage, by adopting secure and scalable network infrastructures, will be the ones best equipped to face the challenges of the digital marketplace.