The basic measures that genuinely protect a small business, put in place and written down. Useful when a customer covered by NIS2 asks how you protect your data and systems.
AT A GLANCE
URETECH secures the PCs, servers, email and backups of SMEs and professional firms with a set of basic measures: two-factor authentication, updates, managed antivirus, backups with a protected copy, a firewall, staff training and an incident procedure.
Every measure is documented. So when a customer covered by NIS2 sends you a supplier questionnaire, you have the answers and the evidence ready. We don’t give legal advice: for the legal side, you work with your own adviser.
What we do for each one. They are the same measures customers ask about most often in their questionnaires.
Switched on for email, remote access and cloud applications, for every user.
Security patches applied to a schedule on PCs, servers and network devices.
Protection on every PC, with alerts that come to us as well as to the user.
The 3-2-1 rule, plus a copy that ransomware can’t encrypt.
No remote desktop exposed to the internet; VPN with strong authentication.
No shared accounts, access removed when people leave, minimum permissions.
SPF, DKIM and DMARC set up, with filters against phishing and dangerous attachments.
A short phishing awareness session and a written procedure on what to do and who to call.
AUTOVALUTAZIONE IN 2 MINUTI
Rispondi per ciascuna misura. Il cerchio si accende man mano: alla fine vedi il punteggio e le misure da sistemare per prime, nello stesso ordine in cui le metteremmo noi.
Rispondi alla prima domanda per accendere il cerchio.
Nessuna misura scoperta: resta da documentare tutto in un registro.
Autovalutazione indicativa: non è una verifica di conformità NIS2 né una consulenza legale.
NIS2
The EU NIS2 Directive was transposed into Italian law by Legislative Decree no. 138 of 4 September 2024 (D.Lgs. 138/2024), in force since 16 October 2024. The competent authority is the Agenzia per la Cybersicurezza Nazionale (ACN), Italy’s National Cybersecurity Agency. Each EU country applies the directive through its own law and authority, so the dates below are the Italian ones.
| What | When |
|---|---|
| Registration of entities on the ACN platform | 1 January to 28 February each year |
| Annual update of the information provided | 15 April to 31 May |
| Notification of significant incidents | Mandatory from January 2026 for entities already on the list |
| Basic security measures | Within 18 months of being notified of inclusion: October 2026 for entities listed since 2025 |
Who is covered: broadly, medium-sized and large companies in 18 sectors (11 highly critical and 7 critical), plus some smaller organisations named explicitly. Maximum fines reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities.
Sources: ACN, NIS page (acn.gov.it/portale/nis); Directive (EU) 2022/2555, Articles 2, 21 and 34. Checked on 8 November 2026.
SUPPLIERS
Most micro and small businesses are not directly subject to NIS2. However, NIS entities have to manage security across their supply chain (Article 21 of the directive) and list their relevant suppliers on the ACN platform. That’s why they ask suppliers for security assurances: questionnaires, contract clauses and sometimes evidence.
If you sell products or services to a large company, a public body or an operator in sectors such as energy, transport, healthcare or digital services, those questions will probably reach you too. It isn’t a direct legal obligation, but it can become a condition for keeping the contract.
The GDPR (Article 32) also requires appropriate technical measures to protect personal data. The basic measures we apply cover both.
DELIVERABLES
The service builds on our IT support and scheduled maintenance. For cloud servers, see cloud for businesses and the managed cloud scenario. More verified figures on attacks against Italian businesses are in our cybersecurity guide for SMEs.
From the check-up to documented measures.
We check the eight measures on your systems and give you a written list of priorities.
What to put in place, in what order, how it affects day-to-day work and what it costs.
We bring the measures in step by step and explain to your staff what changes.
Register, incident procedure and regular reviews as part of the support contract.
The questions we’re asked most about cybersecurity and NIS2.
Tell us how many workstations you have and whether a customer has asked you for security requirements. We’ll tell you which measures to start with.
We will email you within 24 working hours to book the 30 minutes. If it is urgent, message us on WhatsApp.
Prefer to talk right away?
Mon–Fri 9:00–12:30 and 14:00–20:00 (CET).
The other services usually needed alongside this one.
Protected copies and a recovery plan.
The contract that keeps the measures in place over time.
Server hardening and documentation.
Firewall, VPN and separate Wi-Fi.
Tickets, phone and remote access for your staff.