The Agenzia per la cybersicurezza nazionale (ACN) released new guidance on August 11, 2026, targeting the monitoring, supervision, and enforcement phases of the NIS 2 directive. This update provides clarity on how the agency evaluates the compliance of essential and important entities, shifting the focus from internal governance to the practical verification of security measures.
The Evolution of Compliance Verification
The agency’s latest intervention is organized into five questions, labeled MVE.1 through MVE.5. Unlike previous releases that focused on administrative responsibilities, these instructions detail the actual mechanics of how the authority conducts oversight. It’s a shift from theoretical compliance to a model where organizations must prove their adherence to cybersecurity standards in real-time.
The distinction between monitoring, supervision, and enforcement is central to this framework. Monitoring serves as the initial, information-gathering phase. Supervision involves specific investigative powers granted by the decree to verify compliance. Enforcement occurs only when violations are identified, allowing the agency to apply corrective measures or sanctions.
Related: Court rules on legal consultant fees
Entities might find that the increased scrutiny on documentation leads to a rise in administrative requests from the agency. Over the next few years, companies could face more frequent audits, requiring them to maintain a clear audit trail of their security decisions. This will likely force many organizations to transition from passive compliance to a more proactive, document-heavy management style.
Distinguishing Between Essential and Important Entities
The classification of an organization as either an essential or important entity remains a core component of the regulatory framework. While the underlying legal obligations are similar, the intensity of oversight differs significantly. Essential entities are subject to more frequent, systematic checks, while oversight for important entities is typically triggered by evidence suggesting a potential violation.
The MVE.5 FAQ clarifies that these categories also influence the scale of administrative penalties. The enforcement logic is not purely punitive; it is designed to ensure the restoration of compliance. The agency possesses various tools to address identified risks, meaning that a finding of non-conformity does not always trigger an immediate financial penalty.
Related: World Cup boosts ITV first-half results
Documenting Compliance for Future Audits
Organizations are now expected to treat compliance as a demonstrable process rather than a static state. This requires maintaining organized records of security policies, risk assessments, and incident reports. The goal is to provide a clear path for regulators to verify that measures are not only established in writing but are also effectively implemented in daily operations.
A fragmented or inconsistent documentation system can create difficulties during inspections, even if the organization is substantively secure. Establishing a centralized compliance record, similar to the accountability requirements found in the General Data Protection Regulation, helps demonstrate maturity. By systematically tracking policy implementation and corrective actions, firms can better manage their relationship with the agency during the verification cycle.
