NIS2 competent-authority inspection readiness — the evidence dossier

This playbook fires when your organization is a registered NIS2 essential or important entity and the Agenzia per la Cybersicurezza Nazionale (ACN) — the Italian competent authority under d.lgs. 138/2024 — opens a supervisory action: a document request, an off-site review, an on-site inspection, or a request for evidence that the security measures are actually in place.

It is a readiness playbook, not an incident runbook. Reporting a significant incident on the 24h / 72h / 1-month clock is covered separately in the Article 23 incident-timeline playbook; defending a sanction after a finding is covered in the Article 38 penalties playbook. This playbook covers the gap between them: assembling, and continuously maintaining, the evidence dossier so an inspection becomes an export rather than a two-week scramble.

Out of scope: entities still inside their registration window with no implementation deadline reached yet, and voluntary self-assessments that no authority has requested.

ACN is the single competent authority and CSIRT for NIS2 in Italy. Its supervisory and enforcement powers transpose NIS2 Articles 32 (essential entities) and 33 (important entities), and they are not symmetric:

• Essential entities can be inspected ex ante — ACN does not need a prior indication of a breach. Expect document requests, on-site and remote inspections, random checks, requests for access to data and systems, and demands for evidence that each measure is implemented.
• Important entities are supervised ex post: ACN acts when there are indications, evidence, or information suggesting a possible violation (for example, after an incident).

Which regime applies depends on your categorization. ACN determination 155238/2026 sorts registered entities into categories; confirm yours before you build the dossier, because an essential entity should assume an inspection can arrive unannounced. A particularly serious incident can trigger an inspection for either class.

The stakes are set by the penalty regime (art. 38 of the decree): up to €10 million or 2% of worldwide annual turnover for essential entities, €7 million or 1.4% for important entities, whichever is higher — with the management body personally accountable for the risk-management measures.

Before assembling evidence, pin the exact baseline you will be measured against. The authoritative source is ACN's NIS page and its determinations, not secondary commentary (which frequently misquotes the dates):

• Basic security measures are set by ACN determination 379907/2025 (19 December 2025, applicable from 15 January 2026). Allegato 1 lists 37 measures / 87 requirements for important entities; Allegato 2 lists 43 measures / 116 requirements for essential entities. Vulnerability assessment and penetration testing are called out explicitly for essential entities.
• The deadline is per entity, not a single calendar date. For the entities registered in the 2025 cohort, incident-notification obligations began in early 2026 and the basic measures fall due at 18 months from each entity's own inclusion notice — landing in the second half of 2026. Do not plan around a fixed "31 October" date that circulates in the press; count 18 months from your notice.
• 2026-cohort entities (ACN determination 127434/2026) follow a later track: CSIRT referent by 31 December 2026, incident notifications from 1 January 2027, measures by 31 July 2027.
• Registration runs 1 January to 28 February each year; the annual information update runs 15 April to 31 May. Keeping those filings current is itself an evidence item an inspector can check first.

An inspection tests evidence of implementation, measure by measure. Build a map that pairs each risk-management measure (NIS2 Art. 21, transposed in the ACN determination) with the specific artifact that proves it — signed, timestamped, and current. Minimum set:

• Risk analysis & information-security policy — the approved current version, with version history and the approval record.
• Incident handling — the incident register, and for each significant incident the pre-notification, 72h notification, and final report (reconciled with what you filed under Article 23).
• Business continuity & backup — the BCP, and the results of the last restore tests (not just the backup schedule — the proof it restores).
• Supply-chain security — the supplier register, the tiering of suppliers that touch essential functions, and the assessment records, kept current.
• Vulnerability handling & disclosure — scan exports and the remediation records that close them, plus, for essential entities, the VA/PT results ACN calls out explicitly.
• Access control & MFA — the admin-console configuration at activation and at each change; evidence that MFA is enforced where required.
• Cryptography, asset management, HR security, and training — the asset inventory, the cryptography policy, and the security-training attendance records for staff and management.

The operational test for every row: if ACN asks "show me," can one named owner produce the artifact in minutes, with its original timestamp intact? A measure with no retrievable evidence is, for inspection purposes, a measure you cannot prove you have.

NIS2 makes the management body — not just the security team — responsible for approving the risk-management measures and overseeing their implementation (Art. 20, transposed in the decree). This is a separate evidence line that technical teams routinely forget, and it is a fast finding for an inspector because it is documentary, not technical.

Have ready:

• Board/management approval records for the security measures and the policy — minutes or resolutions, dated, naming the measures approved, not a generic "security was discussed."
• Oversight cadence — evidence that the management body reviews the measures periodically (the recurring agenda item, the reporting pack it receives).
• Management training records — proof that directors completed the cybersecurity training the directive requires of them, not only that staff did.
• The accountability chain — who is the designated point of contact with ACN, who owns each measure, and the documented delegation from the management body down.

If the measures are implemented but the board never formally approved them, you have a governance gap that stands even when the technical controls are perfect.

When the notice or the inspectors arrive, the work is retrieval and discipline, not construction:

1. Single point of contact. Route everything through the designated ACN liaison; do not let five people answer the same question five ways.
2. Acknowledge and clarify scope. Confirm in writing which measures, which period, and which entities the request covers. Produce exactly what is asked — over-production buries the signal and invites follow-ups.
3. Produce from the dossier, with provenance. Export each requested artifact with its original timestamp and chain of custody. Do not edit, re-date, or "tidy up" a document to answer a request — a backdated policy is a far worse finding than a late one.
4. Log every exchange. Keep a running record of what was requested, what was produced, and when — it becomes your evidence of cooperation.
5. Flag honestly what is in progress. For a measure still being rolled out, show the plan, the owner, and the target date rather than improvising an answer. Inspectors assess good faith and trajectory, not only the end state.

The difference between a clean inspection and a scramble is almost entirely whether the dossier already existed. If artifacts have to be hunted across tools and re-signed during the inspection window, the ten working days evaporate on assembly instead of answering.

Patterns that turn an inspection into a finding, seen across peer organizations:

• Policy without proof. A polished risk-analysis PDF and no evidence it is operated — no restore-test results, no scan-to-remediation trail, no access-review logs. The policy is the easy half; the evidence of operation is what ACN scores.
• The incident register that does not reconcile. What is in the register does not match what was notified under Article 23 — missing entries, or notifications with no register trace. This is the single easiest gap to find.
• Backdated documents. Re-dating a policy or a training record to fit the deadline. Metadata and version history give it away, and it converts a procedural shortfall into an integrity finding.
• The dead supplier questionnaire. A supplier assessment done once at onboarding, never refreshed, with no tiering of which suppliers touch essential functions.
• Governance as a verbal nod. Measures implemented but never formally approved by the management body, with no minutes and no management-training evidence.

The common root cause is that evidence is assembled for the inspection instead of produced continuously as a by-product of operating the controls. This is where the Zero Hunt approach to compliance pays off: every scan, finding, and remediation is mapped to the relevant framework and signed at the moment it is created (Ed25519, hash-chained), with reports ECDSA-signed, so the dossier is a continuously-maintained, verifiable bundle you export rather than a document you reconstruct. Because findings are mapped across the 34 supported frameworks at once, the same evidence that answers an NIS2 inspection also answers an ISO 27001 or DORA request — one body of proof, not three parallel trails. The inspection stops being a project and becomes an export.

If the inspection surfaces a shortfall, ACN's response escalates: it can issue binding instructions and formal warnings (diffide) with a deadline to remediate, and, for serious or persistent non-compliance, apply the administrative penalties of art. 38 — up to €10M or 2% of worldwide turnover for essential entities, €7M or 1.4% for important ones, with the management body in scope.

Two practical consequences for the readiness posture:

• A diffida is a clock, not a conclusion. Treat it exactly like the inspection request — produce the remediation evidence, dated and signed, before the deadline it sets. The full escalation path and how to respond is in the Article 38 penalties playbook.
• Detection evidence is part of the posture. Supervisors increasingly want proof that you would actually see an incident, not just that you have policies; the detection-capability evidence pack covers how to assemble that specific line of the dossier.