Italy's National Cybersecurity Agency (ACN) has published its Operational Summary for July: malicious campaigns and at-risk assets are declining, while the communications sent by CSIRT Italia continue to rise. At first glance that looks contradictory, but it is exactly the effect NIS2 is meant to produce: more entities obliged to report means more visibility for the state, not necessarily more attacks. Fewer active campaigns succeeding, more events actually detected and handled before they get out of hand.
In parallel, the ACN has published new interpretive clarifications on the supply chain security requirements for NIS entities. This is not a bureaucratic detail: an organisation's security increasingly depends on that of its suppliers, and the regulation explicitly recognises this.
For anyone managing NIS2 compliance, the link between these two announcements is direct: the figures are improving because the system is learning to see what used to remain invisible. But this only holds if second- and third-tier suppliers are also included in the risk assessment, not just the organisation's direct perimeter.
A practical question to ask yourself now: does your supplier assessment stop at the first tier, or does it reach those who supply your suppliers?
Source: ACN, CSIRT Italia
Related: NIS2 Supplier Risk Checklist (free · 10 questions · 5 minutes)
Research as of: September 16, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
