Who does NIS2 apply to?
Directive (EU) 2022/2555 covers essential and important entities identified by sector, size and exceptions. Italy implements it through Legislative Decree 138/2024. Being an SME or supplying a NIS2-regulated customer does not automatically put you in scope.
Suppliers may still receive requests for security evidence. Check your status and applicable duties with the competent authority and a qualified adviser; national implementation matters.
Which technical evidence can you collect?
Article 21 requires a range of cybersecurity risk-management measures. The following information supports selected activities, without fully covering any measure.
- Assets — Article 21(2)(i): an updated inventory of servers and installed software, including containers.
- Vulnerabilities — Article 21(2)(e): daily checks, update priorities and vulnerability decisions with the person, time and reason recorded.
- Assessing measures — Article 21(2)(f): decision history can inform assessment, but is not a complete evaluation of effectiveness.
- Cyber hygiene — Article 21(2)(g): unsupported operating systems and expiring SSL certificates flagged.
- Incidents — Article 21(2)(b): availability and threshold alerts, with start, acknowledgement and resolution history. AI explanations depend on the plan and describe likely causes.
- Continuity — Article 21(2)(c): availability monitoring, disk and memory forecasts and status pages. These do not replace backups, recovery or crisis management.
- Suppliers — Article 21(2)(d): separate customer areas and monthly operational reports on availability, incidents and certificates. These are not NIS2 or security reports.
NIS2 reporting: incident history is a starting point
Article 23 addresses significant incidents: generally an early warning within 24 hours of awareness, an incident notification within 72 hours and a final report within one month of that notification. Special cases apply, including ongoing incidents; not every technical alert is a significant incident.
Available timestamps, errors and analysis in Obermon help reconstruct events. Obermon does not generate or submit notifications to Italy’s ACN: classification, deadlines and submission remain the organisation’s responsibility.
Start with evidence, not a compliance promise
Connect Linux servers, check the inventory and assign responsibility for priority vulnerabilities. Record decisions and verify update outcomes. Use these records alongside your risk-management processes.
Obermon is not antivirus or a firewall. MFA, SSO, audit logs, evidence exports and customer security reports are not part of the capabilities described in this guide.
Sources and further reading
Capabilities described using the product brief dated 28 October 2026. This information does not replace a technical or legal assessment of your circumstances.
What does the Free plan include?
Free: up to 3 Linux servers, security included. AI features are not included. A capability described in this guide is not necessarily included in Free.