EU Directive 2022/2555 (NIS2) updating and replacing the previous NIS, expanding the scope of obligated entities and strengthening cybersecurity requirements for essential and important service operators. It mandates technical and organizational measures for risk management, incident notification within 24 hours, digital supply chain resilience, and national authority supervision. Transposed in Italy with an October 2024 deadline, NIS2 introduces significant sanctions and direct management responsibility for compliance.