Basic NIS2 Security Measures: Is the Italian Aviation Sector Ready for Take-Off?

As the deadlines for the adoption of the EU’s Second Network and Information Systems Directive (NIS2) basic security measures draw near, operators in the aviation sector and their management are required to assess whether their governance frameworks, cybersecurity safeguards, and supply chain risk management arrangements are effectively prepared and capable of withstanding scrutiny from competent authorities, business partners, and the market.

In summary:

• Upcoming deadlines: for entities whose registration in NIS list has been notified starting from April 2025, the obligation to implement the baseline security measures takes effect starting from October 2026; for entities registered in 2026, from 31 July 2027.
• Management accountability: administrative and governing bodies must approve and oversee the implementation of the measures, with potential personal liability in the event of non-compliance.
• Compliance must be demonstrable: governance, risk management, system protection, and incident response practices must be adequately documented and verifiable.
• Supply chain security: in the aviation sector, cyber risk must be managed across the entire supply chain, integrating it with safety, security, and business continuity requirements.
• Strategic impact: compliance with the NIS2 framework is not only a legal obligation, but also a key factor in ensuring reliability, service continuity, and market competitiveness.

Cybersecurity has long been a priority for the aviation industry. The continuity of flight operations and airport services depends on highly interconnected digital systems, including air navigation and air traffic management systems, airline operational platforms, airport infrastructure, ground handling services, maintenance operations, passenger and baggage management systems, and networks of technology suppliers. In this context, a cyber incident may generate effects extending beyond the perimeter of a single organisation, impacting the regularity, continuity, and resilience of operations.

The implementation of the NIS2 Directive, transposed into Italian law by Legislative Decree No. 138/2024 (the NIS2 Decree), is now entering a particularly significant phase for aviation operators included in the NIS register. Registration with the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale - ACN), the submission of information, and the notifications required throughout 2025 and 2026 do not complete compliance process under the NIS2 Decree; rather, they constitute its starting point.

The NIS2 Decree establishes a framework of recurring obligations for entities falling within the NIS2 scope, including, inter alia, the review of corporate information submitted to the ACN, the updating of appointments of individuals responsible for relations with the ACN and for incident management, the prompt notification of any relevant changes, and the classification of corporate activities and services.

Rather than a one-off compliance requirement, NIS2 therefore entails an ongoing process of adaptation, subject to periodic deadlines, reviews, and updates. In this respect, the ability to plan compliance activities in advance and clearly allocate responsibilities is essential to ensuring continued compliance.

Attention is now turning to substantive compliance requirements. Through Determination No. 379907 of 19 December 2025, the ACN specified the basic security measures for managing risks relating to the security of network and information systems of both essential and important entities, with the aim of preventing incidents and minimising their impact.

These measures, implementing Articles 23, 24, and 25 of the NIS2 Decree, affect, among other things, cybersecurity governance, risk assessment processes, the management and protection of information systems, as well as incident detection, response, and recovery capabilities.

As stated in the same Determination, the ACN has required NIS entities to adopt the basic security measures within 18 months from receipt of the notification confirming their inclusion in the NIS register.

Since the first notifications of inclusion in the register were issued in April 2025, the deadline for the adoption of the prescribed basic security measures falls during October 2026 for the entities concerned, including those operating in the aviation sector. Entities included in the NIS register for the first time during 2026 will instead be permitted to adopt such measures by 31 July 2027.

Within the aviation sector, this milestone assumes particular importance. Where the statutory conditions are met, the NIS2 regime may apply, among others, to air carriers, airport operators, and air traffic management service providers, which are required to establish an effective cyber risk governance model integrated with safety, security, business continuity, supply chain management, and information systems protection processes.

Indeed, the sector’s resilience also depends on its relationships with ground handling operators, maintenance organisations, logistics providers, digital service providers, and other supply chain stakeholders, many of whom may themselves fall within the NIS2 perimeter. Consequently, cyber risk cannot be assessed solely with reference to isolated systems or organisations but must be managed with due regard to operational interdependencies, contractual dependencies, and the continuity of essential services.

For legal, compliance, and risk management functions, the implementation of these measures marks the transition from a mere declaration of compliance to the demonstration of the effective deployment of security controls. Competent authorities may assess the manner in which such measures are practically implemented and governed, including through the imposition of corrective measures and administrative pecuniary sanctions.

Corporate governance is also directly engaged. Under Article 23 of the NIS2 Decree, management and governing bodies must approve the arrangements for implementing cybersecurity risk-management measures, oversee compliance with the Decree and are accountable for any related infringements. Article 38 further provides that individuals responsible for an essential entity or acting as its legal representatives with authority to represent it, make decisions on its behalf or exercise control over it, may be held liable where the entity fails to comply with the Decree. If the entity fails to comply with an order issued by the competent national NIS authority, the individuals specified in Article 38 may also be temporarily barred from performing managerial functions within the entity until the relevant deficiencies have been remedied or the order has been complied with.

Similar expectations regarding the effective implementation of those measures are likely to also arise commercially, as customers, business partners, and suppliers throughout the supply chain increasingly attach importance – including in relevant commercial agreements – to an organisation’s ability to demonstrate the adoption of appropriate security standards and a mature approach to cyber risk management.

Compliance with NIS2 therefore becomes not only a regulatory requirement but also a key factor in operational reliability, service continuity, and competitiveness within the aviation market.

An Italian translation of this article is available here.