NIS 2

We work alongside the Client in defining and continuously updating strategies, policies and procedures in line with the many guidelines, determinations and communications issued by the Italian Supervisory Authority (Agenzia per la Cybersicurezza Nazionale – ACN), in a landscape well known for its constant interpretative and regulatory evolution.
The work includes the critical interpretation of the sources, their translation into concrete organisational requirements and the preparation of dynamic adjustment mechanisms capable of absorbing future regulatory developments without operational discontinuity.
The added value is oversight that combines methodological rigour and legal sensitivity, with the aim of turning mandatory compliance obligations, as far as possible, into effective tools for governing cyber risk.

We work alongside the Client in preparing and/or critically reviewing the gap analysis and the compliance roadmap. We check the consistency between the current set-up and the perimeter identified, the measures proposed and the priorities for action, translating regulatory requirements into remediation plans that reflect the real capacity of the planned measures to reduce residual risk. We also help the Client review the timing of the activities, checking their compatibility with the deadlines set by the national legislation and where useful, in the light of the ENISA guidelines.
The objectives are to help the Client identify vulnerabilities and room for improvement that are not always visible internally, and to direct resources towards the interventions that genuinely matter most.

We work alongside the Client in preparing and updating the documents and procedures needed to comply with the NIS2 Directive, with regard to security incident handling, business continuity and disaster recovery.
We take care of the proper formalisation of the documentation from an accountability standpoint, so that the measures adopted are not only consistent with the legislation and with the ACN’s guidance, but also genuinely usable, understandable and defensible in the event of an audit.
The aim is to give the Client solid, coherent documentation that turns regulatory obligations into concrete organisational processes and effective tools for governing risk.

We work alongside the Client in making the most of its existing documentation and procedures for NIS2 purposes. We analyse the materials, processes and procedures already adopted — on information security, business continuity, incident handling and supplier control — to check how far they can be relied on for compliance, avoiding duplication and encouraging the intelligent reuse of the organisational resources already available. Where necessary, we propose targeted additions to fill the substantive gaps against the regulatory requirements. Our approach is conservative: optimising the investments already made, cutting the time and cost of compliance and at the same time ensuring that what is already in place genuinely satisfies the requirements of the NIS2 Directive and the ACN’s guidance.

We work alongside the Client in managing the systematic alignment of the cybersecurity obligations under the NIS2 Directive with personal data protection rules. We identify, case by case, the intersections between the two sets of rules, about incident handling, breach notification, records of processing activities and technical and organisational security measures. The aim is to prevent conflicts and procedural duplication and to build a single compliance framework in which NIS2 and GDPR obligations fit together coherently — a cross-cutting view that streamlines compliance, reduces the risk of non-compliance and provides integrated oversight of the legal, organisational and technical aspects of security.

Every company within the NIS2 perimeter runs into a range of ordinary legal issues that often call for multidisciplinary input — with higher management costs and a greater dispersion of energies, which inevitably affect how quickly action can be taken. This is the scenario the Legal Desk service offered by netforLegaL is designed for. It is a multidisciplinary legal assistance and advisory service whose availability and, above all, speed the Client can always count on. The service meets the need to outsource the handling of legal issues in less complex business contexts and can also be a valuable support to the in-house legal department in more structured organisations.
The involvement of a pool of senior professionals — organised by area of specialisation — allows the Client to capitalise on the advisory experience gained, ensuring constant regulatory updates in its sector. The multidisciplinary approach also delivers attractive economies of scale.

Our areas of work include:

• Strategic and procedural support with NIS2 compliance obligations;
• Critical review of the gap analysis and adaptation roadmap;
• Preparation and updating of the required documents and procedures;
• Making the most of existing documentation for NIS2 purposes;
• Systematic alignment of NIS2 and the GDPR.

For each Client the service involves a “contact lawyer”, who coordinates the work and has an ongoing relationship with the company. The presence of this figure brings:

• A stronger relationship of trust with the Client;
• The progressive personalisation of the service, as knowledge of the company context steadily grows;
• The guarantee of a constant legal presence, which also plays a proactive role towards the Client.

As for how the service is offered, the methodology is that of a typical help desk: maximum freedom and flexibility for the Client to set upfront an annual budget for the initiative, so as to make the most of its economies of scale.
The expected result is to turn what has perhaps been perceived until now as the cost of regulatory compliance into stronger credibility and an investment in protecting the company’s information assets.

Our services also include training sessions on the security of network and information systems (NIS2). Our training is designed to offer both a general grounding in the principles of the legislation and more specific, technical and operational content, tailored to the Client’s sector and to any special regulations that apply. As part of our ongoing advisory work, we also deliver dedicated training sessions on the correct use and implementation of the documentation and procedures adopted.
All our learning services are modulated and adapted to the specific needs of the Client and can be delivered both in class and at distance; timing, duration and recipients of such sessions are always defined in advance and agreed upon with the Client, with the possibility to arrange single sessions for personnel with specific duties and competences within the company.
We furthermore offer drafting of learning materials (e.g. awareness raising materials, simulations of possible scenarios with fictional characters, legal text easily accessible via hypertext) which can also be uploaded into e-learning platforms including animations, sounds, multiple answers questions and randomized answers.
We also offer a range of “ready-to-go” solutions, thanks to a consolidated collaboration with our technological partner Mediamed Interactive, which allows us to offer to our Clients a product based on the more evolved and widespread training platforms, so that our Clients can enjoy both standard sessions or more tailored sessions.