IT Asset Visibility for NIS2 Compliance in Milan: What the October Deadline Exposes

During the Milano Cortina 2026 Winter Olympics, Italy’s national cyber picture sharpened in public view. According to the Agenzia per la Cybersicurezza Nazionale (ACN) Operational Summary for February 2026, DDoS campaigns claimed by pro-Russian groups hit accommodation near competition venues, central and local public administrations, and transport operators. In the same month, CSIRT Italia sent 868 alert communications covering 1,084 internet-exposed, potentially vulnerable services across public administrations and enterprises. Event counts rose sharply as NIS2 notification duties widened the agency’s view of the Italian estate. The Games did not invent those exposures. They made the gap between registered systems and running systems impossible to ignore for any board that still treats inventory as a one-time spreadsheet exercise.

IT asset visibility for NIS2 compliance in Milan is the evidence layer ACN tests against Article 21 security measures, due by October 2026. That same pressure now sits on Milan’s banks, insurers, and manufacturers, who must prove the estate they declared matches what is actually running.

What is IT asset visibility under NIS2?

The NIS2 Directive (EU) 2022/2555 sets baseline cybersecurity risk-management duties for essential and important entities across the Union. Italy transposed those duties through Decreto Legislativo 138/2024. ACN runs the national platform, categorization process, and technical specifications that turn the directive into operational obligations for Italian organizations.

Under the risk-management measures tied to Article 21 of the directive (and the related Italian implementing rules ACN publishes), in-scope entities must maintain capabilities that only work when the estate is known. Risk analysis needs a current inventory. Incident handling needs ownership and dependency context. Business continuity needs an accurate view of which systems sustain critical services. Supply-chain security needs a record of third-party systems and access paths that touch the organization’s own environment. Without those records, policies exist on paper while the live network drifts.

ACN’s second-phase guidance is explicit about timing. In the agency’s NIS second-phase announcement, cybersecurity measures must be adopted by October 2026. Essential entities face a larger set of measures and requirements than important entities, but both clocks run toward the same month. Incident-notification duties already started earlier in the Italian rollout. The October window is the hard stop for implementing the security-measure package itself.

The hidden problem

Most Milan organizations already filed something into ACN’s categorization flow. The hidden problem is the gap between that declared inventory and the estate that actually runs:

IT asset visibility for NIS2 compliance in Milan means closing that table before the next inspection or incident clock starts. ACN will not grade the beauty of a policy deck. Reviewers will ask what exists, who owns it, how it is configured, and how it connects to critical services.

Teams that need a shared definition of discovery-sourced ground truth can start with Trusted Runtime Truth before they rebuild the inventory process.

Why does this matter for Milan specifically?

Milan is Italy’s financial capital and sits inside Lombardy, the country’s manufacturing engine. Borsa Italiana and the broader Piazza Affari ecosystem concentrate listed banks, insurers, asset managers, and market infrastructure. Lombardy’s industrial base drives a large share of national manufacturing turnover and export activity. That dual footprint means NIS2 Annex I financial entities and Annex II manufacturing entities share the same metro, the same talent pool, and often the same managed-service and co-location providers.

Threat reporting already treats both sectors as active targets. The ENISA Threat Landscape 2025 keeps finance and manufacturing under sustained pressure. ACN’s February 2026 summary listed manufacturing among the highest-volume sectors that month. For a Milan CIO or plant IT lead, the regulatory calendar and the threat calendar land on the same estate.

Three failure modes

1. Undocumented OT-IT bridges. Jump servers, MES-to-ERP links, and remote-maintenance paths often lack a named owner in the CMDB, so you can’t prove the scope of a manufacturing incident when ACN or CSIRT Italia asks which production systems were reachable. Read more on Manufacturing IT Asset Management: Managing OT and IT Infrastructure Convergence.
2. Stale CMDB versus ACN’s declared categorization. What was registered last quarter no longer matches what discovery would find this week, so entities fail the simplest consistency check between portal records and live configuration items.
3. Third-party and supply-chain asset blind spots. Supplier-hosted tools rarely appear as configuration items, so a bank or factory inherits a blast radius it never inventoried.

What getting this wrong costs Milan

For leaders

NIS2 places explicit duties on management bodies. Article 23-style leadership accountability in the Italian framework means boards cannot treat cybersecurity measures as a purely technical backlog. When inventory is wrong, every risk report on the board pack is incomplete. IBM’s Cost of a Data Breach research continues to show elevated average costs in financial services and industrial environments relative to the global mean, which keeps multi-million-dollar average loss a board problem rather than only a ticket queue.

For Ops teams

Speed of containment still drives cost. Longer identification and containment windows correlate with higher average breach cost in IBM’s multi-year Cost of a Data Breach series. Ops teams that spend days reconciling spreadsheets before they can name affected CIs burn that window under NIS2 notification clocks.

For regulated environments

Financial entities in Milan also live under the Digital Operational Resilience Act. EIOPA and ESMA both publish standing guidance on DORA, including ICT asset-register expectations that sit beside NIS2 rather than replacing it. Manufacturing environments carry OT documentation expectations consistent with guidance such as NIST SP 800-82 Revision 3 for operational technology security. NIS2 does not erase those regimes. It adds another auditor who will ask for the same underlying truth: a current, owned, dependency-aware inventory.

Milan market-scale challenge

Because finance HQs and manufacturing sites concentrate in one metro, shared vendors, shared data centers, and shared remote-access patterns multiply the cost of a single blind spot across ACN reviews and plant incidents in the same week. Read how NIS2 and DORA compliance overlap for financial services.

How IT asset visibility for NIS2 compliance in Milan gets fixed

Asset visibility is not a slogan. It is a repeatable discovery-to-CMDB-to-map loop that can be shown to an auditor.

1. High-frequency scheduled discovery across hybrid IT and the IT/OT boundary. Agent-based, agentless, and API methods inventory servers, network gear, endpoints, and cloud resources on a defined cadence that fits change windows and OT constraints. The goal is a fresh estate record before each ACN reporting or inspection window, not a one-time cleanup. Ground the program in a discovery platform that can run those cycles on a defined schedule.

2. CMDB as the audit-ready source of record. Discovery feeds configuration items with ownership, criticality, lifecycle state, and relationships. Auditors and ACN reviewers need more than a host list. They need a configuration management database that can explain why a system is in scope and who can change it. When CMDB projects lose discovery authority, records decay between audit windows and ACN checkpoints.

3. Service mapping for blast-radius visibility. Once service definitions are provided, dependency maps show which infrastructure supports which business service. That context matters when NIS2 early-warning and notification clocks start. You cannot scope impact if you do not know what connects to what.

Manual versus automated inventory

NIS2 asset visibility examples in practice

A major bank investigates supplier-linked claims under DORA pressure. In July 2026, Deutsche Bank confirmed it was investigating a supplier-linked incident after the ransomware group Unsafe posted alleged data on a leak site. S-RM’s briefing frames it as an open investigation, not an adjudicated root cause. The transferable point: if supplier systems never appear in the ICT asset register, a bank can’t prove blast radius when regulators ask.

CISA Binding Operational Directive 23-01 treats asset visibility as a prerequisite for vulnerability detection. European boards can read that as confirmation, not as a substitute for ACN rules: you cannot defend what you cannot list.

The Virima layer: discovery, CMDB, and service mapping for NIS2

Virima sits under GRC tools, ITSM platforms, and security scanners as the discovery-sourced Runtime Truth layer. It does not file NIS2 regulatory reports, enforce firewall or segmentation policy, or classify the content of data moving across mapped connections. What it does provide is a current record of assets, relationships, and service context that those other systems consume.

Immediate operational impact

A discovery run against the live estate surfaces undeclared hosts, network devices, and cloud resources before the next ACN categorization update. Teams reconcile findings against what was declared on the NIS platform, then assign owners and criticality tags while the window is still open. That is how IT asset visibility for NIS2 compliance in Milan moves from a slide deck to a working evidence pack.

Long-term accuracy

High-frequency scheduled discovery keeps the CMDB from drifting back to a stale snapshot between audits. Cleanup projects fail when no authority refreshes the record afterward. Ownership fields, criticality tags, and lifecycle state should stay mandatory on every in-scope CI so ACN categorization and internal risk reports pull from the same record set. Milan program owners should lock field standards before the next ACN window rather than after the first failed consistency check.

Integration with existing workflows

Most Milan financial and manufacturing enterprises already run an ITSM platform. Virima integrates with ServiceNow, Jira Service Management, Ivanti, Halo, Xurrent, and other partners so discovered CIs and relationships can feed the tools teams already use. Partner names stay plain text; the discovery and CMDB layer stays underneath. Change tickets, incident records, and CAB packets should inherit the same CI identifiers that discovery refreshes on schedule. That continuity keeps inventory from drifting as a disconnected spreadsheet away from the live estate and keeps ticket history aligned with the same configuration identifiers operations already trust during incident and change windows.

For manufacturing estates, IT asset management practices that track hardware lifecycle and software installs should sit beside CMDB records so plant-adjacent IT is not only discovered once and then forgotten between audit cycles on the plant floor. For financial estates, the same inventory supports audit packets that ITAM and risk teams already assemble for ACN and DORA evidence requests across quarterly and annual evidence windows in both sectors under the same ownership model. Program owners should document which connector feeds which CI class before the next categorization refresh, then keep that map current as suppliers and managed-service providers change across the estate. When the runbook needs a single destination for connector coverage across those ITSM handoffs in one place, use the integrations hub rather than deep partner pages.

Moving from spreadsheet tracking to map-driven NIS2 readiness

Faster ACN categorization updates

When discovery and CMDB stay current, updating declared systems, domains, and ownership on the NIS platform is a controlled delta, not a forensic rebuild.

Faster incident scoping against notification clocks

Service maps and CI relationships let SecOps and plant IT answer which business services sit in the blast radius without rebuilding topology from memory during the first hours of an incident.

Lighter audit-prep burden

Evidence packs pull from dated discovery runs and CMDB exports instead of weekend spreadsheet merges. That reduces the reconciliation hours ITAM and CMDB owners lose every quarter.

Getting started

1. Run discovery against the current hybrid estate, including OT-adjacent IT segments where credentials and change control allow.
2. Reconcile discovered CIs against what’s already declared to ACN.
3. Tag CIs by NIS2 criticality, owner, and lifecycle state.
4. Connect the CMDB to the existing ITSM tool, so tickets inherit the same CI truth.
5. Set a recurring discovery cadence that lands before each ACN reporting window through October 2026 and beyond.

Those five steps are deliberately operational. They do not replace legal counsel, ACN portal filings, or sector-authority guidance for banks and manufacturers. They give the technical foundation those filings and incident packages depend on when reviewers ask for proof rather than policy language alone. Treat discovery cadence as a standing control, not a project milestone that ends when the first ACN update is submitted.

Put Milan’s NIS2 inventory on a schedule before October

October 2026 is the ACN security-measures deadline on the public calendar. Milan’s financial headquarters and Lombardy manufacturing sites share the same metro and the same need for IT asset visibility for NIS2 compliance in Milan that can survive inspection and incident clocks. If your estate still lives in spreadsheets, start with discovery and a CMDB that operations already trust, then keep the schedule honest through each reporting cycle. Boards that wait for the last month will reconstruct inventory under pressure instead of defending a known estate. Schedule a demo when you want to see how scheduled discovery, CMDB accuracy, and service maps fit under your existing ITSM stack.

Frequently Asked Questions