Skip to content
Test page This is a test landing page. It is not indexed and submitted data may be deleted.
Tracciato / NIS2 measures and ACN deadlines, for Italian entities
In development · Early access

NIS2 in Italy: every ACN deadline, one tracker.

Tracciato keeps the basic security measures, the ACN platform windows and the incident notification steps of D.Lgs. 138/2024 in one place — with owners, evidence and reminders. Built for Italian SMEs in the NIS perimeter and the people who look after their IT.

Join the waitlist Pre-order — €129
Free to join No spam €129 / month at launch

Problem01 / 07

Why it's hard today

  1. P-01

    Deadlines depend on when you entered the NIS list. Entities listed in 2025 had 18 months for the basic security measures — October 2026. Entities first listed in 2026 have until 31 July 2027, and must notify incidents from 1 January 2027. On top of that, the ACN platform opens three windows every year.

  2. P-02

    The measures are many and specific. ACN's basic measures count 37 for important entities and 43 for essential ones, each with detailed requirements, policies to approve and records to keep. In most SMEs they live in a spreadsheet that one person understands.

  3. P-03

    Responsibility sits with the board. Under art. 23 of D.Lgs. 138/2024 the management body approves the measures, must follow cybersecurity training and is responsible for violations. It needs a clear, current picture — not a 200-row file.

Solution02 / 07

What Tracciato does

  • Your deadlines, computed

    Tell us when you received the ACN communication and whether you are essential or important. Tracciato builds your calendar — measures, notification, registration, annual update, categorisation — and reminds the punto di contatto and the substitute.

    B-01

  • Every basic measure, tracked

    The measures of ACN Determinazione 379907/2025 for your entity type, each with an owner, a status, linked evidence and a review date.

    B-02

  • Ready for an incident

    A step-by-step playbook for significant incidents with the 24-hour, 72-hour and one-month timers of art. 25, so nobody has to look them up under pressure.

    B-03

Process03 / 07

How it works

  1. Step 1: Set up your entity

    Sector, essential or important, year you were listed, punto di contatto and substitute.

  2. Step 2: Assign the measures

    Give each basic measure an owner and a target date, from your IT team or your external provider.

  3. Step 3: Collect the evidence

    Attach policies, procedures, registers and board approvals as they are done.

  4. Step 4: Report to the board

    Export a status report for the management body and keep a dated history of every change.

Audience04 / 07

Who it's for

  • Italian companies listed as soggetti essenziali or importanti under D.Lgs. 138/2024 — typically 50+ employees
  • IT managers and the designated punto di contatto who carry the NIS obligations day to day
  • Owners and board members who have to approve the measures and follow them
  • Consultants and managed service providers who support several NIS entities
  • Built for Italy: deadlines and terminology follow ACN and the Italian decree, not NIS2 in general

Pricing05 / 07

Simple, early-customer pricing

Tracciato is in development. Join the waitlist for free and we’ll email you when it’s ready.

Want to lock in the founding price? Pre-order today. If we don’t launch, you get a full refund. See the pre-order terms.

Founding entity

Early access

€129 / month

Founding price for the first entities on the waitlist. Pre-orders open soon: the first month is charged upfront and fully refunded if Tracciato doesn't launch.

  • One NIS entity, essential or important
  • Personal calendar of ACN deadlines and platform windows
  • Basic measures tracker with owners, evidence and review dates
  • Incident notification playbook with 24h / 72h / one-month timers
  • Board status report export (PDF)
  • Unlimited internal users and one external consultant seat
  • Direct line to the people building it
Pre-order — €129 · €129 Join the waitlist instead

Secure checkout by Stripe. Full refund if Tracciato doesn’t launch. Terms.

FAQ06 / 07

Questions, answered

Q01 Does Tracciato make us NIS2 compliant?

No software can do that. Tracciato organises the work: deadlines, measures, owners and evidence. Implementing the measures, the decisions and the board approval remain yours. Tracciato is not legal advice and does not replace a qualified consultant.

Q02 Is it only for Italy?

Yes, for now. NIS2 is a directive, so every member state has its own law and authority. Tracciato follows the Italian one: D.Lgs. 138/2024, the ACN determinations and the ACN platform calendar. It is not designed for entities supervised in other countries.

Q03 Are we in scope?

Broadly: public or private entities of the types in Annexes I–IV of D.Lgs. 138/2024 that exceed the small-enterprise ceilings (50 staff, €10 million turnover or balance sheet). Some types are in scope regardless of size, such as trust service providers and DNS providers. If you are in scope, ACN tells you through the platform whether you are listed as essential or important. Tracciato does not decide this for you.

Q04 Which deadlines apply to us?

It depends on when you received the ACN communication of inclusion in the list. Entities listed in 2025: incident notification from January 2026 and basic measures by October 2026 (18 months). Entities first listed in 2026: incident notification from 1 January 2027 and basic measures by 31 July 2027 (Determinazione ACN 127434/2026). Every year: registration 1 January–28 February, annual update 15 April–31 May, categorisation of activities and services 1 May–30 June.

Q05 What is the punto di contatto?

The person the entity designates when registering on the ACN platform, usually an employee delegated by the legal representative. They log in with SPID or CIE and handle the declarations; a substitute is designated during the annual update. Tracciato sends reminders to both.

Q06 What are the incident notification steps?

For a significant incident, art. 25 of D.Lgs. 138/2024 requires a pre-notification to CSIRT Italia within 24 hours of becoming aware of it, a notification within 72 hours, and a final report within one month of the notification. Tracciato tracks these steps; the notification itself is sent through ACN's own channels.

Q07 Does Tracciato file anything with ACN?

No. Registration, updates, categorisation and incident notifications are made by your punto di contatto on ACN's platforms. Tracciato is an independent tool and is not affiliated with or endorsed by the Agenzia per la Cybersicurezza Nazionale.

Q08 Where is our data stored, and who can see it?

Your workspace is private to your entity and the people you invite. We are building Tracciato to host data in the EU, encrypt it in transit and at rest, and never use your data to train models or share it with third parties. You will be able to export and delete everything at any time.

Q09 When will it be available?

Tracciato is in development. We are onboarding a small group of founding entities first. Join the waitlist and we'll email you when there is something to try.

Q10 Can I pre-order?

Pre-orders open soon, first for people on the waitlist. A pre-order charges the first month (€129) upfront. If Tracciato doesn't launch, you get a full refund, and you can ask for a full refund at any time before delivery, for any reason; we process refunds within 14 days.

Access07 / 07

Get early access

We're starting with a small group of Italian NIS entities and their consultants. Leave your work email and we'll contact you when a pilot slot opens.

Questions? hello@holtrane.com

No spam. One email when there is something to show. Unsubscribe any time.