NormaShieldAcademy
Cybersecurity, compliance and the human factor
Twelve paths to train the whole organisation, from staff to the top: NIS2 and ACN measures, AI Act, DORA, Cyber Resilience Act, incident response, cloud and industrial plants. Tests at every step and verifiable named certificates, in Italian and English.
Create your account Resume your courses Browse the paths
NIS2 focus Deadlines, basic measures and enhanced measures under consultation: what applies today
NIS2 focus · Legislative Decree 138/2024
The decree sets the principles; the deadlines, the fields to declare and the measures are set by ACN determinations. For many entities the deadlines for the basic measures have already been reached, for others they arrive in 2027, and meanwhile ACN is working on the enhanced measures. Here is the picture, act by act.
18 October 2024
Legislative Decree 138/2024 applies In force
Management bodies approve the measures and are accountable for them (art. 23), risk management measures (art. 24), incident notifications (art. 25).
15 January 2026
ACN basic measures In force
Determination 379907/2025: separate requirements for important and essential entities, organised around the functions of the National Framework.
January and October 2026
Entities listed in 2025: deadlines reached Expired
Incident notification at 9 months and basic measures at 18 months from the entity's own notice of inclusion. 31 October is not a statutory date: the deadline runs from that notice.
18 September 2026
Enhanced measures under consultation Under consultation
ACN is discussing them with the sectoral tables to supplement and replace the basic measures; on 14 October the first results went to the NIS Table. No text published.
25 October 2026
New determination on the platform In force
Determination 314287/2026 replaces 127437: annual update from 15 April to 31 May and the list of relevant suppliers.
2027
The 2027 deadlines Coming up
For everyone, registration or update on the platform from 1 January to 28 February. For entities listed in 2026, incident notification from 1 January and basic measures by 31 July.
Enhanced security measures
Until ACN adopts the text, the enhanced measures bind no one and move no deadline: postponing an activity “pending the enhanced measures” means suspending an obligation already in force. You can, however, build a project today that will absorb them with little extra work.
Status checked against the acts published by ACN as of 1 November 2026. The paths are updated when an act changes.
Training in the ACN measures
For NIS entities training is not good practice: it is measure PR.AT-01 of the ACN basic specifications, with the same requirements for important and essential entities; essential entities also have PR.AT-02. Here is what they require, point by point, and what you will find here to meet them.
PR.AT-01 · point 1
A training plan for all staff, management bodies included, defined, implemented, updated and documented, with the planned activities and their content.
A path for every role, each with a full programme, modules, duration and objectives to put in the plan. Annual certificate validity and the review of content whenever a regulation changes keep the plan up to date.
PR.AT-01 · point 1, letter b
How the acquisition of the content is assessed.
Module tests with a 70% pass mark, decision-based exercises with automatic scoring and the final test of the path: the same methods in every path, to be cited in the plan as they are.
PR.AT-01 · point 2
The plan is approved by the management bodies.
Approval stays with the management body and cannot be delegated. The GRC path teaches which documents the body must approve and how the proof is kept; the Fundamentals path is the starting point for training the bodies themselves.
PR.AT-01 · point 3
An up-to-date register: who received the training, with what content and which assessments.
For each person the platform records the path, completion module by module, test results with their date and study time; the named certificate has a public verification code. This is the data the register asks for, kept even after the annual renewal.
PR.AT-02 · essential entities only
Dedicated training for specialised roles, system administrators included: secure configuration and operation of systems, known threats, behaviour in the event of security events. This too goes in the register.
Secure configuration and operation LinuxCloudSecure developmentOT
Known threats FundamentalsAwareness
Security events Incident ResponseForensics
Request places for your organisation The text of the measures: ACN determination 379907/2025, annexes 1 and 2
Where to start
The training plan must cover all staff, management bodies included, and for essential entities the specialised roles. Here is where to start for each of them.
PR.AT-01 · AI Act art. 4
No technical skills required: everyday practices, recognising attacks and the conscious use of artificial intelligence.
PR.AT-02
Secure configuration and operation of systems, known threats and behaviour in the event of security events: administration, cloud, development, incident response, industrial plants and investigations.
FundamentalsLinuxSecure developmentCloudIncident ResponseOTForensics
Art. 24 · ACN measures
Those who write the training plan and keep the register, and with them the compliance project: inventories, risk, impact analysis, suppliers, continuity plans and the evidence an audit asks for.
Art. 23 · PR.AT-01 point 2
They are trained, approve the measures and the training plan and are accountable for them: risk, continuity and responsibilities that cannot be delegated.
The programme
You start from the basics, which everyone needs: the language of security, everyday practices, the human factor, the informed use of artificial intelligence. Then two areas for people with a specific role: governance, for those accountable for risk and compliance, and the technical area, for those who develop software and those who manage systems, incidents, industrial plants and digital evidence. Each path stands on its own, with the same method and the same certificate; the level indicates how much experience you need at the start.
No technical skills required. Fundamentals provides the common language of every area; Hygiene, Awareness and artificial intelligence are the training that NIS2 and the AI Act require for all staff.
The vocabulary and conceptual models on which everything else rests: what is protected, from which adversaries, with which controls and with which risk logic. It is the recommended starting point for anyone going on to the other areas.
Risk analysisSecurity controlsCryptography and identity
The everyday practices that measurably reduce the attack surface, from credential management to data continuity. Every module closes with a checklist you can apply straight away.
Credentials and MFAUpdatesBackup and recovery
The human factor is not the weak link: trained properly, it is your first detection sensor. How manipulation works, how to recognise attempted attacks and how to build a culture of reporting.
Social engineeringPhishing and fraudReporting
From the basics of AI to the obligations of Regulation (EU) 2024/1689: how generative models really work and why they get things wrong, how to work with them methodically, what European law asks of those who provide them and those who use them, and what security and data protection risks they bring into the organisation. No technical skills required.
Fundamentals and generative modelsWorking methodAI ActData and security
For those accountable for risk and compliance obligations: compliance, DPO, audit, management bodies. From the regulatory framework to the compliance project and continuity plans.
The foundations first: NIS2 and ACN specifications, NIST CSF 2.0, CIS Controls, ISO/IEC 27001, DORA and the Cyber Resilience Act. Then the compliance project phase by phase, with templates for the documents to produce: asset inventory, risk analysis, Business Impact Analysis, supplier register.
NIS2 and ACNISO/IEC 27001Asset inventoryBusiness Impact AnalysisSupplier register
Sooner or later every organisation comes to a halt: the difference between a disruption you manage and one you simply suffer is decided beforehand. How to measure the cost of downtime with a business impact analysis, how to set RTO and RPO, how to design backups that hold up against an encryption attack, how to write plans that can be used under pressure and how to test them. With the continuity obligations of NIS2, DORA and the GDPR.
ISO 22301Business impact analysisStrategies and plansNIS2 and DORA
For those who manage systems, cloud services, incidents, industrial plants and digital evidence, and for those who develop software: operational skills, with the rules that require them referenced module by module.
From the meaning of the prompt to the day to day running of a server. For every command: what it answers, in which situation you use it, how you write it and what happens when you get it wrong. Every lesson contains terminal sessions meant to be reproduced, not read, and points to the official documentation.
Filesystem and permissionsStreams and pipelinesProcesses and systemdNetworking and SSHScripting and hardening
The process that NIS2 and Legislative Decree 138/2024 really require: preparing with a plan and defined roles, classifying with the ACN (Italy's National Cybersecurity Agency) taxonomy, notifying CSIRT Italia (the national CSIRT) within 24 and 72 hours, responding while preserving the evidence and learning from the incident. With a precise link to the GDPR whenever the data is personal.
NIS2 and Legislative Decree 138/2024ACN determinationsNotifications to CSIRT Italia
An industrial plant is not an office with machinery inside it: the safety of people comes first, then production, then data. How to carry out a security assessment of an automation system with the method of the IEC 62443 series: asset inventory, partitioning into zones and conduits, security levels, the gap between what is needed and what is in place. With the convergence towards ISO/IEC 27001 and NIS2 shown module by module.
IEC 62443Zones and conduitsSecurity levelsISO 27001 and NIS2
Two copies of the same file can have identical content and different value: the difference is not in the data, it is in the documented process that accompanies it. What to look at first, what to acquire and in what order, how to preserve it, how to analyse it without being misled and how to write the report that closes the work. With the link to notification obligations and to data protection.
ISO/IEC 27037Chain of custodyAnalysis and reportingGDPR and NIS2
Since 11 September 2026 manufacturers of products with digital elements must already report exploited vulnerabilities; from 11 December 2027 the Cyber Resilience Act applies in full. How to build software that withstands attacks and how to prove it: requirements and threat modelling, code, third-party components and SBOM, pre-release verification, vulnerability handling and reporting.
Cyber Resilience ActOWASP and CWESBOM and dependenciesNIST SSDF
The provider is responsible for the security of the cloud, the customer for security in the cloud: identities, permissions, configuration, data, keys and logs. How to govern the part that always stays with the user of the service, how to respond to an incident when the infrastructure belongs to someone else, and what a contract must say, under NIS2, GDPR, the Data Act and DORA, so that you can also leave.
Shared responsibilityIdentity and accessData and keysData Act and exit
Weekly NIS2 bulletin
Releases, determinations and clarifications on the NIS rules from the National Cybersecurity Agency, collected every Monday from the ACN portal. Titles and summaries are the originals, in Italian.
Week from 26 October 2026 to 1 November 2026 · 1 new release
Rendere le imprese più sicure lungo tutta la filiera, dal prodotto all’organizzazione che lo usa. È l’obiettivo del lavoro che l’Agenzia per la Cybersicurezza Nazionale (ACN) e Assolombarda portano avanti insieme e che oggi è...
SourcesACN releasecomunicato stampa
L’Agenzia per la cybersicurezza nazionale prosegue il percorso per semplificare le procedure di registrazione dei soggetti NIS sul portale dei servizi. In vista della registrazione da gennaio 2027 l’Agenzia ha pubblicato la...
Sono stati due giorni di confronto tra la delegazione della Commissione europea e l’Agenzia per la cybersicurezza nazionale nel corso della country visit dedicata all’attuazione italiana della Direttiva NIS2. Negli incontri del...
SourcesACN release
La riunione plenaria del Tavolo di attuazione della NIS dell’Agenzia per la cybersicurezza nazionale, con le Autorità di settore e i rappresentanti regionali, ha approfondito le determinazioni del Direttore generale di ACN. È...
SourcesACN release
È disponibile il Vademecum NIS con le indicazioni di carattere generale sui principali adempimenti le relative scadenze e alcuni focus su temi specifici. La prima scadenza, nel prossimo ottobre, riguarda il termine per...
SourcesACN release
Source: National Cybersecurity AgencyAll ACN news on NIS
CSIRT Italia alerts
Vulnerabilities with critical severity or under active exploitation reported by CSIRT Italia of the National Cybersecurity Agency. Updated automatically every 30 minutes; bulletins are published in Italian.
Rilevate due nuove vulnerabilità, di cui una con gravità "critica", che interessano il prodotto SonicWall Global Management System (GMS), piattaforma utilizzata per la gestione...
Disponibili Proof of Concept (PoC) per lo sfruttamento di molteplici vulnerabilità, di cui 3 con gravità "critica" e 24 con gravità “alta”, in FreeRDP, implementazione open source del...
SourcesCSIRT Italia bulletingithub.comgithub.com (2)github.com (3)
WatchGuard ha rilasciato aggiornamenti di sicurezza per sanare 4 vulnerabilità, 3 con gravità “critica” e una con gravità “alta”, nel prodotto AuthPoint Authentication Gateway, componente...
SourcesCSIRT Italia bulletinpsirt.watchguard.compsirt.watchguard.com (2)psirt.watchguard.com (3)
È stato rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-118539 - già sanata dal vendor - presente in Drupal Commerce Core, modulo dedicato all'implementazione di...
Updated on 5 November at 20:37All alerts and bulletins
The method
The same structure across every path, so the pace of study stays predictable from the first module to the certificate.
Step 1
The treatment of the topic, the regulatory background with sources you can verify, the documented real-world cases and the in practice chapter: what you do on Monday morning. Operational in tone, with no needless jargon.
Step 2
Pass mark 70%, unlimited attempts. Every answer, including a wrong one, comes with an explanation of why.
Step 3
A case to work through by choosing: every decision opens a different path and the outcome depends on what you chose, with an explanation of what would have happened otherwise. You can retake it as many times as you like.
At the end
Once the modules are complete, the final test of the path unlocks and, on passing it, a personalised PDF certificate with a verification code. It is valid for one year: after that the path reopens for recertification.
The proof
For a regulatory obligation, delivering the training is not enough: you have to be able to prove it years later. The platform produces by itself the evidence an audit asks for.
Every certificate carries a unique code: whoever receives it can check that it is genuine on the public verification page, without registering and without having to ask anyone.
Twelve months after completion the path reopens by itself: tests to retake on updated content and a new certificate. The training stays alive instead of becoming a PDF in a drawer.
A progress bar module by module and recorded study time: anyone following a path always knows where they stand, and anyone administering the training can document it.
Completions, test results and certificates stay on record even after the annual renewal: each person's training history can be reconstructed for the whole retention period.
Every lesson, every question, every diagram and every certificate exists in both languages: not two parallel courses, but the same path switching language with one click. Anyone with staff who do not work in Italian trains them and documents it the same way, with the same records and the same certificates.
The obligations
European legislation now requires organisations to have documented skills. For each obligation, article by article, the paths that address it.
NIS2 · Legislative Decree 138/2024
Management bodies must follow training and promote similar training for staff (art. 23); the measures include basic cyber hygiene practices, incident handling and business continuity (art. 24). The ACN specifications require a training plan approved by the body and a register (PR.AT-01) and, for essential entities, training for specialised roles (PR.AT-02).
Fundamentals, Hygiene, Awareness, GRC, Incident Response, Business continuity
AI Act · Reg. (EU) 2024/1689
From 2 February 2025, anyone providing or using AI systems must adopt measures that support the AI literacy of their staff, proportionate to their role and context of use (Article 4, as reworded by Reg. (EU) 2026/1744). In Italy, from 23 October 2026, Legislative Decree 179/2026 entrusts supervision to ACN, sets the penalties and reserves decisions on the employment relationship to a person.
Artificial intelligence: fundamentals, tools and the AI Act
GDPR · Reg. (EU) 2016/679
The controller must ensure that anyone acting under its authority is instructed on the processing (Articles 29 and 32); staff training is among the tasks overseen by the DPO (Article 39).
Awareness, Incident Response, Digital Forensics
DORA · Reg. (EU) 2022/2554 · CRA · Reg. (EU) 2024/2847
DORA requires financial entities to run digital operational resilience training programmes for all staff and specific training for the management body (Arts. 5 and 13), with continuity plans tested regularly; the Cyber Resilience Act requires manufacturers of products with digital elements to handle their vulnerabilities and, from 11 September 2026, to report those actively exploited (Art. 14).
GRC, Business continuity
NIS2 · Machinery Regulation · Reg. (EU) 2023/1230
NIS2 covers energy, water, transport and manufacturing, and its measures also apply to automation systems; the Machinery Regulation, applicable from 20 January 2027, requires protection against corruption and control systems that withstand deliberate attempts (Annex III, points 1.1.9 and 1.2.1). Neither of them mandates IEC 62443: the series is the method for demonstrating that the measures are adequate.
OT security assessment to IEC 62443
Consistency
A platform that trains people in cybersecurity is also judged by how it handles your data and your access. Here the rules taught in the courses apply first of all to us.
Privileged accounts can only sign in with a second factor. For learners, access stays simple: the weight of security falls on those who administer the platform, not on those who study.
The policy asks for long, memorable phrases, exactly as the Hygiene path teaches: no mandatory symbols pushing people towards predictable passwords.
A clear privacy notice at registration and a public register of purposes and retention periods, which anyone can consult without an account.
Encrypted traffic, daily backups with an integrity check and separate environments: the cyber hygiene of the courses, applied to the platform that hosts them.
Frequently asked questions
You create a free account and send the request from the path page. An administrator reviews it and, if approved, you receive by email a personal, single-use key to enter on the I already have a key page.
Yes. In the request you state how many people to train: a contact person receives the keys and distributes them. Each person studies with their own account and earns their own certificate.
That the path was completed by passing the module tests and the final test. Every certificate has a public verification code and is valid for twelve months, then the path reopens for an update. It is not a certification of persons under ISO/IEC 17024.
No: your organisation defines the plan and its management bodies approve it (ACN measure PR.AT-01, point 2). Each path gives you what the plan has to state: programme, content, duration and assessment methods. The GRC path places the plan among the documents of the compliance project and shows how its approval is kept on record.
Yes, for the training part. Art. 23 of Legislative Decree 138/2024 requires management bodies to follow training and to promote similar training for staff: the paths cover its content, and certificates, test results and study time remain recorded as evidence. Who to train and on what remains a documented decision of your organisation.
The estimated duration is shown on every path and on its presentation page. You study online, at your own pace and from any device; your progress is saved.
Every path shows its update date and cites the official sources. When a rule changes, the lessons and questions are revised; what is still under consultation is presented as such.
In Italian and in English: lessons, tests, exercises and certificates exist in both languages, and you switch from one to the other with a click.
Every path has its own overview page, with the full syllabus and how the course runs. From there, access takes three steps:
The key opens the path for 90 days, and 15 days before it expires you receive a reminder; once you complete it, certificates and progress remain yours.
The content is intended for training purposes and does not constitute legal advice. For the obligations that fall on your organisation, refer to the legislation in force and to qualified legal support.