ECP vs AGID Misure Minime (Italy): Private-Sector MSP vs Italian PA Security Baseline

No. AGID Misure Minime is a 2017 framework for Italian public administrations. Italy's NIS2 transposition is D.Lgs. 138/2024, in force since October 16, 2024, managed by the ACN (Agenzia per la Cybersicurezza Nazionale). The ACN has issued its own technical security guidelines for NIS2-obligated entities. An Italian PA or private entity audited under NIS2 is assessed against the ACN framework, not AGID Misure Minime. The two frameworks share some control areas (both draw on CIS Controls), but AGID Misure Minime does not provide legal coverage for NIS2 obligations. Italian PA in NIS2 scope must satisfy both: AGID Misure Minime for their PA-baseline obligations and the ACN NIS2 framework for their NIS2 obligations.

Not natively today. ECP implements CyFun (the Belgian CCB framework). The control areas overlap — CyFun and AGID Misure Minime both trace to the CIS Controls lineage — so an Italian entity using ECP would find a familiar control structure. But ECP does not generate an AGID-format self-declaration or an ACN-ready NIS2 compliance bundle. The ECP framework engine (ADR-0039) is designed to host additional national frameworks; an Italian NIS2 path is plausible on that engine, but is not on the committed roadmap. If Italian NIS2 is your target today, engage an Italian ACN-aligned consultancy.

The framework has not been formally updated since its 2017 publication. It is based on CIS Controls v6.0 (October 2015), and CIS has since released v7.1 and v8 with significant updates. Meanwhile, the threat landscape has changed dramatically — ransomware-as-a-service, supply chain attacks, and cloud-first infrastructure are all developments the 2017 document does not explicitly address. AGID has not issued an update or a revised circular. Italian public administrations that follow only the Minimum level of the 2017 framework are working from a dated baseline. Italian NIS2 (ACN framework, D.Lgs. 138/2024) is more current, but AGID Misure Minime itself has not been revised.

They are different obligations with different scopes. AGID Misure Minime (2017): a PA-only ICT security baseline, self-assessed, free, based on 20 CIS Controls-derived controls. ACN NIS2 framework (2024): Italy's transposition of the EU NIS2 Directive, covering both public and private entities in 18 essential/important sectors. ACN has issued specific technical guidelines (Linee Guida NIS) with its own security measures, incident reporting obligations (from January 2026), and compliance deadline (October 2026). The ACN framework imposes external supervision and fines up to €10M or 2% of turnover for essential entities. AGID Misure Minime has no fine regime — it relies on the internal accountability of the responsible manager.

It depends on who the Italian clients are. If they are Italian public administrations: they need AGID Misure Minime (for the PA baseline) and ACN NIS2 (if they fall in NIS2 scope) — ECP does not natively address either today. If they are Italian private-sector SMEs in NIS2 scope: they need the ACN framework under D.Lgs. 138/2024 — again, ECP does not natively address this. If your Italian private clients are not in NIS2 scope: there is no mandatory Italian baseline for them; voluntary ISO 27001 is common. ECP today is purpose-built for Belgian CyFun delivery. For cross-border Italian engagements, honest advice is to partner with an Italian ACN-aligned consultancy while using ECP for your Belgian book.