When One IT Stack Serves Many Legal Entities, NIS2 Turns Governance Into the Real Attack Surface
Centralized technology can simplify operations, but under NIS2 it also forces corporate groups to define who owns risk, who reports incidents, and who carries board-level responsibility.
In corporate groups, the hardest cybersecurity problem is not always the firewall or the backup system. It is the operating model. When multiple legal entities depend on the same IT, the security question quickly becomes a governance question: which company speaks for the group, which board approves the controls, and how does accountability survive shared services?
That is the pressure point exposed by Italy’s NIS2 transposition. The regulatory frame does not treat cybersecurity as a purely technical discipline. It expects management bodies to oversee risk, incident handling, and the security of dependencies that sit inside or alongside the group structure. For organizations with centralized IT, that means the paperwork has to match the architecture.
Fast Facts
- NIS2 is built around risk management, incident reporting, and governance, not just technical hardening.
- Italy’s D.Lgs. 138/2024 creates compliance obligations for business groups that rely on centralized IT.
- An intra-group agreement can be used to define governance, notifications, supply-chain matters, and board responsibilities.
- Boards remain responsible for cybersecurity oversight even when services are shared across entities.
- Centralized IT can turn one operational weakness into a group-wide coordination problem.
Why shared services complicate NIS2
From a technical perspective, centralized identity, logging, backup, SOC, or hosting services create a common control plane. That is efficient, but it also means a single misconfiguration, delayed escalation, or service outage may affect more than one legal entity at once. In a group environment, the challenge is not only preventing compromise, but proving that each entity can still meet its own reporting and oversight duties if the shared layer is under stress.
This is where the intra-group agreement matters. It is best understood as an internal control-and-responsibility mechanism, not a magic shield. It can help assign who detects, who escalates, who notifies, and who documents decisions. But it cannot erase statutory duties. If a board delegates security operations, it still needs visibility into how those operations work, what the dependencies are, and how fast the group can react when a significant incident appears.
There is also a supply-chain angle. Shared services inside a group may behave like supplier relationships from a security standpoint, especially when one entity delivers platforms or security functions to others. In that setting, lifecycle controls, change management, and regular review of dependencies become just as important as external vendor checks.
At the time of writing, public information does not fully establish the exact contractual form every group will use, nor the full practical scope of every obligation in every sector. The available information supports a risk analysis, not a definitive claim that one document solves every compliance problem.
The lesson for corporate groups
NIS2 is forcing a simple but uncomfortable realization: centralized IT makes security more scalable, but it also makes failure more scalable. Groups that rely on shared services need one clear map of legal entities, one incident-playbook that works across those entities, and one board-level view of who is accountable for what. In that sense, the real control is not the server room. It is the structure around it.
The broader lesson is that compliance in a group setting is no longer about checking boxes in isolation. It is about making governance, reporting, and resilience work together before an incident turns an internal efficiency model into a compliance blind spot.
WIKICROOK
- NIS2: The EU cybersecurity framework that combines risk management, incident reporting, and board oversight duties.
- D.Lgs. 138/2024: Italy’s transposition measure for NIS2, setting domestic compliance expectations.
- Intra-group agreement: An internal arrangement used to regulate governance, notifications, supply-chain matters, and board responsibilities within a corporate group.
- Management body: The board or equivalent leadership organ responsible for cybersecurity oversight and approvals.
- Common failure domain: A shared technical environment where one issue can affect multiple entities or services at once.
