Producer portals and NIS2: how to govern access and traceability of third-party producers

NIS2 does not stop at internal systems: it extends cybersecurity risk management to the supply chain. In Italy, Legislative Decree 138/2024 requires essential and important entities to also manage the risks arising from suppliers and third parties, including those that access their systems. The portal used to manage relationships with third-party producers is one of the points where this risk becomes concrete: it is a door through which external users access data, schedules and documents.

A useful clarification: NIS2 does not automatically make every third-party producer or every portal subject to the directive. The obligations remain with the essential or important entity, which must however govern cyber risk along its own supply chain, including third-party access to its systems.

The deadline to make the ACN baseline security measures operational and documented is not a single date for everyone: it runs eighteen months from the individual notification of inclusion in the NIS register. For the first wave of entities, listed in 2025, the deadline falls in many cases in autumn 2026; for entities listed later it shifts. From that point, the ability to demonstrate the adoption of the measures through procedures, controls and evidence becomes particularly important, within ACN's supervisory powers.

What NIS2 requires from those who manage relationships with third-party producers

Among the baseline security measures set out in ACN Determination no. 379907/2025 (applicable from 15 January 2026), some have a direct impact on the design and management of an externally accessible portal. The Determination does not expressly mention producer portals, but these principles apply to them:

• Access control and identity management throughout the user lifecycle.
• Strong authentication, with particular attention to privileged, administrative and remote access, according to the applicable measures.
• Data protection with adequate cryptographic measures, in transit and at rest, according to the classification of the information and the risks.
• Traceability of operations, and the ability to detect and report an incident.
• Supply-chain security management: assessing supplier risks and defining adequate security requirements in contractual relationships with suppliers and third parties that access the systems (art. 24 of Legislative Decree 138/2024).

The critical point: external user access

Many producer portals start as applications with their own access system, separate from the corporate one. The risk concentrates there: external users who see more data than necessary, access that stays active after the relationship ends, operations with no reconstructable history.

For this reason, in a producer portal two principles matter more than the others: giving each user the minimum access needed for their role, and keeping track of relevant operations.

Producer portals and NIS2: the 7-point checklist

This is an initial self-assessment, not a certification tool. Even a single "no" is a signal to look into: check whether the requirement applies and assess whether corrective measures are needed.

1. Access by role and perimeter: each user accesses only the data and features they are authorised for, based on their role.
2. Strong authentication on access, with attention to privileged, administrative and remote access.
3. Tracked onboarding and offboarding: every external user is registered and can be deactivated in a controlled way.
4. Traceability of relevant operations: access events, changes to master data and schedules, administrative operations, permission changes and exports, with a reconstructable history.
5. Cryptographic protection of data in transit and at rest, according to the risks.
6. Governed integrations: the APIs expose data with uniform authentication and rules.
7. Contractual security requirements with ICT suppliers and third parties that access the portal.

How THOR governs producer access and data

THOR, MAS's producer portal, was created to standardise the relationship between those who offtake energy and third-party producers. Its architecture includes features that contribute to access governance, information segregation and operation traceability:

• Access by role and perimeter: profiles are built feature by feature; each user accesses only the producers and plants within their remit.
• Operation history: master data, schedules, outages and invoicing requests retain the author, the time and the evolution of their statuses.
• Uniform data management: measurements, schedules, Excel imports, REST APIs with OAuth 2.0 authentication and synchronisation with source systems all go through the same write controls.

The data collected then feeds the forecasting of SOLIS UPNR and bidding in ERGO Suite, with no manual steps outside the portal.

These features are useful building blocks for designing a system consistent with the principles of access control, traceability and data governance referred to by NIS2. Overall compliance nonetheless depends on the configurations, on the measures actually implemented and on the organisational processes of the entity using the platform.

Where to start

NIS2 compliance cannot be improvised just before an audit, and no single piece of software guarantees it on its own. But the access and traceability of a producer portal are among the most concrete areas to act on. The first step is an honest snapshot of the current state: who accesses what data, and with what audit trail.

Would you like an assessment of your producer portal's controls against the principles of NIS2? Write to us.

Sources: Legislative Decree 138/2024 transposing the NIS2 Directive, in particular article 24 on cybersecurity risk-management obligations and supply-chain security; ACN Determination no. 379907/2025 on baseline security measures (Annex 1 for important entities, Annex 2 for essential entities); NIS2 and supply-chain security. This article is for information purposes and does not constitute legal advice.