Obtaining ISO/IEC 27001: turning regulatory obligations into growth opportunities.

In a context shaped by the growing digitalisation of businesses and increasingly sophisticated cyber threats, the ability to protect data, systems and infrastructure is essential to ensure business continuity, stakeholder protection and corporate reputation.

In this regard, ISO/IEC 27001 is the leading international standard for information security management. It defines the requirements for establishing, maintaining and improving an Information Security Management System (ISMS).

It enables companies to identify, assess and mitigate cyber risks through structured processes and globally recognised controls.

In February 2025, as an operator in the energy sector, BELENERGIA was called upon to comply with the provisions of the NIS 2 Directive — the European Union's regulatory framework imposing stringent cybersecurity and risk management standards to protect critical infrastructure.

We turned this regulatory obligation into an opportunity for the BELENERGIA Group: both to strengthen and structure our cybersecurity posture, enabling the group to maintain sovereignty over its data, and to align with ISO/IEC 27001, which addresses most NIS 2 requirements.

A multidisciplinary working group was established to adopt a 360° approach to the world of IT and cybersecurity.

Bringing together IT consultants from Argomedia, advisory expertise from Ernest & Partners, advanced solutions from AmagisTech and our internal teams (Amedeo Sciagura and Omar Speranza), BELENERGIA integrated the Vanta platform into its processes. This platform enables the visualisation and management of cyber risks, the inventory of all relevant employee devices, and a step-by-step approach to progressive compliance, ensuring a continuous and consistent gap analysis.

This holistic and multidisciplinary approach made it possible, within just a few months, to achieve full compliance with NIS 2 Directive requirements and to obtain ISO 27001 certification, covering Belenergia SPA and Belenergia Mezz Finance.

But the true tangible outcome — both in the short and long term — goes beyond mere certification. BELENERGIA has created a new internal paradigm in its approach to IT matters, supported by a comprehensive and integrated system for preventing risks and threats.

As required by the ISO standard, in the coming months the group will continue its journey of continuous improvement on cybersecurity matters, ahead of its next renewal in April 2027.

View the ISO 27001 certificate here.

Andrea Emanuele is ESG & Quality Coordinator at Belenergia