Italian Cybersecurity Agency

Italian Cybersecurity Agency
Name	Italian Cybersecurity Agency
Native name	Agenzia per la Cybersicurezza Nazionale
Formed	2021
Jurisdiction	Italian Republic
Headquarters	Rome
Chief1 name	Renato Urraro
Chief1 position	Director
Parent agency	Presidency of the Council of Ministers

Italian Cybersecurity Agency is the central authority for national cybersecurity in the Italian Republic. Created to coordinate civil, infrastructure, and strategic digital defenses, the agency integrates policy, operational, and regulatory roles. It interacts with national institutions, regional bodies, critical infrastructure operators, and international partners to manage risks arising from cyber threats.

History and Legal Framework

The agency was established by Legislative Decree No. 82/2021 and later refined through ministerial decrees and parliamentary oversight linked to the functions of the Presidency of the Council of Ministers, the Ministry of Defence (Italy), and the Ministry of Economy and Finance (Italy). Its creation followed policy debates in the Italian Parliament and public inquiries prompted by incidents affecting the Istituto Nazionale di Statistica, ENEL, and Azienda Sanitaria Locale networks. Prior frameworks included the National Cybersecurity Perimeter and earlier strategies promulgated by the Italian National Security Council and the Department of Information for Security (DIS). EU instruments such as the NIS Directive and the establishment of the European Union Agency for Cybersecurity influenced national legislation, alongside international commitments under the North Atlantic Treaty Organization and the G7.

Structure and Leadership

Leadership is vested in a Director appointed by the President of the Council of Ministers and accountable to the Council of Ministers and relevant parliamentary committees including the Committee on Defence (Italian Senate). Organizationally, the agency comprises directorates for Policy, Operations, Research, and Liaison, and units dedicated to Critical Infrastructure, Incident Response, and Public-Private Engagement, interacting with bodies like the Istituto Superiore di Sanità, Polizia di Stato, and the Carabinieri. Advisory boards include experts from universities such as the Sapienza University of Rome, the Politecnico di Milano, and research organizations including the Istituto Nazionale di Ricerca Metrologica and industry stakeholders like Leonardo S.p.A., TIM (Telecom Italia), and Eni.

Mandate and Functions

The agency’s statutory functions include national cyber risk assessment, defensive operations for the National Cybersecurity Perimeter, certification of information and communication technologies, and the development of cybersecurity standards. It issues guidance to public administrations, coordinates with operators deemed "essential" under the NIS Directive, and manages responses to incidents affecting entities such as Aeroporti di Roma, Ferrovie dello Stato Italiane, and healthcare providers like the Azienda Ospedaliero-Universitaria Policlinico Umberto I. It oversees national exercises with participants from the European Commission, US Cyber Command, and NATO Cyber Centre and fosters resilience programs with the World Bank and International Telecommunication Union.

Operations and Incident Response

Operationally the agency runs a National Computer Emergency Response Team coordinating with sectoral CERTs such as the CERT-PA and private-sector SOCs operated by firms like Accenture, KPMG, and Capgemini. It conducts threat intelligence sharing with platforms including FIRST and engages in digital forensics cooperating with the Public Prosecutor's Office and judicial police units. High-profile operations have involved responses to ransomware incidents impacting energy firms, supply chain compromises affecting vendors tied to Leonardo S.p.A. and Sogei, and nation-state intrusion campaigns linked in reports to actors associated with events like the NotPetya and SolarWinds incidents. The agency also maintains crisis exercises with the Civil Protection Department and the European Centre for Disease Prevention and Control when healthcare IT is impacted.

Collaboration and International Relations

The agency participates in multilateral fora including the European Union cybersecurity architecture, NATO Cooperative Cyber Defence Centre of Excellence, and bilateral dialogues with the United States Department of Homeland Security, French National Cybersecurity Agency (ANSSI), and German Federal Office for Information Security (BSI). It signs memoranda of understanding with academia such as University of Bologna, with industry groups like Confindustria, and with international organizations including the International Monetary Fund for cyber resilience in finance. Cooperation extends to cybercrime investigations with Europol and the INTERPOL cyber units and to standards bodies like ISO and ETSI.

Cybersecurity Policy and Standards=

The agency promulgates national guidelines aligned with ISO/IEC 27001, the NIS Directive, and EU certification frameworks under the Cybersecurity Act (EU). It develops sector-specific frameworks for telecommunications, finance, energy, and transport, referencing standards used by SWIFT, European Central Bank, and regulatory authorities such as the Bank of Italy and CONSOB. Policy instruments include national risk assessments, supply chain security guidance referencing vendors like Microsoft and Cisco Systems, and procurement rules that intersect with public administration reforms driven by the AgID.

Criticism and Controversies

Criticism has centered on perceived overlaps with the DIS and the Agenzia delle Entrate on data handling, debates in the Italian Chamber of Deputies over transparency of operations, and concerns raised by civil society groups such as Liberal Forum and privacy advocates referencing the Garante per la protezione dei dati personali. Industry voices in trade associations like Federazione Nazionale dei Cavalieri del Lavoro and unions have debated resource allocation, while academic commentators from institutions including Bocconi University and Luiss Guido Carli question the balance between security and digital rights. International commentators have compared the agency's remit to agencies in France, Germany, and the United Kingdom and critiqued clarity on procurement and vendor certification processes.

Category:Government agencies of Italy Category:Cybersecurity in Italy