National Cybersecurity Strategy The evolution of the national cybersecurity legislation To face the increased interconnection and interdependence between IT systems and their related threats, both the EU and Italy adopted some legislation in continuous evolution. In a nutshell, during the last five years, Italy has adopted the following acts and regulations on cybersecurity: Prime Minister’s Decree (DPCM) of 17 February 2017, which updated the national cybersecurity architecture established by DPCM of 23 January 2013; Legislative Decree of 18 May 2018, no. 65 (thereafter “NIS Decree”), which provides for an obligation upon Operators of Essential Services and Digital Services Provides to both notify cyber incidents having a relevant impact on service continuity and implement security measures based on risk assessment; Law Decree of 21 September 2019, no. 105 (thereafter “Perimeter Decree”), which established the National Security Perimeter for Cyber, with the aim of protecting digital assets the malfunctioning, interruption, also partial, or improper use of which may determine a prejudice for national security. It provides, compared to the NIS Decree, for stricter criteria on incident notification and higher security levels, also for the supply chain, as well as specific procedures for procurement of ICT intended to be used on such digital assets; Law Decree of 18 July 2020, no. 76, which moved forward digitalization of the Public Administration, providing that such digitalization shall happen in compliance with network and information security principles, including workforce’s professional development and promotion of the awareness on the importance of network and information security; Law Decree of 14 June 2021, no. 82, providing for urgent provisions on cybersecurity, definition of the national cybersecurity architecture and establishment of the National Cybersecurity Agency; the Italian Cloud Strategy, adopted in the context of the triennial plan for ICT in the Public Administration for 2020-2022 and defined by the Department for digital transformation in collaboration with the National Cybersecurity Agency, with the aim of encouraging the use of solutions based on cloud computing by the Public Administration; Legislative Decree of 8 November 2021, no. 207, implementing the Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code. It provides, among others, for cybersecurity requirements for public electronic communication networks or for publicly accessible electronic communication services, the obligation to notify significant cyber incidents, as well as the adoption of cybersecurity measures, attributing the competence on the subject to the National Cybersecurity Agency; Law Decree of 21 March 2022, no. 21, which provides, among others, for the redefinition of the exercise of special powers on electronic communication services based on 5G, as well as on other services, goods, relations, activities and technologies which are relevant for cybersecurity, including those related to cloud technology. Specifically, it redefined the obligations and notification procedures by interested companies as well as the procedures for the exercise of the special powers, the monitoring and sanctioning by the Government, establishing the participation of the National Cybersecurity Agency, the possibility of using the National Assessment and Certification Centre (CVCN) and the carrying out of inspection and verification activities. 25