Italian cybersecurity architecture: protection of critical infrastructure, technical, legal and institutional innovations

The article is devoted to the study of the Italian cybersecurity architecture, the strategy and organizational principles of protecting the country’s critical infrastructure, and the logic of technical, legal, and institutional innovations in the field of cyber defense of the Italian Republic. It has been established that Italy took its first regulatory steps on cybersecurity relatively late compared to other European countries – in 2013 (‘Monti Decree’). The second Italian cybersecurity strategy (‘Gentiloni Decree’) aimed to streamline the institutional cybersecurity ecosystem in accordance with the requirements of the European ‘Network and Information Security (NIS) Directive’. An analysis of the evolution of Italian cybersecurity suggests that between the 2013 and 2018 strategies, most of the changes concerned the institutional framework (reduction of the number of actors with overlapping functions; centralization of the structure) rather than the formulation of cybersecurity policy. In accordance with the ‘NIS Directive’, a national team was established to respond to computer incidents (‘Computer Security Incident Response Team’, CSIRT). It was noted that the further development of a consistent and comprehensive legal framework in the field of cybersecurity was facilitated by the creation of the so-called ‘national cybersecurity perimeter’ (‘Perimetro di Sicurezza Nazionale Cibernetica’). Lawmakers have clearly defined ‘critical technologies’: artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defense, energy storage, quantum, nuclear, nano- and bio-technologies. It was noted that in recent years, Italy has strengthened its cyber defense capabilities by creating the National Cyber Security Agency (ACN), which was tasked with implementing the new (third) National Cyber Security Strategy for 2022–2026. The authors believe that the wide range of measures provided for by Italian legislation largely complies with the cybersecurity requirements developed by EU institutions. It is concluded that flexible national legislation based on government decrees avoids excessive regulatory framework, as it can be amended easily and relatively quickly.