ItalyDecreto-legge 21 settembre 2019, n. 105, National Cybersecurity Perimeter Duties
Art. 1, Decreto-legge 21 settembre 2019, n. 105
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- If you are an entity that the Prime Minister's administrative act includes in the national cybersecurity perimeter, prepare and update at least once a year a list of the networks, information systems and IT services on which your essential function or service depends, and send it to the National Cybersecurity Agency within six months of being notified of your inclusion (Decree-Law 105/2019, Article 1(2)(b)).
- Apply the security measures that the decree of the President of the Council of Ministers sets for those networks, information systems and IT services, including those on risk management, incident handling and the procurement of ICT goods, systems and services (Article 1(3)(b)).
- Before awarding a supply of ICT goods, systems or services for use on those networks in a category that the decree of the President of the Council of Ministers identifies, notify the CVCN, and use the supply only on the conditions and after the tests that the CVCN imposes (Article 1(6)(a) and (9)(e)).
- If you are identified as a supplier of goods, systems or services for those networks, cooperate with the CVCN's tests and bear their costs (Article 1(6)(b)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 1(11) punishes untrue information given to obstruct the preparation of the list of networks, information systems and IT services, the CVCN notification or the inspections, and failure to communicate such information on time, with imprisonment from one to three years.
Penalty structure
Article 1(9) sets administrative fines of 200,000 to 1,200,000 euro for the list, 250,000 to 1,500,000 euro for the security measures, and 300,000 to 1,800,000 euro for the CVCN notification and for use of products in breach of its conditions or tests.
- Rule
- Fixed only
- As of
- Minimum
- 200,000
- Currency
- EUR
- Fixed cap
- 1,800,000
Who enforces it
Enforcement body
The National Cybersecurity Agency (ACN), which since Decree-Law 82/2021 stands in for the Presidency of the Council of Ministers and the Ministry of Economic Development named in Article 1(12).
Settledness
- As of
What this law does
The decree-law establishes the national cybersecurity perimeter for public and private operators with a seat in Italy on which an essential State function or an essential service depends and whose malfunction could harm national security (Article 1(1)). The entities included in the perimeter are listed in an administrative act of the Prime Minister that is not published and carries no right of access, and each of them is notified of its inclusion separately (Article 1(2-bis)).
Each entity included in the perimeter must prepare, and update at least once a year, a list of the networks, information systems and IT services within its remit, and send it to the National Cybersecurity Agency within six months of being notified of its inclusion (Article 1(2)(b)).
A decree of the President of the Council of Ministers sets security measures for the networks, information systems and IT services on that list, covering security organization, security policies and risk management, incident mitigation and handling, physical and logical protection of data, integrity of networks and systems, operational continuity, monitoring and testing, training, and the procurement of ICT goods, systems and services (Article 1(3)(b)).
A regulation governs the procedure by which an entity in the perimeter that intends to award a supply of ICT goods, systems or services for use on those networks, in categories identified by a decree of the President of the Council of Ministers, notifies the National Evaluation and Certification Centre (CVCN) (Article 1(6)(a)).
Within 45 days of receiving that notification, extendable once by 15 days in complex cases, the CVCN may carry out preliminary checks and impose conditions and hardware and software tests (Article 1(6)(a)). The suppliers identified as providers of goods, systems and services for those networks must cooperate with the CVCN in its tests and bear their costs (Article 1(6)(b)).
Failure to prepare, update or send the list of networks, information systems and IT services is punished by an administrative fine of 200,000 to 1,200,000 euro (Article 1(9)(a)). Failure to observe the security measures is punished by an administrative fine of 250,000 to 1,500,000 euro (Article 1(9)(c)).
Failure to notify the CVCN within the prescribed time, and the use of products or services in breach of its conditions or without passing its tests, are each punished by an administrative fine of 300,000 to 1,800,000 euro (Article 1(9)(d) and (e)).
Anyone who gives untrue information to obstruct or influence the preparation of the list of networks, information systems and IT services, the notification to the CVCN or the inspections, or omits to communicate such information on time, is punished by imprisonment of one to three years (Article 1(11)).
The Presidency of the Council of Ministers, for public entities, and the Ministry of Economic Development, for private entities, are the authorities that ascertain violations and impose the administrative sanctions (Article 1(12)). A later amendment provides that every reference in the decree-law to the Ministry of Economic Development and to the Presidency of the Council of Ministers is read as a reference to the National Cybersecurity Agency (Article 1).
The decree-law entered into force on and was converted, with amendments, by Law 133 of .
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .