La nuova legge sulla cybersicurezza, un passo avanti e due indietro

The new law on cybersecurity implements some important organisational and functional changes, which aim to strengthen the institutional role of the National Cyber Security Agency and the cyber resilience of public authorities. In particular, the reform amends several specific profiles: from the reporting obligations of cyber incidents to the sanctions and address functions of the Agency, from the introduction of the cybersecurity manager to the definition of minimum cybersecurity requirements in public procurement related to ICT goods and services. However, the effectiveness of the regulatory act seems to be quite limited, especially in view of the financial invariance clause contained in the law and in view of the new interpretative issues raised by the law, since some of its provisions were exceeded by the entry into force of the Legislative Decree 4 September 2014, no. 138.