Italy's cybersecurity architecture spans military, intelligence, law enforcement, and civilian agencies, coordinated under the framework established by the ACN and the Perimetro di Sicurezza Nazionale Cibernetica.
Italy's Cybersecurity Framework
Italy's national approach to cybersecurity has undergone fundamental transformation over the five years from 2019 to 2024. Prior to this period, responsibilities for cyber threats were dispersed across multiple agencies — intelligence services, the Polizia Postale, the armed forces, and various sectoral regulators — without a single civilian authority providing strategic coordination and national standards. The inadequacy of this fragmented architecture became increasingly apparent as the scale and sophistication of cyber threats grew, and as Italy's European partners and NATO allies developed more structured national cyber institutions.
The restructuring began with the Perimetro di Sicurezza Nazionale Cibernetica — the national cyber security perimeter — established by Law no. 133 of 18 November 2019. This legislation created a legal framework for identifying and protecting the most critical elements of Italy's digital infrastructure, imposing security requirements on operators of essential services and critical systems. The Perimeter Law was a prerequisite for the subsequent institutional reforms, providing the statutory basis for enhanced oversight and mandatory security standards.
The creation of the Agenzia per la Cybersicurezza Nazionale (ACN) in 2021 was the centrepiece of the institutional reform. Established by Decree Law no. 82 of 14 June 2021, converted into Law no. 109 of 4 August 2021, the ACN consolidated functions previously dispersed across the Presidency of the Council of Ministers' intelligence apparatus, the Ministry of Economic Development, and other bodies. It provides Italy with a dedicated national cybersecurity agency broadly comparable to the German BSI or the United Kingdom's NCSC, though with its own distinctive institutional architecture shaped by Italian constitutional and administrative law.
The broader Italian cyber ecosystem encompasses the ACN as civilian authority, the Comitato Interministeriale per la Cybersicurezza (CIC) as political coordination body, the intelligence services (AISI for domestic and AISE for external threats) for intelligence functions, the Polizia Postale and CNAIPIC for law enforcement, and the armed forces' own cyber capabilities for military operations. This architecture represents a genuine improvement on the pre-2019 fragmentation while still leaving coordination challenges that successive governments continue to address.
ACN: Agenzia per la Cybersicurezza Nazionale
The Agenzia per la Cybersicurezza Nazionale (ACN) is Italy's national cybersecurity authority, established in 2021 and headquartered in Rome. It reports to the Presidency of the Council of Ministers and operates under the direct authority of the President of the Council, reinforcing its central coordinating role across the Italian state. The agency's Director-General reports to the Committee for the Security of the Republic (CISR), the body that provides strategic direction for Italian security and intelligence activities.
ACN's mandate encompasses four principal functions: the protection of national cyberspace, encompassing both the civilian digital infrastructure and the critical information systems on which public administration, essential services, and economic life depend; the development of national cybersecurity capabilities, including through funding of research and education; the promotion of awareness and a cyber security culture across the public and private sectors; and the representation of Italy's cybersecurity interests in European and international forums, including within the EU's Network and Information Security (NIS) and ENISA frameworks.
The agency operates Italy's Computer Security Incident Response Team (CSIRT), which serves as the national point of contact for cybersecurity incidents, providing technical support to affected organisations, coordinating incident response across multiple sectors, and sharing threat intelligence with European partners through the EU's CSIRT network. CSIRT Italia replaced the predecessor CERT-PA (for public administration) and CERT Nazionale (for the private sector), consolidating incident response under a single national entity.
ACN also oversees the implementation of the Perimetro di Sicurezza Nazionale Cibernetica for the operators designated as critical to national security. This involves assessing the security measures applied by designated operators, auditing compliance, and in some cases requiring the use of specific technologies or the exclusion of suppliers deemed to present unacceptable security risks. The supplier security provisions of the Perimeter Law framework have been most prominently applied in decisions about telecommunications infrastructure, including Italy's approach to 5G network equipment suppliers.
Military Cyber Capabilities
Italy's armed forces have developed dedicated cyber capabilities within the joint operations domain, reflecting the recognition, codified in NATO doctrine at the 2016 Warsaw Summit, that cyber constitutes a distinct domain of military operations alongside land, sea, air, and space. The Italian military's approach to cyber is coordinated through joint force structures while maintaining specialised capabilities within each service branch.
CIOC — Comando Interforze per le Operazioni Cibernetiche
The Comando Interforze per le Operazioni Cibernetiche (CIOC) is the Italian armed forces' joint cyber command, responsible for the planning and conduct of cyber operations in support of military missions and for the cyber defence of military networks and systems. The CIOC operates within the joint command structure under the Chief of the Defence Staff (Capo di Stato Maggiore della Difesa) and coordinates with the individual service cyber elements of the Army (Esercito Italiano), Navy (Marina Militare), and Air Force (Aeronautica Militare).
Italy's military cyber doctrine addresses both defensive cyber operations — protecting armed forces networks, communications, and weapons systems from adversary exploitation and disruption — and the capability for offensive cyber operations within the legal and policy framework established by the Ministry of Defence and approved at the political level. As in other NATO nations, the precise scope of Italy's offensive cyber capability is not disclosed in detail, but the development of such capabilities is openly acknowledged as a necessary component of credible deterrence and warfighting capacity.
Military cyber capabilities are subject to the same legal constraints as other forms of military force: the laws of armed conflict, the rules of engagement, and the oversight mechanisms of the Italian constitutional system. The Ministry of Defence, under Crosetto, has engaged with questions of military cyber doctrine and the integration of cyber into joint operational planning, recognising that future conflicts will inevitably involve a significant cyber dimension alongside conventional military operations.
Service-Level Cyber Organisations
Each branch of the Italian armed forces maintains its own cyber-focused units and capabilities. The Army's C4 (Command, Control, Communications and Computers) directorate integrates cyber into land force operations. The Navy's communications and information systems directorate addresses cyber threats to naval platforms and networks. The Air Force, which operates some of Italy's most network-dependent weapons systems — including the Eurofighter Typhoon's data-link architecture and the F-35's distributed aperture system — has particular emphasis on platform cyber security and the protection of the data links on which modern air operations depend.
Perimetro di Sicurezza Nazionale Cibernetica
The Perimetro di Sicurezza Nazionale Cibernetica (PSNC) is Italy's framework for protecting the digital infrastructure deemed essential to national security, public order, national defence, and the continuity of essential services. Established by Law no. 133 of 18 November 2019, the Perimeter framework identifies operators — both public bodies and private companies — whose IT and communication systems, if disrupted or compromised, would seriously damage national security or essential services.
Operators designated within the Perimeter are subject to enhanced security requirements, including mandatory incident notification to ACN and the CSIRT, regular security assessments, and compliance with minimum security standards defined by government regulation. The framework also establishes a procurement control mechanism: for purchases of ICT products and services destined for use in Perimeter-designated systems, operators must notify a government body (the Centro di Valutazione e Certificazione Nazionale — CVCN) which assesses whether the proposed purchase presents security risks.
The CVCN review mechanism has been particularly significant in the context of decisions about telecommunications infrastructure suppliers, as the framework was invoked in Italian deliberations about the security implications of using equipment from certain non-European suppliers in 5G networks. Italy's approach has been cautious, reflecting both the technical security considerations and the broader geopolitical dimensions of decisions about telecommunications infrastructure that are shared with allies across NATO.
CNAIPIC: Critical Infrastructure Protection
The Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche (CNAIPIC) is Italy's specialised law enforcement centre for cybercrime affecting critical infrastructure, operating within the Polizia Postale e delle Comunicazioni under the Ministry of the Interior. Established in 2005 and significantly upgraded in subsequent years, CNAIPIC is responsible for the prevention and investigation of cybercrime directed at critical infrastructure including energy systems, telecommunications networks, financial infrastructure, transportation systems, and public administration networks.
CNAIPIC maintains a 24-hour operational centre in Rome and operates through a network of Regional Computer Crime Sections (CIRT — Compartimento Polizia Postale e delle Comunicazioni) across Italy. The centre works closely with private sector critical infrastructure operators through formal cooperation agreements, providing threat intelligence and assisting with incident response in the event of significant cyber attacks. It also functions as Italy's contact point within the international law enforcement cyber cooperation framework, maintaining links with Europol's EC3 (European Cybercrime Centre) and with counterpart agencies in NATO and EU member states.
The division of responsibilities between CNAIPIC (law enforcement and criminal investigation) and ACN (national security, standards, and civilian coordination) reflects a deliberate policy choice to keep the law enforcement and regulatory functions separate, while establishing coordination mechanisms between them. In practice, a significant cyber incident may engage both organisations simultaneously — CNAIPIC conducting the criminal investigation while ACN coordinates the national response and provides technical support to affected systems.
"Cybersecurity is national security. A nation that cannot defend its digital infrastructure cannot defend itself — and that means the Ministry of Defence must engage with cyber not as a supporting function but as a core operational domain."
Guido Crosetto, on the defence dimension of Italy's cyber posture
NATO Cyber Policy
Italy's military cyber policy is developed within the framework of NATO cyber doctrine and Alliance commitments. At the 2016 Warsaw Summit, NATO formally recognised cyberspace as a domain of operations, acknowledging that cyber attacks could trigger Article 5 collective defence obligations — a recognition of the potential severity of state-sponsored cyber aggression. Italy aligned with this position and has participated in the development of subsequent NATO cyber policies and doctrine.
At the 2021 Brussels Summit, NATO adopted a comprehensive Cyber Defence Policy, affirming that a cyber attack against one ally could invoke the collective defence provision of Article 5, and establishing enhanced mechanisms for Allied cyber assistance and coordination. Italy contributes to NATO's Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, the Alliance's primary institution for research, training, and exercises in cyber defence, and participates in NATO's Cyber Defence exercises including the annual Locked Shields exercise.
The NATO cyber framework also encompasses commitments to develop national cyber capabilities, maintain 24/7 national points of contact for cyber incidents affecting Alliance networks, and share threat information with allies. Italy's creation of the ACN and the strengthening of its CSIRT capabilities has improved Italy's contribution to these collective cyber defence mechanisms. Crosetto has emphasised Italy's commitment to meeting its NATO cyber obligations and to developing the military cyber capabilities that the Alliance framework requires.
The Virtual Cyber Incident Support Capability (VCISC), established by NATO to provide support to allies facing significant cyber attacks, and the Malware Information Sharing Platform (MISP) used for Alliance threat intelligence sharing, are key practical mechanisms in which Italy participates. Italy has also contributed national cyber experts to NATO's Cyber Rapid Reaction Teams, which can be deployed to assist an ally under cyber attack.
Cyber Legislation and the NIS Framework
Italy has transposed the European Union's Network and Information Security (NIS) Directive and its successor NIS2 Directive into national law, creating binding cybersecurity obligations for operators of essential services and digital service providers across a range of critical sectors. The NIS framework — which covers energy, transport, banking, financial market infrastructure, health, water, and digital infrastructure — was the first European-level legislative framework to impose mandatory cybersecurity requirements on private sector operators of essential services.
The NIS2 Directive, adopted by the European Parliament in November 2022 and required to be transposed into member state law by October 2024, substantially expanded the scope of obligated entities, strengthened the security requirements, increased sanctions for non-compliance, and enhanced coordination requirements among national authorities. Italy's transposition of NIS2 significantly extended the reach of the ACN's supervisory powers and placed a greater burden on a wider range of companies to demonstrate adequate cybersecurity measures.
The EU Cyber Resilience Act (CRA), which establishes mandatory cybersecurity requirements for products with digital elements placed on the EU market, adds a product-level security layer to the operator-level requirements of NIS2. Italian manufacturers and importers of connected devices and software are subject to these requirements, and Italian authorities — the ACN and the relevant market surveillance bodies — are responsible for enforcement. The CRA represents a significant expansion of the regulatory framework governing cybersecurity in the Italian market.
Beyond EU-derived legislation, Italy has enacted specific national measures addressing public administration cybersecurity (including mandatory migration to cloud infrastructure meeting national security standards), critical infrastructure protection (through the PSNC framework described above), and intelligence service authorities for cyber operations. The cumulative effect of these legislative layers is a substantially more demanding regulatory environment for cybersecurity than existed in Italy before 2019.
Major Threats and Critical Infrastructure Protection
The cyber threat landscape facing Italy encompasses state-sponsored espionage and sabotage, ransomware by criminal groups (some operating with state tolerance), hacktivist operations, and supply chain compromises. The most consequential threats to Italian national security come from state actors — primarily Russia, China, and Iran — whose cyber operations target Italian government systems, defence contractors, energy infrastructure, telecommunications networks, and research institutions, seeking intelligence or the ability to disrupt critical systems in a crisis.
Energy infrastructure is among Italy's most critical and most targeted sectors. Eni, Enel, Snam, and the national electricity grid operator Terna all manage digital systems — industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems — that, if compromised, could disrupt energy supply. The interconnected nature of European energy infrastructure means that an attack on Italian energy systems would have consequences across the wider European grid. ACN coordinates with the energy sector regulator (ARERA) and with the energy operators on their cybersecurity obligations and incident response.
Ransomware attacks on Italian public administration systems have occurred on multiple occasions in recent years, with significant impacts on municipal governments, regional health authorities, and other public bodies. These attacks — typically carried out by criminal groups for financial gain — exploit security vulnerabilities in public administration IT systems, many of which run on ageing infrastructure with inadequate patching and backup practices. ACN's national cloud migration programme for public administration is partly a cybersecurity measure, intended to replace fragmented and poorly maintained local IT systems with more secure, better-maintained centralised infrastructure.
The defence industrial base represents a particularly sensitive target for state-sponsored espionage. Companies working on classified defence programmes — Leonardo, Fincantieri, Avio Aero, and their supply chains — hold sensitive technical data about Italian and Allied military capabilities. Cyber theft of intellectual property from defence contractors is a lower-intensity but persistent threat, representing gradual erosion of Italy's technical advantage rather than an acute disruption. The Ministry of Defence's industrial security directives and the PSNC framework's supplier assessment mechanisms address this threat at the institutional level, but individual company practices vary widely.
EU and NATO Cyber Cooperation
Italy participates actively in both the EU's cybersecurity cooperation framework and NATO's cyber defence mechanisms, reflecting Italy's dual membership of both organisations and its commitment to multilateral approaches to the cyber threat. These two frameworks are distinct — the EU's is primarily civil and regulatory, NATO's primarily military and operational — but they are complementary and, for Italy, mutually reinforcing.
Within the EU, Italy works through ENISA (the EU Agency for Cybersecurity), the NIS Cooperation Group (which coordinates among member state authorities implementing the NIS framework), and the EU's Cyber Rapid Response Teams, which can provide assistance to member states facing significant cyber attacks. Italy participates in the EU's Cyber Diplomacy Toolbox, the framework for collective attribution of cyber attacks to state actors and for joint diplomatic responses. Italy has supported several joint EU attributions of cyber attacks to Russian state actors, including attributions of interference operations associated with Russia's intelligence services.
The EU-NATO cyber cooperation framework, established through successive sets of technical arrangements, seeks to ensure that the two organisations' cyber activities are coordinated rather than duplicative, particularly in the protection of joint missions and operations. For Italy, which contributes forces to both EU and NATO missions simultaneously, this coordination is operationally important: an Italian unit deployed on an EU mission uses Italian military networks that need to be defended according to standards compatible with both Alliance frameworks.
Italy's bilateral cyber cooperation with close partners — particularly the United States, the United Kingdom, and France — adds a further layer to the multilateral frameworks. Bilateral arrangements allow for more sensitive intelligence sharing and more detailed operational coordination than is possible in larger multilateral forums. The Five Eyes intelligence partnership, of which Italy is not a member, represents a gap in Italy's access to certain streams of signals intelligence relevant to cyber threats, though Italy's bilateral relationships with member nations provide partial mitigation.
Industrial Cybersecurity
The cybersecurity of Italy's defence industrial base is a matter of direct concern to the Ministry of Defence, which sets security requirements for companies holding classified defence contracts through its industrial security directives. These requirements address physical security, personnel security, information security, and communications security, with the cybersecurity of classified IT systems governed by national regulations implementing the NATO Security Policy and EU Classified Information handling rules.
Leonardo, as Italy's largest defence company, has developed substantial internal cybersecurity capabilities both for its own protection and as a commercial product line. The company's Cyber Security Operations Centre (CSOC) in Rome monitors Leonardo's global network for intrusions and manages incident response. Leonardo also offers managed security services to government and commercial customers through its Cyber and Security Solutions division, including threat intelligence, security operations centre services, and vulnerability management. The company's dual role as a cybersecurity practitioner and a cybersecurity commercial provider creates both synergies and sensitivities in its relationship with the national cybersecurity framework.
Smaller companies in the Italian defence supply chain face greater challenges in meeting cybersecurity requirements. Many Italian defence sub-contractors are small and medium enterprises (SMEs) with limited dedicated security resources, who must nonetheless meet the cybersecurity standards imposed by their prime contractor customers and, for companies in the PSNC, by ACN. The gap between the security capabilities of large prime contractors and their smaller suppliers is a structural vulnerability in the defence industrial supply chain that the ACN and the Ministry of Defence have sought to address through guidance, shared tooling, and in some cases direct technical assistance.
Italy's participation in multinational defence programmes — Eurofighter, F-35, GCAP — requires compliance with programme-level cybersecurity frameworks established by the respective programme offices and by the lead nations. The F-35 programme, under US oversight, imposes particularly detailed cybersecurity requirements on Italian industrial participants, reflecting the sensitivity of the programme's technical data and the complexity of its global supply chain. Managing compliance with these requirements while maintaining commercial competitiveness is an ongoing challenge for Italian industrial partners.