Compliance in Italy: Navigating the New Cloud Italy Strategy

Originally published by Schellman.

As the world becomes increasingly digital, governments around the world are taking measures to ensure the safety and security of their citizens' data.

One such example is the recent Cloud Italy Strategy, initiated by the Italian Agency for National Cybersecurity (ACN) which outlines specific compliance requirements for cloud service providers serving the Italian public sector.

Whether your organization is based in Italy or elsewhere, this new development may impact your cloud services and compliance efforts.

That’s why, in this article, we’re going to leverage our experience with the relevant ISO standards and Cloud Security Alliance (CSA) STAR Programs to disseminate Cloud Italy Strategy requirements so that cloud providers understand this new standard for cybersecurity more clearly.

Cloud Italy Strategy Data and Service Classifications

If you’re a cloud service provider that services (or potentially would seek to service) the Italian public sector, you will need to have to meet the requirements of this ACN Cloud Italy Strategy.

From what we know, there are three classifications of data and services within the Cloud Italy Strategy:

• Ordinary (QC1)
• Critical (QC2)
• Strategic (QC3)

Though Strategic is the highest classification—meaning it requires the most certifications—the ACN anticipates that the majority of CSPs will be considered Ordinary or Critical. Still, however you do classify, you’ll have to demonstrate the related minimum compliance requirements that, depending on the classification, could include the following:

• ISO 9001 certification
• ISO 27001 certification (including ISO 27017 and ISO 27018)
• ISO 22301 self-attestation and/or certification
• ISO 20000-1 self-attestation and/or certification
• CSA STAR Level 2 attestation or certification

Cloud Italy Strategy Compliance Requirements

How these certifications and requirements break down by classification is as follows:

Such certification requirements demonstrate a clear commitment to cybersecurity, but in fact, there’s more to do—in addition to these mandates noted above, cloud service providers will also have to ensure that they have controls and processes in place based on the Italian National Cybersecurity Framework as relevant to the cloud service provider’s classification.

What is the Timeline for Cloud Italy Strategy?

As much of a load this may seem to be, you unfortunately don’t have much time to begin your preparation—the Italian government has set a deadline of July 2023 for compliance with these new requirements.

For those who have already met the requirements of the previous Italian cloud scheme, you have a bit more of a reprieve in that the country has set January 2024 as your deadline to demonstrate compliance.