System administrator: what it means in Italy

System administrator: what it means

A system administrator (amministratore di sistema, AdS) is the person who manages and maintains IT systems, networks and databases with elevated privileges. In Italy the role is the subject of a specific order from the Garante per la protezione dei dati personali (the Italian Data Protection Authority), dated 27 November 2008.

In short

The Garante's order, published in the Italian Official Journal (Gazzetta Ufficiale) no. 300 of 24 December 2008 and amended in June 2009, treats as system administrators not only systems engineers in the strict sense, but also the administrators of databases, networks, security appliances and complex software systems, whenever they can access personal data. They can be internal or external: the IT supplier or consultant who manages the servers remotely fully fits the definition.

What the Garante requires

assessment of the experience, capability and reliability of whoever receives the role;
individual appointment, listing the areas in which each person is allowed to operate;
a list of administrators with the functions assigned to them, kept in an internal register; if the administrators also process employee data, their identity must be made known to staff;
review of the administrators' work, at least once a year;
logging of logical access (authentications) to systems and archives: the logs must be complete, unalterable, with verifiable integrity, record the date, time and a description of the event, and be retained for an appropriate period of no less than six months.

If the work is outsourced, the data controller must keep the identifying details of the people who act as administrators on the supplier's behalf.

Why it matters

Whoever holds the highest privileges can read, change or delete almost anything, and a compromised account of theirs is an attacker's most prized target. The order exists to make it traceable who gets in, and when. In practice, logging is the hardest part to comply with: logs must be collected centrally, protected from tampering and available when needed, for example during an inspection or after an incident. A SIEM and multi-factor authentication on administrative accounts are the natural companions to this obligation. Read more in the guide to system administrator logs and in the solution dedicated to system administrators.

Example

A 60-person company outsources server management to an external supplier with three technicians. To comply, it appoints the three technicians and its own internal IT manager individually, keeps the list up to date, collects logins to servers and PCs in a central log retained for more than six months, and once a year reviews the administrators' work on the basis of those logs. When a technician leaves the supplier, their account is disabled and the list updated the same day.

Related terms

Where you find it in Dottor Box

Access Logs collects logins from endpoints and, if you use Microsoft 365, from the cloud tenant, together with the declared register of system administrators and a full CSV export to attach to an audit or inspection. Alerts flag repeated failed attempts, logins from new countries and administrative logins.