Cyber security for public administration
Municipalities, consortia and publicly owned companies run services that citizens cannot buy elsewhere. The Italian rules are many and overlap: it pays to start with the ones that ask for technical proof.
Cyber security in the public sector: services that cannot stop
When a local authority is hit, the population register, local taxes, payments to suppliers, document registration and sometimes the local police all stop. Citizens notice immediately, and the data the authority holds, from certificates to social services data, can end up published online. Cyber security in public administration is therefore first and foremost about continuity of service.
The weaknesses recur: systems managed by several external suppliers with their own access, applications in use for many years, branch offices connected to the same network, staff who change while their accounts stay active, institutional websites and online service portals exposed to anyone. In many small authorities IT is in the hands of one or two people, who also deal with everything else.
The typical attacks are no different from those against businesses: phishing aimed at the offices, reused credentials, known vulnerabilities never fixed on a server reachable from the internet. What changes is the impact, which falls on a whole community.
AgID minimum measures, NIS2 for public bodies and Law 90/2024
Four Italian references, each addressed to different bodies. It helps to know which ones concern you before deciding where to start.
Minimum ICT security measures
Circular no. 2/2017 from AgID, the Agency for Digital Italy, applies to all public administrations. It sets three levels (minimum, standard, high), with the minimum mandatory, and requires the digital transition officer to sign and keep the implementation form. The controls derive from the CIS Controls.
NIS2 for public administrations
Legislative Decree 138/2024, the Italian law transposing NIS2, includes in Annex III central government bodies, Regions and Autonomous Provinces, metropolitan cities, municipalities with more than 100,000 inhabitants, municipalities that are regional capitals and local health authorities, as well as other categories of public bodies. Annex IV allows in-house companies, publicly owned companies and publicly controlled companies to be included.
Law 90/2024
For central government bodies, Regions, metropolitan cities, large municipalities, regional capitals and other listed bodies: reporting of incidents to ACN, Italy's National Cybersecurity Agency, within 24 hours, full notification within 72 hours, and a cyber security unit and contact person.
GDPR and the Three-Year Plan
Every public body is a data controller: records of processing, Article 32 measures and notification of data breaches to the Garante (the Italian Data Protection Authority) within 72 hours. The Three-Year Plan for IT in Public Administration, updated every year, has cyber security among its pillars.
Is a small municipality outside NIS2? At present, municipalities with fewer than 100,000 inhabitants that are not regional capitals do not appear in Annex III, but they remain subject to the AgID minimum measures and the GDPR. For a precise check read who must comply with NIS2 and consult the portal of ACN, the National Cybersecurity Agency (in Italian).
The AgID minimum measures, control by control
The control families in the circular are the same ones it pays to start from for NIS2. Here is which Dottor Box services produce the evidence for each one.
| Control family (ABSC) | What Dottor Box produces |
|---|---|
| 1 · Device inventory | Asset Management: machines with the agent and devices found by the network map of the Cyber Drill probe |
| 2 · Software inventory | Authorised software: what is installed, who authorised it, alerts on new applications |
| 3 · Secure configurations | Configuration checks by the Cyber Agent and Microsoft 365 or Google Workspace posture |
| 4 · Vulnerability assessment and remediation | Internal, external and institutional website Vulnerability Assessment, with history and comparison between scans |
| 5 · Administrative privileges | Access logs with administrator accounts, in line with the Garante's order on system administrators |
| 8 · Malware defence | Antivirus status on endpoints and flagging of unprotected machines |
| 10 · Backups | The Backup & Recovery questionnaire in Business continuity |
| 13 · Data protection | Open shares and exposed credentials found by Dark Web Monitoring |
Evidence that stays even when the people change
A form you can stand behind
The implementation form for the minimum measures rests on scans and inventories, not on boxes ticked from memory.
The authority's memory
Archived reports, versioned procedures and scan history remain even when the contact person moves to another office.
Suppliers under control
ICT supplier qualification questionnaires completed from a link, with the evidence attached.
Incidents handled with a method
Roles assigned and phases tracked with Incident Response, to meet the reporting deadlines.
Dottor Marc is ISO/IEC 27001 and ISO 9001 certified. The authority's data sits in a dedicated environment, on Google cloud infrastructure and Dottor Marc's own data centres, with an appointed data protection officer.
Technical and contractual details are on the Security and compliance page. For how activation works for a public body, write to us.
Questions about cyber security in public administration
Are the AgID minimum measures still mandatory?
Yes. AgID circular no. 2/2017 set 31 December 2017 as the deadline for compliance, and since then all administrations have had to apply at least the minimum level. The measures have not been replaced by NIS2: for bodies that also fall under Decree 138/2024, its obligations are added. The implementation form must be kept up to date, not filled in just once.
Which public administrations fall under NIS2?
Annex III of Legislative Decree 138/2024 lists central government bodies, Regions and Autonomous Provinces, metropolitan cities, municipalities with more than 100,000 inhabitants, municipalities that are regional capitals, local health authorities and some categories of other public bodies. Annex IV allows in-house companies, publicly owned and publicly controlled companies and local public transport operators to be included, if identified by ACN, the National Cybersecurity Agency.
How quickly must a public body report a cyber incident?
Law 90/2024 requires the bodies it lists to report the incident to ACN, the National Cybersecurity Agency, within 24 hours and to complete the notification within 72 hours. If the body is also a NIS2 entity, the deadlines of Decree 138/2024 apply; if personal data is involved, there is also notification to the Garante within 72 hours. Our data breach guide sums up the steps.
Does a publicly owned company have to apply the AgID minimum measures?
The circular is addressed to public administrations. For publicly owned and in-house companies it is worth checking case by case, also in the light of the service contracts with the shareholding public body, which often refer to the same measures. As for NIS2, Annex IV makes them eligible for inclusion if ACN identifies them: adopting the basic controls today avoids having to catch up tomorrow.
What are the CIS Controls and how are they linked to the AgID measures?
They are a list of technical security controls, in order of priority, published by the Center for Internet Security. The AgID minimum measures are an adaptation of them for Italian public administration. In Dottor Box you can carry out the self-assessment against the CIS Controls and use the same scan data as evidence for both.
The modules for a public body
Asset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeAuthorised software
Installed software compared with the approved list, to find what should not be there.
Learn more SeeAccess logs
System administrator logins collected and retained as the Italian Data Protection Authority requires.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more ComplianceCIS Controls · IG1
Basic cyber hygiene: the starting point for every SME.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.