INDUSTRIES, PUBLIC PROCUREMENT | Italian Government Laid Out Cybersecurity Guidelines for Strategic IT Procurement

On 5 May 2025, it was published on the Italian Official Gazette the Decree of the President of the Council of Ministers (DPCM) dated 30 April 2025 setting out cybersecurity requirements applicable to the procurement of IT goods and services used in contexts tied to national strategic interests and security. The DPCM implements Article 14 of Law No. 90 of 28 June 2024 and introduces specific criteria and obligations for both public and certain private entities when sourcing technologies deemed critical. In particular, the DPCM identifies essential cybersecurity requirements (Annex 1), such as default secure configurations, secure update mechanisms, resilience against denial-of-service attacks, and strict access controls; defines a list of 22 categories of IT goods and services (Annex 2) that are subject to these requirements, ranging from identity management systems to smart meters and cloud services; it also sets out a trustworthiness criterion, providing preferential treatment for bids relying on cybersecurity technologies originating from Italy, the EU, NATO countries, or the six selected third countries enlisted in Annex 3 (Australia, South Korea, Japan, Israel, New Zealand, Switzerland). The Decree is framed as a dynamic instrument, subject to periodic updates to account for technological and international developments. This new framework will have significant implications on both public procurement strategies and vendor selection processes, particularly for operators in sensitive sectors.

Newsletter n. 107 – May 2025