INDUSTRIES, TECHNOLOGY | New rules to boost cybersecurity enter into force

On 2 July 2024, Law No. 90 of 28 June 2024 setting forth “Provisions to strengthen national cybersecurity and cybercrimes” was published in the Italian Official Journal. This Law lays down measures to reach a high level of cybersecurity, highlighting the importance of establishing an internal cybersecurity risk management (the “Cybersecurity Law”). Pursuant to Article 1 of the Cybersecurity Law, public administrations must notify any incidents or cyber threats within 24 hours, in accordance with the procedures available on the National Cybersecurity Agency website. Under Article 8 of the Cybersecurity Law, public administrations shall designate a cybersecurity unit and a cybersecurity officer. They shall enhance public procurement rules for the award of IT goods and services to achieve a high common level of cybersecurity. Furthermore, the Cybersecurity Law amended the catalogue of crimes that give rise to administrative liability of companies under Legislative Decree No. 231 of 8 June 2001. In particular, Article 24-bis increases the penalties for cyber-crimes such as abusive access to a computer system, illicit interception of cyber communications and public data corruption, and introduces the new crime of cyber extortion.

Newsletter n. 98 – July 2024