Who is Concerned
Since December 31, 2017, as indicated in the Digital Administration Code (CAD - art. 17), there is an obligation for public administrations to maintain minimum security standards related to IT infrastructures. Therefore, all public administrations are required to comply with the minimum IT security measures developed by AgID.
Depending on the type of public administration, it may be necessary to demonstrate compliance with different ICT security standards. However, it is mandatory for all public administrations to complete a form certifying the adoption of minimum IT security measures.
What They Are and What They Consist Of
The implementation of the regulation implies that there are technological, organizational, and procedural controls dedicated to public administrations. These controls aim to define a methodological standard to facilitate the assessment of the IT security level of public administrations. For a public administration to be compliant, it is necessary to adopt the minimum ICT security measures for public administrations.
Depending on the IT system and function of the public administration, the minimum IT security measures can be implemented following three levels of implementation progressively.
Minimum
Compliance with these measures ensures conformity with the regulation.
Every public administration must necessarily adopt the security measures related to this level. This level is sub-optimal and should be considered temporary.
Standard
Compliance with the security measures of the standard level is considered a basis for having concrete IT security.
Most public administrations should achieve the standards of this security level.
Advanced
The security measures of the advanced level should be seen as a cue to improve the existing security of all organizations and are recommended for public administrations particularly exposed to risks.
Adhering to the ICT security guidelines in public administrations and completing the implementation form by the head of the structure for organization, innovation, and technologies or the appointed manager becomes the responsibility of the public administrations.
Conclusions
ISGroup, thanks to its team of IT security experts, will be able to help public administrations understand the minimum ICT security measures, comply with them, and complete the implementation form; bringing the public administration from a state of non-compliance to full compliance.
