ACN and the judiciary: powers and coordination
12 April 2022 · A contribution on the powers of Italy’s National Cybersecurity Agency and their relationship with judicial investigations.
Listen to the contribution · Italian audioArea 04 · Advice and representation
Law & Tech | Cybersecurity
Legal advice and representation on the digital economy: contracts, platforms, data, artificial intelligence and cybersecurity. Assistance for businesses, public bodies and technology providers.
Digital law
Law & Tech
The firm advises businesses, public bodies and technology providers on the legal aspects of digital transformation and the development of innovative products and services. Our advice covers business-to-business (B2B), business-to-consumer (B2C) and business-to-government (B2G) relationships, as well as dealings between platforms and their business users.
We support clients in negotiating software, cloud, licensing and digital services agreements, drafting terms of use and managing e-commerce activities. Our work addresses data access, use and sharing, the protection of content and technology assets, electronic documents and signatures, and liability arising from the use of artificial intelligence.
Our assistance includes compliance with EU digital regulation, dealings with the relevant authorities and representation in disputes.
Matters we can help with
Cybersecurity in Italy: governance, suppliers and incidents
Cybersecurity compliance requires an approach that brings together organisation, responsibilities, supplies and service continuity. The firm addresses the legal aspects alongside corporate teams and technical advisers, considering supply-chain risks beyond IT services.
- Assessing NIS2 applicability and defining responsibilities, delegated powers and board reporting.
- Preparing and updating compliance plans and documenting the implementation of applicable measures.
- Defining contractual requirements and oversight for relevant supplies, including from non-ICT businesses or suppliers not independently subject to NIS2.
- Addressing the legal aspects of incidents, notifications and dealings with authorities and counterparties.
How we assist
Cybersecurity and leadership responsibilities
The firm supports management and governing bodies in performing their functions and undertaking the mandatory training provided for in Article 23 of Legislative Decree 138/2024, coordinating their work with the CISO (Chief Information Security Officer) and technical teams. Our advice clarifies roles, responsibilities and information flows so that technical assessments inform considered, documented decisions, while respecting the duties of direction, approval and supervision that remain with the board of directors.
Compliance plans and implementation of measures
Legal support in preparing and updating compliance and risk-treatment plans, taking account of applicable ACN measures and assessments by technical teams. Identifying obligations, gaps, priorities, responsible individuals and the evidence to retain. Supporting management and governing bodies’ decisions and documenting implementation, with coordinated consideration of business continuity, crisis management, incidents and training.
Suppliers and supply-chain security
Supply-chain risk management covers goods, services and activities that may affect the security of an NIS entity’s network and information systems and the continuity of its services, including where the supplier is not an ICT operator or independently subject to NIS2. We advise customers and suppliers on identifying relevant relationships, defining risk-proportionate requirements, reviewing contracts and procurement arrangements, and establishing oversight, subcontracting, cooperation and incident-management obligations. Depending on the activity, this includes maintenance, facility operations, physical access and other outsourced services.
Data protection and incident management
GDPR advice covering roles, privacy notices, data-processing agreements, impact assessments and data-subject requests. Legal support in handling incidents and personal-data breaches, assessing reporting and notification duties, and dealing with authorities and counterparties. Coordination between regulatory regimes ensures that obligations with different legal triggers are assessed separately.
Technology, services and artificial intelligence
Assistance in drafting contractual terms, licences, SaaS agreements, service-level agreements and data-processing agreements. Assessment of the legal implications of adopting AI tools, including liability, confidentiality, data use and work organisation. Legal safeguards are coordinated with security assessments, IT teams and technical advisers.
Research and institutional dialogue
Cybersecurity, responsibility and public authorities
Prof. Angelo Tuzza is a member of the Scientific Council of the ICSA Foundation – Intelligence Culture and Strategic Analysis.
At the ICSA Foundation, he undertakes research into the legal framework for national security and cybersecurity. His public contributions address public authorities’ powers, their relationship with judicial investigations and organisational responsibilities. Research is integrated with the firm’s legal work on compliance programmes, responsibilities and supply-chain safeguards.
Cybersecurity and healthcare infrastructure
5 December 2024 · A conference on the security of healthcare facilities, data protection and the digital transformation of healthcare services.
Conference and ICSA documentation · ItalianIllustrative example
Supply-chain security across different sectors
Waste management and environmental services
An operator within the scope of NIS2 outsources facility maintenance and services involving access to relevant premises or systems. The firm assists with assessing supply arrangements, defining security clauses and cooperation duties, and coordinating them with the compliance plan.
Defence and strategic supply chains
A business in the defence supply chain needs to safeguard supplier reliability and protect information and systems. The firm assists with identifying the applicable regime, taking account of the specific rules and exclusions for defence and national security, and defining contractual requirements, access arrangements, subcontracting and continuity of supplies.
Communications and telecommunications
An operator within the scope of NIS2 outsources network maintenance, facility management or access to sites. Assistance covers supplier qualification, including non-ICT suppliers, security requirements, oversight and incident management across the supply chain, consistently with the operator’s obligations and responsibilities.
Healthcare and service continuity
A healthcare provider within the scope of NIS2 relies on suppliers of devices, maintenance and outsourced services. The firm advises on the legal aspects of risk assessment, contractual requirements and cooperation duties, with attention to system security, data protection and continuity of patient care.
A hypothetical situation illustrating the work undertaken. It does not describe a particular client engagement.
Tools and services
Assessment of regulatory scope; legal and organisational aspects of compliance and risk-treatment plans; support for management decisions; supplier qualification; security clauses and supply-chain oversight procedures; incident-management support and training.
Contact
An initial conversation.
A clear direction.
For an initial assessment of your matter and the assistance available, contact the firm’s office to arrange a confidential meeting, in person or by video call.
Email the firm
segreteria@studiotuzza.itTelephone
+39 06 5922543Office hours
Monday–Friday · 09:00–19:00