The cybersecurity game comes to a head for companies

For small and medium-sized enterprises in Central Italy (and Lazio in particular), the challenge of cybersecurity is coming to the fore. Since 16 October, the new legislation implementing the European NIS 2 (Network and Information Security) directive has been in force in Italy. Its aim is to improve the preparedness and response of member states to cyber attacks. Perhaps the most important novelty is the extension of new obligations - from risk analysis to incident management and staff training - to a wide range of sectors: not only companies in those defined as 'highly critical' for cyber attacks such as energy, transport, finance, and health, but also other providers of critical services such as digital, postal, and waste management services.

It is estimated that in Italy the regulation will directly affect between 30 thousand and 50 thousand companies, a third of which will be in Central Italy (up to about 16 thousand) and up to 6 thousand companies in Lazio, excluding, however, the entire chain of suppliers, which is difficult to estimate.

The fear is that small companies are frightened by these changes, fearing an increase in costs in an already uncertain economic phase. This is why both business associations and institutions are already taking action. "Perhaps for small companies there may be an immediate increase in costs, but over time the application of the new rules will bring savings,' explains Lorenzo Benigni, vice-president of Unindustria Lazio with responsibility for cybersecurity, and senior vice-president Governmental & institutional relations of the Elt Group (for over 70 years a world leader in electronic defence systems and today a group with a multi-domain approach that also covers cyber space and biodefence, with 320 million in annual turnover and 1,600 employees).

'Even small and medium-sized companies can be victims of hacker attacks,' explains Benigni, 'with very serious consequences. The theft of sensitive data can have a devastating impact, for example in the defence, construction and pharmaceutical sectors. It often happens that a ransom is demanded for stolen data, and if it is not paid, it is made public. Beyond the obvious damage in the case of sensitive data or patents, there is a loss of company reputation that has a direct impact on customer trust and thus on business'.

The application of the directive with its requirements 'shelters', as Benigni explains, even small companies. In some cases, however, these are companies with as few as five employees, with at most one person dealing with IT. That is why it is not surprising that some of them may be frightened by the schedule of new obligations that will actually start in 2025, starting with the registration on the dedicated digital platform.