Italy ACN Cybersecurity

Agenzia per la Cybersicurezza Nazionale guidelines - National Cybersecurity Perimeter, supply chain.


Short name	ACN IT
Region	Europe
Country or scope	Italy
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ACN IT

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for ACN IT.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for ACN IT and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IT-ACN-INV` ICT Asset List	Perimeter entities must compile and keep updated a list of the ICT assets supporting their essential functions; a populated software component inventory is the direct SBOM analogue (DL 105/2019 Art. 1(2)(b))	Scan
`IT-ACN-CVCN` Supply-Chain Evaluation (CVCN)	ICT goods and services intended for perimeter networks are subject to national evaluation before procurement, which requires the supplier of each component to be known and recorded (DL 105/2019, CVCN procurement-scrutiny provision)	Scan
`IT-ACN-MEAS-INT` Integrity Security Measures	The implementing decree prescribes technical measures protecting the integrity of perimeter systems; integrity hashes across deployed components provide verifiable evidence (DPCM 81/2021, security-measures annex)	Scan
`IT-ACN-VULN` Vulnerability and Update Management	Prescribed measures include managing vulnerabilities and keeping systems updated, which is only demonstrable when each component's version is recorded (DPCM 81/2021, vulnerability-management measures)	Scan
`IT-ACN-INCIDENT` Incident Notification Readiness	Perimeter entities must notify significant incidents to the Italian CSIRT within short deadlines; scoping an incident that fast requires components to be unambiguously identifiable (DL 105/2019, incident-notification obligation)	Scan
`IT-ACN-DOC` Maintained Asset Documentation	Asset lists must be transmitted to the authorities and periodically updated, presupposing dated, identifiable documentation of the software estate (DL 105/2019, asset-list update and transmission duty)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ACN-PSNC-1`	Perimeter Identification and Asset Register
`ACN-PSNC-2`	ICT Supply Chain Security Assessment
`ACN-PSNC-3`	Notification of Cyber Incidents to CSIRT Italia
`ACN-PSNC-4`	Minimum Technical Security Measures
`ACN-PSNC-5`	SBOM and Software Component Transparency
`ACN-PSNC-6`	Continuity and Recovery Planning
`ACN-PSNC-7`	Privileged Access Management for Perimeter Systems
`ACN-PSNC-8`	Security Audit and Penetration Testing

Policy templates

Written for ACN IT:

ACN/PSNC: Privacy Notice
ACN/PSNC: Breach Notification Procedure
ACN/PSNC: ICT Supply Chain Security Policy

And 22 from the standard set, adapted to ACN IT.