The l. 90/2024, containing "Provisions regarding the strengthening of national cybersecurity and computer crimes", introduces specific measures aimed at protecting computer security and combating computer crimes.

In particular, the new provisions impose on central public administrations, regions and autonomous provinces, metropolitan cities, municipalities with a population exceeding 100,000 inhabitants, regional capital municipalities, as well as urban public transport companies and local health authorities the obligation to notify the National Cybersecurity Agency of any IT incident of which they become aware, as well as the obligation to adopt, without delay and in any case no later than fifteen days from the communication, the remedial measures indicated by the Agency itself.

Failure to comply with these obligations may result in the application of a pecuniary administrative sanction ranging from 25,000 euros to 125,000 euros.

The same subjects must also equip themselves with a structure that shall be entrusted with specific tasks regarding the management of IT risk and information security. Furthermore, a contact person for cybersecurity shall be identified based on specific and proven professionalism and skills in the matter.
Chapter II of the law. 90/2024, dedicated to the prevention and fight against computer crimes, provides for the increase in the sanctions provided for by Legislative Decree 231/2001 for computer crimes and introduces among the predicate crimes provided for by the same decree an aggravated hypothesis of extortion carried out through the conduct referred to in the articles 615 ter (“Unlawful access to a computer or telematic system”), 617 quater (“Illicit interception, impediment or interruption of computer or telematic communications”), 617 sexies (“Falsification, alteration or suppression of the content of computer or telematic communications” ), 635 bis (“Damage to information, data and computer programs”), 635 quater (“Damage to computer or telematic systems”) and 635 quinquies (“Damage to computer or telematic systems of public interest”) of the Penal Code.

Law 90/2024, published in the Official Journal no. 153 of 2nd July 2024, entered into force on 17th July 2024.