language: en · source language: it · status: in-force · last checked: 2026-10-08

Italy — ACN Regolamento cloud per la PA (decreto direttoriale n. 21007/24)

This is the single regulation governing the cloud services that Italian public administrations may use. The Agenzia per la cybersicurezza nazionale (ACN) adopted it by decreto direttoriale n. 21007/24 of 27 June 2024, under art. 33-septies, comma 4, of decreto-legge 179/2012, and it has applied since 1 August 2024 (art. 27). Cloud qualification moved to ACN from AGID by decreto-legge 82/2021. This Regolamento replaced the AGID regolamento of 15 December 2021 (determinazione n. 628/2021) and the ACN determinations and decrees of the transitional regime (art. 26). ACN's documentation page (read 2026-10-08) lists it as the current rule; it lists no amending act.

Fact text is Italian (authentic language); this README is curation.

Applicability to EdTech

• A SaaS product used by a public body must be qualified. The definitions name Software-as-a-Service as one of the three cloud service types (art. 1, lett. p)). A "fornitore di servizi cloud" is whoever delivers the service, including through distributors or resellers. A reseller does not become the provider unless it determines the means of delivery (lett. v)). Administrations migrate their data and digital services only to cloud services qualified under art. 17 (or, if publicly run, adeguati under art. 15) (art. 9). Whether Italian state schools fall within the "amministrazioni" this targets depends on art. 1, lett. c)–e), which refers to the list in legge 196/2009. The Regolamento does not name schools.
• Classification drives the level. Each administration classifies its data and services as ordinari, critici or strategici (art. 3). Private providers' services are qualified at four levels, QC1–QC4. Ordinary data may run on any level, critical data on QC2 and above, strategic data on QC3 and above (art. 17, comma 4). The requirements per level are in Allegati 3 and 4 (art. 8, art. 17 comma 3).
• The procedure. The provider applies through ACN's platform with the information listed in art. 18 comma 3, which includes the security checks it has run on the service. ACN decides within sixty days, which can be extended (art. 19). A qualification lasts at most 36 months (comma 6), and renewal is applied for ninety days before expiry (comma 9). Qualified services are published in ACN's catalogue (comma 8).
• Monitoring and revocation. ACN can verify that requirements are still met after qualification. While a verification is open, the provider must tell its customers that it is under review (art. 20 comma 3). On revocation, administrations may keep using the service for up to six months (art. 21 comma 5).
• Personal data (art. 22): administrations are controllers. Cloud providers and infrastructure operators act as processors under Art. 28 GDPR and must ensure the administration is informed of breaches promptly (comma 3). Sub-processors follow Art. 28(2) and (4) GDPR (comma 4). Transfers outside the EEA follow the administration's instructions, and the provider must supply what the administration needs to assess the safeguards (comma 5).
• What a SaaS provider is checked against (Allegato 3): the base characteristics per classification level, organised by the FNCS subcategories and the CSA Cloud Control Matrix (1.2). For ordinary data: an availability SLA of 99% per month, 24/7 emergency support and a one-hour maximum response to critical incidents (QU.LS-01 1_O); bulk export and import of data in open, non-proprietary formats (IP.PO-01); the administration's data, including security systems, processed on infrastructure located in the European Union, with business continuity and CDN functions included unless there are documented reasons (PR.DS-01 1_O), and metadata about the administration likewise (2_O); and notice to the administration of an incident or data breach "entro 1 ora dalla registrazione e classificazione dell'evento" (RS.CO-01 4_O). Critical and strategic data add further points (3, 4).
• Qualification requirements and certifications (Allegato 4): a QC1 SaaS must run on a qualified or adeguato SaaS, PaaS, IaaS or infrastructure of the same level or higher (2.2). A private provider needs a self-declaration of ISO 9001 and ISO/IEC 27001 certification with the ISO/IEC 27017 and 27018 extensions, or CSA STAR Level 2 (2.3). Qualified providers report to ACN every six months which administrations use their services (2.6). QC2 adds ISO 22301 and ISO 20000 self-declarations (3.2); QC4 adds Hold Your Own Key encryption (5.1).
• Classification and infrastructure (Allegato 1; Allegato 2): administrations classify their data and services through ACN's platform, accepting or adjusting predefined lists (Allegato 1, 2.1). Allegato 2 sets the minimum levels for the data centres and infrastructure underneath (availability, disaster recovery with RTO and RPO of at most 48 hours for ordinary data, physical security, energy efficiency, security measures), with an appendix of construction and plant characteristics (Tabella 1).
• Migration deadline. Administrations were to complete their migration plans by 30 June 2026 (art. 11 comma 4). Until then they could keep using the infrastructure and cloud services already in use (comma 10).

Contents

Scope note: not carried: the decree's preamble (the VISTO/CONSIDERATO recitals), each Allegato's Sommario (table of contents), and ACN's "misure applicabili" and qualification questionnaires published on its site. Allegati 1–4 (pages 22–88 of the PDF) are carried in full in the four ALLEGATO documents; REGOLAMENTO-CLOUD.md's own Meta, which predates them, still describes that document's scope (the articles only). The published PDF breaks off art. 22 comma 6 mid-word ("violazioni di dati persona"); the corpus reproduces it as printed.

Enforcement

ACN qualifies, monitors and revokes (art. 19–21). ACN reports administrations that breach the Regolamento to AGID, under art. 33-septies, comma 4-quinquies, of decreto-legge 179/2012 (art. 23). The Garante stays competent for the personal-data provisions (art. 22 comma 6).

Licence

The corpus reproduces articles 1–27 and Allegati 1–4 of a regulation that ACN, a public administration, adopted by decreto direttoriale under a statutory delegation (art. 33-septies, comma 4, d.l. 179/2012), and whose publication in the Gazzetta Ufficiale the Regolamento itself provides for (art. 27 comma 3). Art. 5 of legge 22 aprile 1941, n. 633 (Normattiva — legge 633/1941, art. 5) provides: "Le disposizioni di questa legge non si applicano ai testi degli atti ufficiali dello stato e delle Amministrazioni pubbliche, sia italiane che straniere." The Regolamento is such an act.

ACN's site terms (acn.gov.it — Note legali, read 2026-10-08) reserve rights in the site's contents: "I contenuti del Sito … sono di proprietà di ACN, se non diversamente indicato, sono protetti dalla normativa sul diritto d'Autore" and reproduction is not allowed "senza preventiva autorizzazione scritta di ACN". That notice covers the site as a whole, its news, images, graphics and trademarks. It cannot create copyright in the text of an official act, which art. 5 places outside the copyright law. The corpus reproduces only that text. The Allegati are part of the act: its articles refer to them for the classification method and the requirements. The corpus takes nothing from ACN's web pages, logo or graphics, and does not carry ACN's infographics.

Conditions: none attach to the act's text, because no copyright subsists in it. The corpus still identifies its source: the fact document names ACN's PDF in each Capo's provenance line and in Meta. The selection, the Markdown layout and the anchors are described there. The corpus does not claim that ACN endorses it. If the reading of art. 5 were rejected, ACN's notice would make the label restricted.

Related

• AGID Linee guida accessibilità: the accessibility requirements that apply to the same procurements
• Garante — scuola: the data-protection authority on schools' platform suppliers, who are processors under the school's instructions
• Codice privacy

Sources

• ACN — Cloud: documentazione utile ("Regolamento ACN n. 21007/24", 27 giugno 2024)
• ACN — Regolamento Cloud per la PA
• RegolamentoCloud.pdf (archived: sources/RegolamentoCloud.pdf)
• ACN — Qualificazione e adeguamento