Cyber Security and Incident Management
The Firm assists companies, public and private entities, and organisations with the legal and regulatory aspects of cyber security, incident management and personal data protection, both at the preventive stage and in emergency situations.
Areas of activity
The Firm’s assistance includes the analysis of applicable requirements, the development of policies and procedures, the assessment of roles and responsibilities, the management of relationships with technology providers and partners, and the review of incident response and business continuity processes.
The Firm also supports organisations in preventing, managing, documenting and reporting cyber incidents and personal data breaches, coordinating legal, technical and organisational aspects.
NIS2 and relations with the ACN
The Firm assists organisations in assessing whether the NIS2 Directive and any other applicable cyber security regimes apply to them, taking into account their sector of activity and, where relevant, their classification as essential or important entities.
The Firm’s assistance may cover information obligations towards the ACN, the identification of internal contacts and responsibilities, the assessment of risk-management measures, the preparation of procedures for managing and reporting significant incidents, and coordination with the ACN, CSIRT Italia, the Italian Data Protection Authority and other competent authorities.
Particular attention is paid to documenting the measures adopted, ensuring traceability of decisions and coordinating NIS2 requirements with personal data protection, national cyber security and sector-specific regulations.
DORA and digital operational resilience
The Firm advises financial-sector operators on the DORA Regulation, with particular regard to digital operational resilience, incident management and reporting, relationships with ICT service providers and technology-risk governance.
Incident management
The Firm assists clients in preparing and implementing coordinated incident-management frameworks, supporting them in classifying events, assessing their impact, identifying applicable reporting and notification obligations, preparing the necessary communications and coordinating with authorities, clients, suppliers and other relevant stakeholders.
The assistance also covers incident documentation, the preservation of relevant information, containment and recovery activities, and the assessment of corrective measures to be adopted.
Main cyber threats
The Firm advises on the legal and organisational implications of, among other things, ransomware, cryptojacking, malware, data threats, disinformation, human error, misconfigurations, threats to data availability and integrity, email-related threats and supply-chain risks.
Through an integrated approach, the Firm supports its clients in strengthening compliance, preventing cyber risks and managing incidents in an orderly and effective manner.