Italy’s Cloud Strategy

The ‘Strategia Cloud Italia’ is a pivotal initiative aimed at digitising Italy’s Public Administration (PA) by leveraging cloud computing technologies. This strategy is a response to the irreversible digital transformation accelerated by the ongoing pandemic, which has underscored the critical importance of robust digital infrastructure. The strategy is designed to enhance the quality, efficiency, and effectiveness of public services, while fostering new opportunities for the country’s digital economy.

Key Objectives The strategy is structured around three main objectives:

1. National Strategic Hub (PSN): Establishing a national infrastructure for cloud services, autonomously managed from non-EU providers, ensuring data security and national control.
2. Qualification of Cloud Services: Implementing a qualification process for public cloud service providers to ensure security, reliability, and compliance with relevant regulations.
3. Data and Service Classification: Developing a methodology for classifying data and services managed by public administrations to guide their migration to the most appropriate cloud solutions (PSN or qualified public cloud).

Cloud Computing Paradigms The strategy covers various cloud computing models, including public, private, hybrid, and multi-cloud, each with its own advantages and use cases:

1. Public Cloud: Managed by third-party providers offering scalable and resilient computational resources distributed across multiple regions. This model is predominantly led by non-EU companies.
2. Private Cloud: Dedicated environments for single clients, offering greater control and security, but potentially limited scalability.
3. Hybrid Cloud: Combines private and public cloud resources to balance control and flexibility, useful for managing unpredictable workloads.
4. Multi-Cloud: Utilises multiple cloud services from different providers to enhance flexibility and avoid vendor lock-in.

Challenges and Solutions The adoption of cloud computing presents several challenges, including technological autonomy, data control, and resilience:

1. Technological Autonomy: Ensuring control over digital infrastructure and data processing is crucial for national security and strategic independence.
2. Data Control: Mitigating risks associated with extra-EU cloud providers and ensuring compliance with European and national data protection laws.
3. Resilience: Enhancing the resilience of cloud infrastructures to cyber threats and technical failures through layered security controls and robust disaster recovery mechanisms.

Strategic Implementation for Public Administration The cloud strategy for PA includes:

• Data and Service Classification: Identifying the impact of data and service compromises and classifying them into strategic, critical, and ordinary categories.
• Qualification of Cloud Services: Systematically evaluating cloud services based on operational management, security requirements, and contractual conditions to ensure suitability for public administration use.
• National Strategic Hub (PSN): Developing a geographically distributed infrastructure to provide high-reliability and resilient cloud services under national control.

Migration Process The migration of PA services to the cloud will be centrally managed, starting with administrations currently operating suboptimal data centers. The process will involve:

• Defining migration plans based on data and service classification.
• Ensuring adherence to strategic guidelines and validation by the Department for Digital Transformation and the National Cybersecurity Agency.

Adoption Phases The strategy’s implementation will be phased:

1. Tender Publication: Issuing the tender for the PSN by the end of 2021.
2. PSN Award and Construction: Awarding the tender and beginning PSN construction by the end of 2022.
3. Migration of Administrations: Starting migration by the end of 2022, prioritising administrations with inadequate data centers, and completing the process by the end of 2025.