The selection of ICT service providers: contractual clauses and management of cyber risks.

The conference “Cybersecurity Compliance”, organised by Paradigma S.p.A., provides an in-depth analysis of the organisational and governance safeguards required under the new European and national regulatory framework following the entry into force of the NIS 2 Directive and its implementing measures, with particular focus on the structured management of cyber risks, on prevention, detection and incident response mechanisms, and on the obligations to notify competent authorities.

The initiative systematically examines the National Framework for Cybersecurity and Data Protection in its most recent edition, analysing security governance functions, the identification and protection of critical assets, threat detection capabilities, incident response processes, and recovery and business continuity strategies, as well as the paradigm shift introduced by the new European legislation in terms of digital resilience, the distinction between essential and important entities, and the central role of the Italian National Cybersecurity Agency.

Within this context, the presentation delivered by Attorney Alessandro Del Ninno focuses on the legal and contractual aspects of cybersecurity, with particular reference to the selection of ICT service providers and the management of cyber risks across the supply chain, analysing product and service assessment criteria, relevant contractual clauses, the specificities of outsourced and cloud-based data centres, sector-specific regulatory requirements, and the legal implications associated with the use of artificial intelligence services.

Attorney Del Ninno’s contribution offers an integrated perspective combining cybersecurity law, regulatory compliance and contractual governance, providing practical tools to structure supplier relationships in line with the security, accountability and control obligations imposed by the new regulatory framework and capable of supporting a conscious and sustainable approach to cyber risk management within organisations.

Conference Schedule