There’s a convenient misconception in Italy: thinking that cybersecurity is a matter for ministries or large strategic players. It’s reassuring. And it’s wrong.
In the real design of public connectivity, local authorities are not periphery: they are nodes. They connect essential services, safeguard sensitive data, provide daily functions—registry, taxes, local police, SUAP (Supply of Public Administration Services), social services, schools, and local healthcare—and, above all, they are embedded in national supply chains of infrastructure, suppliers, platforms, and interconnections. When a municipality or local authority falls, it’s not just that: a chain is broken.
The point isn’t to raise alarmism. It’s to acknowledge a structural fact: local government is an attack surface. And, in public administration, the attack surface isn’t just expanded by technology. It’s also expanded by politics.
Cybersecurity in a local government doesn’t fail simply because of a lack of budget or expertise. It often fails due to organizational choices and self-interest: opaque contracts, “tailor-made” supplies, fragmented consultancy, inconsistent turnover, a “one-man-only” or—worse—no one-man-only.
Here comes the uncomfortable part: the conflict between public interest and local micro-interest.
When the management of the network and digital services becomes a playground of favoritism, personal or family relationships, companies “invited” to participate and win, decisions driven by consensus or proximity, security ceases to be a technical requirement. It becomes a political variable. And when security is a variable, sooner or later it is sacrificed.
This isn’t moralism. It’s risk management. A network designed to “please” is easier to hack. Governance designed for career advancement is a governance system that, at the first crisis, seeks cover rather than solutions.
In recent years, the regulatory framework has strengthened: resilience tools, risk management and reporting requirements, minimum standards, and guidelines. But without effective internal oversight, the law remains a mere paper trail.
Hence a simple thesis: every local authority must have a real watchman, with a clear mandate. To protect. Not to “pass around” contracts.
A contact person — or small function — who:
There’s another illusion to dispel: that centralization is enough. National security for critical infrastructure isn’t just a coordinating center. It’s a network that exchanges information quickly and effectively.
If that network is riddled with silos, opaqueness, and career goals, it becomes slow, self-referential, and inefficient. What’s needed instead is a network of sentinels that share indicators, adopt common playbooks, conduct real-world exercises, conduct post-mortems without witch hunts, and surface problems before they become incidents.
The difference isn’t made by the norm. It’s the lack of ambiguity: protection over career.
When a local authority purchases poorly—or buys for relationships—it doesn’t just create inefficiency. It creates debt, both direct and indirect: corrective contracts, costly repairs, disputes, lost productivity, and emergencies managed with derogations.
Breaking the cycle of bad decisions means freeing up resources and planning. Prevention is also about public finances.
Warning signs (not proof) that an IT contract is going badly. Not to accuse, but as a checklist before signing.
Typical risk indicators
Minimum countermeasures
The issue isn’t adding a firewall. It’s defending the public service.
If local nodes remain fragile because cybersecurity is treated as an expense—or worse, as a networking opportunity—national security becomes a castle built on weak administrative foundations.
The solution is pragmatic: a sentinel for each agency, with a mandate and responsibilities; procurement rules that protect security, not habit; a national network that truly collaborates, rather than competes internally; long-term planning, because cybersecurity isn’t something you buy at the end of the year: it’s built and maintained.
Finally, a non-negotiable principle: when a local authority makes poor decisions about its network, it’s not only making mistakes for itself. It’s increasing the risk for everyone.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
