AgID: Italy Cloud Security Qualification Guide
Italy's cloud qualification framework, originally established by AgID (Agenzia per l'Italia Digitale) and now overseen by ACN (Agenzia per la Cybersicurezza Nazionale), defines the security and compliance requirements that cloud services must meet to serve Italian public administration. As part of Italy's national cloud strategy and digital transformation agenda, the framework ensures that government data is hosted on qualified, secure infrastructure.
What AgID Cloud Qualification Covers
The framework classifies public administration data into three categories: ordinary, critical, and strategic. Each category maps to specific qualification levels (QI1 through QI4) with progressively stringent security, availability, and data sovereignty requirements. Strategic data — including data critical to national security — requires the highest qualification levels with strict Italian or EU data residency.
Qualification requirements cover information security management (aligned with ISO 27001), service continuity and disaster recovery, data portability and interoperability, compliance with Italian and EU data protection regulations, and transparency about infrastructure and supply chain.
Who Needs AgID/ACN Qualification
Cloud service providers (IaaS, PaaS, SaaS) seeking to serve Italian public administration entities must obtain the appropriate qualification level. This includes both Italian and international cloud providers. The framework applies to central government, regional authorities, municipalities, public healthcare entities, and publicly funded organizations. Italy's Cloud First policy directs public entities to adopt qualified cloud services, creating significant market demand.
Implementation Approach
Determine the target qualification level based on the data classification your service will handle. Assess your current compliance against the qualification requirements. Obtain prerequisite certifications — ISO 27001 is typically required for higher qualification levels. Prepare the qualification application with supporting documentation including security policies, service level commitments, and architecture descriptions. Submit through the ACN qualification portal and respond to any assessment findings.
Cost Considerations
Qualification costs range from $25,000 for lower-level qualifications with simple services to $150,000 for strategic-level qualifications requiring extensive security controls and Italian data residency. International cloud providers may face additional costs for establishing Italian or EU infrastructure. The investment provides access to Italy's public sector digital transformation spending, which totals billions of euros under the National Recovery and Resilience Plan.