National Cybersecurity Agency: circular on public sector IT security products published in Official Gazette.

The National Cybersecurity Agency's ('ACN') Circular No. 4336 of 21 April 2022, Diversification of IT Security Technology Products and Services was published, on 26 April 2022, in the Official Gazette.

In particular, the circular intends to indicate the categories of IT security technology products and services for which public administrations will have to proceed to diversification pursuant to Article 29 of Decree Law No. 21 of 2022, on Urgent Measures to Counter the Economic and Humanitarian Effects of the Ukrainian Crisis. Specifically, the circular notes that the diversification involves certain products and services of the companies AO Kaspersky Lab, Group-IB Global Private Limited, and Positive Technologies.

Additionally, the circular includes a set of procedural recommendations addressed to public administrations. Furthermore, the circular recommends to, among other things:

• survey in detail the services and products mentioned in the circular and analyse the impact of any update on operations;
• identify and evaluate new services and products;
• define, share, and communicate migration plans with all directly or indirectly interested parties;
• analyse and validate the functionalities and integrations of new services and products, ensuring the application of rules and security configurations proportionate to high-risk scenarios; and
• ensure adequate monitoring and auditing of new products and services.