1. When Cyber Risk Becomes Business Risk
A cyber incident can disrupt production, interrupt essential services, expose strategic information, and generate economic, reputational, and regulatory consequences. Yet cybersecurity is still often viewed as a predominantly technical responsibility, delegated to IT functions and assessed through the presence of tools and controls. This approach is no longer sufficient. Cloud technologies, artificial intelligence, interconnected systems, and technology suppliers have expanded the exposure perimeter, making it increasingly difficult to separate digital risk from operational and strategic risk. Cyber risk is no longer just about protecting systems — it concerns the organization’s ability to continue operating under adverse conditions. It is this transformation that makes the evolution of governance necessary.
2. From Cybersecurity to Risk Governance
2.1. Integrating Cyber Risk into Corporate Decision‑Making
Cyber maturity is not measured solely by the number of controls implemented or by the absence of incidents. It also depends on the ability to identify relevant exposures, assess their impact on the business, and make decisions aligned with the organization’s risk profile. Cyber risk management must therefore be integrated into Enterprise Risk Management (ERM), investment planning, and internal control processes. Which processes are truly critical? What would be the impact of their unavailability? Which external dependencies could compromise them? Is the residual risk compatible with the organization’s objectives? These are questions that require structured answers, supported by evidence and meaningful indicators. Without this integration, even a technologically advanced system may exhibit significant organizational vulnerabilities.
2.2. Governance and Accountability: The Role of Management
The growing relevance of cyber risk requires informed involvement from governing and management bodies. The NIS2 Directive, transposed in Italy through Legislative Decree 138/2024, strengthens the role of management bodies in overseeing the measures for managing cyber risk. Operational responsibility may be assigned to specialist functions, but it must be embedded within a governance system characterized by clear roles, effective information flows, and adequate oversight. Management must be able to understand the implications of the risk, set priorities, and verify the alignment between exposure, controls, and available resources. Cybersecurity can be delegated in execution, but it cannot be excluded from corporate governance.
2.3. Cyber resilience e supply chain: il rischio oltre il perimetro aziendale
Dependence on suppliers, cloud services, and external platforms makes a strategy focused solely on internal infrastructures insufficient. The compromise of a third party can propagate along the supply chain and disrupt essential processes. Supplier management must therefore evolve toward continuous monitoring, proportionate to the criticality of services and dependencies. At the same time, prevention must be accompanied by a concrete ability to respond and recover. Incident response plans, backups, and business continuity procedures must be validated through tests and exercises. Cyber resilience does not coincide with the absence of incidents, but with the ability to contain their effects and preserve essential functions.
2.4. Regulatory Compliance: Beyond Formal Adherence
The European regulatory framework — from NIS2 to the DORA Regulation for the financial sector, and from the GDPR to the Cyber Resilience Act — reinforces the focus on structured digital‑risk management. These regulations have different scopes, yet they highlight the importance of clearly defined responsibilities, adequate measures, and verifiable processes. Compliance, however, does not automatically equate to cyber maturity. Policies, procedures, and registers are necessary, but their effectiveness depends on actual implementation and the ability to adapt to evolving threats. The challenge lies in moving beyond a fragmented, requirement‑driven approach and integrating compliance, cybersecurity, risk management, and operational continuity into a coherent risk‑governance model.
Governance as a Lever for Digital Resilience
The evolution of cyber risk requires moving beyond a security vision limited to the technological dimension. Protecting systems remains essential, but it is not sufficient without a governance model capable of connecting risk, strategy, accountability, and operational continuity. Competitive advantage does not stem solely from the ability to prevent an attack, but also from understanding one’s exposures, making timely decisions, and preserving corporate value under adverse conditions. For organizations, the issue is concrete: is governance truly capable of steering cyber risk, or does it still focus primarily on monitoring technical and regulatory aspects? The answer is a meaningful indicator of digital maturity and of the organization’s ability to navigate an ever‑evolving risk landscape.
Sources and Regulatory References
European Regulatory Framework
- Directive (EU) 2022/2555 — NIS2: cyber‑risk management, supply‑chain security, and accountability of management bodies.
- Regulation (EU) 2022/2554 — DORA: digital operational resilience and ICT risk management in the financial sector.
- Regulation (EU) 2016/679 — GDPR: protection of personal data and security of processing.
- Regulation (EU) 2024/2847 — Cyber Resilience Act: cybersecurity requirements for products with digital elements. The reporting obligations apply from 11 September 2026; general application is scheduled for 11 December 2027.
National Regulatory Framework
- Legislative Decree of 4 September 2024, No. 138: transposition of the NIS2 Directive. Consolidated text available on Normattiva.
- Law of 28 June 2024, No. 90: provisions on strengthening national cybersecurity and on cyber‑related criminal offences. Published in the Official Gazette.