Following recent cyberattacks on ships and port facilities, the Ministry of Infrastructure and Transport issued – on December 16 – a specific circular on navigation safety: No. 177 of 2025. It is expected to become fully operational by November 1, 2026.

This measure is aimed at various entities, such as: ships flying the Italian flag, ports and their infrastructures, as well as ship management companies (operating under the ISM Code).

The Circular is intended to ensure that all the aforementioned actors include, within their security projects, cyber-related risks in a stable and organized manner. This must be implemented, according to Circular 177/25, by considering a wide range of possible scenarios. Therefore, the regulatory intervention focuses not only on neutralizing the threat but also on its prevention, as well as restoring full system operability once the threat has been eliminated.

A fundamental principle of the circular is the development of personnel training, alongside the technological equipment used. Hence, specific training and updating programs are planned for many roles. Onboard personnel, company and port security managers, as well as IT and industrial technicians, must undergo adequate basic training and continuous updates.

In terms of emergencies, there is a specific obligation to report incidents and/or intrusions. In practice, this means that all involved parties must promptly inform the dedicated office of the National Cybersecurity Agency in case of critical issues.

This circular, therefore, represents a step forward in recognizing the close interconnection between proper cyber management and navigation safety. In doing so, the Italian legislator has aligned its regulations with IMO guidelines and the European NIS2 Directive (which sets cybersecurity standards for EU member states).

Alessandro Poggi
alessandro.poggi@mordiglia.it