News

The deadline for adopting basic security measures does not mark the end of the NIS2 compliance process. After the deadline, organisations must be able to maintain active controls, document the procedures adopted and demonstrate ongoing compliance with their obligations. The National Cybersecurity Agency (ACN) carries out supervisory and verification activities in accordance with the procedures established for the different categories of entities.

The supervisory model distinguishes between essential entities, which are subject to proactive checks and periodic inspections, and important entities, which are primarily subject to subsequent checks and targeted supervisory activities. Inspections may concern the actual adequacy of security measures, the traceability of internal processes and the proper management and documentation of incident notifications. For organisations, this means preparing not only to meet the initial deadline, but also to demonstrate the robustness of their cybersecurity management system.

Data-in-transit protection and the confidentiality of internal communications are at the heart of the new security features:

• One-Time Passwords (OTP) for Sharing Links: This feature allows access to externally shared files to be protected by requiring a One-Time Password sent via email or through custom providers that can be integrated via API (e.g., SMS).
  “Classified” Conversations in Nextcloud Talk: For managing highly sensitive information or information subject to trade secrecy, Nextcloud Talk introduces the Classified security preset:
  1. Complete blocking of public links and access for guest users (guests).
  2. Restrictions on message forwarding, call recording, and media previews.
  3. Scheduled expiration and automatic deletion of messages and chats.
• Announcement Channels: Introduction of one-way communication channels with a fixed audience (without the possibility of leaving autonomously) and calls disabled, ideal for corporate broadcast communication.

The main advantages of RAFT concern greater accuracy of responses and significant robustness towards inaccurate or noisy retrievals. Through training with distractor documents and Chain-of-Thought reasoning, the model learns not to be influenced by irrelevant content retrieved by the retrieval system.

Furthermore, RAFT allows relatively smaller models, such as LLaMA-7B, to achieve higher performance compared to zero-shot RAG and traditional domain Fine-Tuning, both with and without RAG. In different application contexts, these models can achieve better results even compared to larger models, such as GPT-3.5 combined with RAG.

Although they may seem like similar situations, orphan, inactive and disabled accounts describe different conditions:

• Orphan account: it is still present and potentially active in a system, but is no longer associated with a person or a manager who has a current role in the organization.
• Inactive account: it belongs to an identifiable user, but has not been used for an extended period. However, the user may still be part of the organization.
• Disabled account: it has been explicitly suspended or deactivated and should therefore not allow access. However, if the deactivation is not completed correctly, processes or active authorizations may remain, giving rise to the so-called zombie account.

Distinguishing between these situations is important to determine which action to take and correctly assess the level of risk associated with each account.

The main difference lies in their purpose within the user lifecycle: provisioning focuses on enablement and productivity, creating identities and providing the tools required for a person to start working.

Deprovisioning, on the other hand, is primarily focused on cybersecurity and data protection, removing those same privileges and closing access to the system when the employment relationship ends or the user’s role changes.

Offboarding represents the final stage of the identity lifecycle and is often considered one of the most sensitive processes in cybersecurity.

Ineffective account deactivation can leave active users, credentials, and unnecessary privileges in place. These unused accounts, often referred to as orphan accounts, can become an entry point for unauthorized access and data breaches.

Automating access revocation allows organizations to promptly remove privileges, group memberships, and software licenses, significantly reducing exposure risks and improving control over digital assets

The growing adoption of cloud environments, hybrid infrastructures, and distributed applications has made it increasingly difficult to manually manage users, roles, and permissions. In this context, an IGA system enables centralized control over access and reduces the risk of exposing enterprise resources.

The adoption of policies based on the principle of least privilege ensures that each user is granted only the permissions strictly necessary, limiting the possibility that compromised accounts or misconfigurations become an attack vector for the organization.

The main strength of fine-tuning lies in its ability to adapt model behavior to the specific needs of an organization. Through targeted training, AI systems can learn technical terminology, business processes, communication style, and operational rules, generating more consistent and context-aware responses.

This approach is particularly effective in scenarios where the information to be managed remains relatively stable over time and the system must replicate precise procedures or highly specialized language. Typical applications include technical documentation management, insurance workflows, regulatory procedures, and internal business processes.

Another key advantage is fast inference. Since the model already contains the required knowledge, it does not need to continuously query external databases to generate responses.

For use cases involving dynamic and frequently updated data, however, RAG represents an alternative approach with specific advantages for chatbots and enterprise AI systems.

To apply for the Cloud & Cybersecurity Voucher 2026, businesses and professionals must meet specific eligibility criteria defined by the program. Key requirements include being legally registered and operational in Italy, as well as having an internet connection with a minimum download speed of 30 Mbps.

A further requirement introduced recently is compliance with insurance obligations covering damages caused by natural disasters and catastrophic events, which is mandatory to access the funding.

The incentive does not apply to sectors excluded under the EU “de minimis” regulation, such as primary agricultural production, fisheries, and aquaculture.

YooPoint is designed to support companies in the digitalization of access control processes, identity governance, and visitor management, offering a modern, centralized platform that can be integrated with existing infrastructure.

With YooPoint, companies can:

• improve digital identity governance;
• increase access security;
• centralize permissions and access rights;
• simplify onboarding processes;
• reduce manual activities and operational inefficiencies.