Cloud migration is a top priority for public administrations. However, the path is fraught with regulatory and technical challenges. The Italian National Cybersecurity Agency (ACN) has defined a cloud service qualification system that is a cornerstone for security and compliance. Understanding QC1-QC4 levels and correct data classification is crucial to avoid costly errors, penalties, and, above all, compromising the security of public information.
When I assisted organizations with complex infrastructures, I noticed that confusion about ACN qualification levels and data classification is one of the biggest obstacles. Often, there’s a tendency to underestimate the impact of an incorrect choice, only discovering later that the adopted service doesn’t meet the minimum requirements for the type of data handled. This not only generates additional costs for migrating to a compliant solution but also exposes the entity to significant risks in terms of data breaches and violations of NIS2 regulations. The goal of this guide is to provide clarity and practical tools to navigate the ACN Catalog securely, ensuring that every decision is informed and strategically sound. Read also: Cybersecurity: Recurrent Exposures & 90 Days
Tested on: ACN Cloud Services Regulation · ACN Catalog · October 2026
Prerequisites / Test Environment
To correctly follow this guide, you only need access to a web browser and the official ACN website. No specific technical skills are required for consulting the catalog, but a basic understanding of cybersecurity concepts and data management is recommended to best interpret the information. It is essential to always refer only to the official documents and the Cloud Services Catalog for Public Administrations, available on the ACN portal, for the most up-to-date and accurate information.
Data Classification: Ordinary, Critical, Strategic
The first fundamental step for any administration intending to migrate its services to the cloud is the correct classification of the data that will be processed. This classification is not arbitrary but follows precise guidelines defined by ACN and current regulations, including NIS2. Data is categorized into three main types:
- Ordinary Data: These are information whose compromise (loss of confidentiality, integrity, or availability) does not cause significant damage to the entity, citizens, or national interests. Examples may include public data or non-sensitive information. Read also: Q4 Public Administration Deadlines: IT Regulatory Calendar
- Critical Data: The compromise of this data can cause significant damage, disruption of essential services, or prejudice fundamental rights and freedoms. This category includes personal, health, non-strategic financial data, or information necessary for the functioning of non-vital public services.
- Strategic Data: The compromise of this data can have a devastating impact on national interest, public security, defense, the economy, or public health on a large scale. These are data whose integrity and confidentiality are of vital importance. This category includes critical control systems, data related to essential infrastructures, or information with national security implications.
The correct attribution of a criticality level to each dataset is a process that requires in-depth analysis and risk assessment, often supported by standard methodologies such as those provided by ISO 27001:2022 or NIST CSF 2.0. An accurate analysis allows determining the necessary protection level and, consequently, the required cloud qualification level.
What QC1, QC2, QC3, and QC4 Levels Mean
The Cloud Qualification (QC) levels defined by ACN are the tool through which a cloud service provider’s ability to guarantee certain standards of security, reliability, and data sovereignty is evaluated and certified. Each level represents a growing set of requirements and controls, proportional to the criticality of the data the service is intended to host.
- QC1 (Basic Qualification): Suitable for providing services that handle Ordinary Data. Security requirements are standard, ensuring an adequate level of protection for non-sensitive information.
- QC2 (Medium Qualification): Required for services that manage Critical Data. It involves more stringent security requirements, greater resilience, and controls on data localization within the European Union.
- QC3 (High Qualification): Intended for services that handle Strategic Data. Requirements are extremely rigorous, including guarantees of national data sovereignty, advanced security controls, and a highly resilient and redundant system architecture.
- QC4 (Maximum Qualification): This level, while formally provided for, represents the highest degree of security and control. It is reserved for exceptional and strategic cases where data protection is the absolute priority and requires total control over the service supply chain, including the nationality of providers and personnel involved. Currently, most qualified services are QC1, QC2, or QC3, with QC4 still in the practical definition phase for specific needs.
The choice of the appropriate QC level is directly related to data classification. A QC1 service can never host critical or strategic data, and vice versa. This correspondence is the cornerstone of the public administration’s cloud strategy.
Which Level is Needed for an Entity’s Services
Determining the necessary QC level for a cloud service depends exclusively on the classification of the data that service will process. There is no general rule that applies to all services of an entity, as an administration may simultaneously manage ordinary, critical, and strategic data in different operational contexts. Read also: VMware Migration: 6-Month Review, Costs, and Failures
The logic is as follows:
- If a service primarily handles Ordinary Data, a provider with QC1 qualification will suffice.
- If the service processes Critical Data, a provider with QC2 qualification or higher will be indispensable.
- For services that process Strategic Data, the choice must fall on providers with QC3 qualification or, in specific cases, QC4.
It is crucial to perform this assessment for each individual service or application intended for migration. A common mistake is to apply a homogeneous qualification to the entire infrastructure, ending up adopting oversized (and costly) solutions for ordinary data or, worse, undersized for critical or strategic data. The approach must be granular and based on the actual risk of the data.
How to Verify a Service’s Level in the Catalog
The Cloud Services Catalog for Public Administrations, managed by ACN, is the official tool and the only reliable source for verifying the qualifications of cloud providers and services. It is essential to consult it regularly, as qualifications may vary over time.
To consult the catalog:
- Access the official website of the National Cybersecurity Agency (ACN) at acn.gov.it.
- Use the search function or available filters to find the provider or service of interest.
- Check the section related to “Service Qualification” or “Infrastructure Qualification” to identify the assigned QC level (QC1, QC2, QC3, QC4).
It is important to distinguish between infrastructure qualification and specific service qualification. A provider may have a QC3 qualified infrastructure but offer a specific service on that infrastructure that is only QC2 qualified, perhaps because not all specific service security controls reach the maximum level. Carefully reading the detailed sheets of each service is essential.
Infrastructure and Services: Two Different Qualifications
An often-overlooked aspect is the distinction between the qualification of the cloud infrastructure (IaaS/PaaS) and that of the application service (SaaS) delivered on it. They are not the same thing and do not always coincide.
- Infrastructure Qualification: Concerns the underlying environment (data center, hardware, virtualization, networking) provided by the cloud provider. A QC3 qualified infrastructure means the provider meets high standards for the physical and logical management of its systems.
- Service Qualification: Refers to the specific application or service (e.g., productivity suite, management system, CRM) delivered on the infrastructure. The qualification of a service takes into account not only the underlying infrastructure but also the security controls implemented at the application level, access management, software lifecycle, etc.
It is possible for a provider to offer a QC3 infrastructure, but for a specific application delivered on it to be only QC2 qualified, due to less stringent application security controls or specific unmet requirements at the service level. Conversely, a particularly robust service could be QC3 qualified even if based on an infrastructure with lower qualifications, provided that compensatory controls at the service level are sufficient. However, the general rule is that the service cannot have a higher qualification than the infrastructure on which it resides. Read also: Oracle RMAN: Database Recovery After Failure
For an administration, this means that it is not enough to verify the provider’s infrastructure qualification; it is mandatory to check the qualification of every single service intended for use. This granularity is fundamental for compliance.
Common Errors in Provider Selection
In the process of selecting a cloud provider for Public Administrations, I have encountered some recurring errors that can compromise security and regulatory compliance:
- Underestimating data classification: Incorrectly classifying data, or classifying it too generically, leads to choosing an inadequate QC level. This is the most serious and common error.
- Relying solely on infrastructure qualification: As discussed, infrastructure qualification is not sufficient. It is essential to verify the qualification of the specific service intended for use.
- Ignoring data localization: For critical and strategic data, ACN regulations impose stringent requirements on the physical location of data centers and data sovereignty. A provider with extra-EU data centers, even if qualified, might not be suitable.
- Not verifying qualification validity: Qualifications have an expiration date and can be revoked. Always consult the ACN catalog for current validity.
- Confusing industry certifications with ACN qualifications: Certifications like ISO 27001 or GDPR compliance are important, but they do not replace ACN qualification, which is specific to the Italian Public Administration context.
Avoiding these errors requires a rigorous methodology and constant consultation of official sources. The initial investment in understanding these mechanisms translates into significant time and resource savings in the long run, while ensuring the security and compliance of public services.
FAQ — Frequently Asked Questions
Do I need to reclassify my data if I use a new cloud service?
Yes, every time a new service is introduced or data is migrated, it is essential to review data classification based on the specific context of the new service. Data criticality can vary depending on how it is processed and used by the application. Accurate reclassification ensures that the chosen cloud service is always aligned with security requirements.
Is a provider’s QC qualification permanent?
No, ACN qualifications are not permanent. They have a temporary validity and are subject to reviews and potential revocations. It is the public entity’s responsibility to periodically verify the validity of its providers’ qualifications on the ACN Catalog to ensure the continuous compliance of the services used.
Can I use a QC1 service for critical data if I have implemented additional security controls?
In general, no. ACN regulations are stringent: the service’s qualification level must be adequate for the maximum criticality of the data processed. Additional internal controls can strengthen overall security but cannot compensate for a QC qualification lower than that required by law for a specific data type. Compliance is paramount.
What happens if a provider loses its QC qualification?
If a provider loses its QC qualification or if the level is downgraded below what is required for the data processed, the public entity is required to intervene. This may mean migrating data and services to an alternative provider with the appropriate qualification, or terminating the service, to avoid penalties and data security risks. This situation requires immediate action.
Is there a cost to consult the ACN Catalog?
No, the Cloud Services Catalog for Public Administrations is a public tool, and its consultation is completely free. ACN makes it available to support administrations in the cloud migration process, providing transparency on the qualifications of providers and services.
Conclusions with Operational Takeaways
Navigating the landscape of cloud services for Public Administrations is complex, but not impossible. The key to success lies in a deep understanding and rigorous application of ACN guidelines. The main operational takeaway is: start with data classification. Only after identifying whether data is ordinary, critical, or strategic can the required QC qualification level (QC1-QC4) for the cloud service be determined. Always remember to consult the official ACN Catalog to verify infrastructure and service qualifications, carefully distinguishing between the two. A methodical and informed approach not only ensures regulatory compliance but significantly strengthens the entity’s cybersecurity posture, protecting sensitive information and essential services.
Sources
Updated: October 2026
