The thesis work takes place in a new regulatory context: following the Decreto Legge No. 105 of 21 September 2019, in fact, the Italian government has established the Perimetro Nazionale di Sicurezza Cibernetica that identifies public administrations, public and private entities and operators on which the exercise of an essential function of the State depends. The new legislation requires them to comply with more stringent rules on the prevention and response to cyber attacks. On one hand, they are required to create and periodically update the list of networks, information systems and IT services they are responsible for, and on the other hand they are required to carry out analysis operations to identify potential criticalities and/or vulnerabilities (VAPT) in their ICT infrastructure.