OpenLobby.EU
Explore

Namirial S.p.A.

LA SOCIETA' HA PER OGGETTO L'ESERCIZIO DELLE SEGUENTI ATTIVITA': A. STUDIO, PROGETTAZIONE, CREAZIONE, INSTALLAZIONE, COMPRAVENDITA, MANUTENZIONE E GESTIONE DI PROGRAMMI E SISTEMI INFORMATICI E TELEMATICI, DI RETI INFORMATICHE, DI SISTEMI ELETTRICI ED ELETTRONICI IN GENERE, DI PROGRAMMI ED APPLICATIVI DI ELABORAZIONI E DI BANCHE DI DATI; B. EROGAZIONE DI SERVIZI INFORMATICI IN GENERE, IVI COMPRESE LA COMMERCIALIZZAZIONE E LA GESTIONE DI CASELLE DI POSTA ELETTRONICA (CERTIFICATA E NON), DI SERVIZI DI CERTIFICATION AUTHORITY, DI SERVIZI WEB BASATI SU CLOUD COMPUTING, DI SMART CARD E TOKEN, SOFTWARE GESTIONALI, TOOL E SERVIZI DI SICUREZZA INFORMATICA IN GENERE; C. ACQUISTO, UTILIZZAZIONE, REALIZZAZIONE, PROGETTAZIONE, SVILUPPO, COMMERCIALIZZAZIONE, SFRUTTAMENTO, MANUTENZIONE E ASSISTENZA DI DOMINI INTERNET , DI SITI WEB E DI SERVIZI TELEMATICI IN GENERE, SENZA LIMITAZIONI ALCUNE, SIA PER CONTO PROPRIO CHE PER CONTO TERZI E ANCHE ATTRAVERSO SOCIETA' SPECIALIZZATE Ecc...

Lobbying Activity

Meeting with Roberto Viola (Director-General Communications Networks, Content and Technology)

25 Jun 2025 · Discussion on eIDAS implementing act and interaction with the Digital Product Passport

Response to Quantum Strategy of the EU

30 May 2025

Namirial welcomes the Commissions initiative to develop a comprehensive EU Quantum Strategy, to position Europe as a global leader in quantum technologies, safeguarding its technological sovereignty and economic security. We emphasize that cybersecurity and cryptographic resilience must be foundational pillars of the EU's quantum ambitions, meaning that a coherent quantum strategy cannot be truly complete without a detailed and robust approach to mitigating the cryptographic threats posed by quantum computing, entailing the adoption of PQC (Post-Quantum Cryptography) algorithms and protocols. Updating of current cryptographic schemes should be an integral part of the EU Quantum Strategy. As recognized in both the Call for Evidence and ENISAs 2021 report on PQCs Current State and Quantum Mitigation, quantum computing threatens to render current public-key cryptography obsolete, jeopardizing the confidentiality, integrity, and authenticity of digital communications and transactions. The so-called harvest now, decrypt later attacks could already be underway, making it necessary to avoid any delay in deploying PQC-based solutions. The EU must treat PQC not as an add-on, but as a prerequisite to the secure adoption and deployment of quantum solutions, developed in parallel with cybersecurity solutions. This is particularly vital in sectors such as healthcare, finance, government, defence, digital infrastructure (including cloud, 5G, and AI-enabled systems), where co-design approaches should be pursued. We recommend that the EU Quantum Strategy covers the entire development and industrial uptake of PQC, through: 1) Supporting R&D and innovation across diverse key PQC algorithm families, such as lattice-based, code-based, hash-based; developing different algorithms will provide an additional level of robustness against possible compromises; 2) Funding testbeds, pilots, and implementation projects to assess PQC performance in real-world environments, particularly in critical infrastructure and high-assurance sectors, including those related to the eIDAS framework and its applications; 3) Contributing to and aligning with international standards while enabling European leadership in defining secure and interoperable protocols; 4) Establishing risk-based migration plans, including hybrid encryption and key diversification techniques while also incorporating PQC readiness into the European cybersecurity certification framework, ensuring that certified systems remain secure in a post-quantum world. We also encourage the Commission to: - Support collaboration between ENISA, the European Cybersecurity Competence Center, Member States, standards bodies (such as CEN, CENELEC and ETSI), and the industry; - Include industry representatives in the Strategic Advisory Board and in the governance mechanisms for the EU Quantum Strategy and the Quantum Act; - Encourage the collaboration between industrial users and providers of cryptography-based solutions. In summary, the EU Quantum Strategy should address these key priorities: - Make PQC a core horizontal enabler across all quantum initiatives; - Provide targeted funding and policy instruments for the PQC lifecycle, from theoretical research to practical deployments; - Mandate quantum threat assessments and PQC transition planning for EU-funded digital projects; - Use EU regulatory levers to accelerate PQC adoption; - Coordinate international PQC standardisation and foster strategic autonomy in cryptographic technologies and encouraging the uptake of EU-based algorithms, protocols and solutions. By embedding robust PQC into its foundations, the EU can protect its citizens, secure its digital infrastructure, and assert its technological sovereignty in a future shaped by quantum capabilities. Namirial stands ready to contribute to this mission and looks forward to continuing a constructive and effective dialogue and collaboration with the European Commission and its partners.
Read full response

Response to Digital Product Passport (DPP) service providers

5 Dec 2024

The European Sustainability Reporting Regulation (ESPR) introduces a new paradigm for product sustainability, focusing on a life-cycle approach. From a cybersecurity perspective, ensuring the security of systems managing Digital Product Passports (DPPs) is crucial. These systems should be designed with a "defense in depth" strategy, taking into account potential attempts to circumvent the regulation. Given the global supply chains involved, there are several risks that could undermine the effectiveness of the ESPR, including the submission of inaccurate data (e.g., greenwashing) and limitations on the accessibility of DPP information (e.g., storing it in inaccessible locations or using unreliable backup services). To address these concerns, the ESPR has prompted a standardization request for the CEN CENELEC JTC 24 committee, which faces tight deadlines for compliance. A proposed approach for securing DPPs draws from the successful model of the eIDAS Regulation (2014, revised in 2024). This model created a large, competitive ecosystem of trust service providers in the EU. It is suggested that the ESPR could adopt a similar structure, creating a list of authorized DPP service providers that adhere to specific technical, organizational, and operational standards, as well as security practices and certifications. DPP service providers should be organizations that meet rigorous security requirements, including periodic audits, adherence to cybersecurity standards, and insurance for risks. These providers should be included in a public "EU Trusted List," modeled after the eIDAS Trusted List for trust service providers. This list would ensure interoperability among DPP systems across Europe and potentially beyond. Unlike eIDAS, which distinguishes between qualified and unqualified operators, a single tier for DPP service providers is considered sufficient. Key requirements for DPP service providers must include: Demonstrated technical and organizational expertise; Compliance with relevant security practices and standards; Periodic certification and security audits (e.g., every two years); Cybersecurity insurance; Recognition in a specific EU Trusted List to ensure system interoperability. A specific new working group for JTC 24 should define all of these in detail. The security of DPPs is further ensured by leveraging eIDAS building blocks, particularly the European Digital Identity Wallet (EUDIW), which must be the sole accepted authentication method for accessing or modifying DPP data. This system prevents unauthorized access, ensures data integrity, and mitigates risks like data falsification or unauthorized changes. Data added to the DPP should be signed with a Qualified Electronic Signature (QES) or Qualified Electronic Seal, ensuring accountability and preventing repudiation. Durability and availability of DPP data are critical, and to mitigate risks of data loss, DPP service providers must use legal archiving services, as defined in the eIDAS Regulation. These services ensure that DPPs are preserved and cannot be altered or deleted prematurely. Additionally, the use of eIDAS trust services reduces the complexity of security for DPP providers, as many critical processes (e.g., authentication and data integrity) are handled by specialized third-party operators, making audits simpler and more efficient. By leveraging eIDAS trust services, the ESPR can establish a robust, secure framework for managing product sustainability data while ensuring long-term accessibility, integrity, and reliability. This approach also benefits from the existing competitive and diverse market of over 200 eIDAS trust service operators in Europe. Please refer to the attached document for a greater detail.
Read full response