**2. Addressing complexity and impacts of pandemic in critical infrastructure**

Dealing with complexity and reducing uncertainty during 2020 crisis is a priority for Countries, Critical Infrastructures, and companies.

Complexity could represent a risk but also an opportunity to create a new competitive advantage.

Society is dependent on composed critical networks, becoming more complex as are strong interdependent both within and between infrastructure systems [1].

Nowadays, complexity and uncertainty assess the search for new and effective management strategies and methods. Embracing unpredictability and planning to adapt is crucial to manage the complexity that cannot be eliminated, although, it can be reduced to manageable levels. Complexity and vulnerability of Critical Infrastructure systems has been explored and assessed [2, 3].

Complexity is related with composite systems and problems that are dynamic, unpredictable, and multi-dimensional. It consists of a collection of interconnected relationships and parts. Unlike traditional "cause and effect" or linear thinking, complexity science is characterized by nonlinearity [4]. Complexity management needs to consider several layouts of complexity, in fact an IC or a company internal value chain is strongly dependent on external complexity.

For each area of complexity regulation, as avoidance and reduction related to causes, transfer, and division, exist several theories, approaches and methods.

Effective complexity management aim to develop an appropriate and effective incident response plan. Finally, complexity must be addressed proactively.

In fact, in such complex scenario, different actors (institutional and non) have responded to the crisis in multiple ways, according to the regulations issued. Moreover, these troubled times show how strategic and essential are some sectors.

In the crisis generated by the pandemic it has been confirmed that the daily life of the citizens depends on the reliability of the Critical Infrastructures (CI) to supply essential services such as energy and water. In recent years, Critical Infrastructure control systems have become more complex, with increasingly interconnected devices; a trend that will probably continue with the Internet of Things.

The need for increased resilience to resist extreme events of both natural and malicious origin has become more acute. With Critical Infrastructure continuously exposed to threats, especially cyber-attacks, there are severe security implications, most notably in the energy sector which is ranked as one of the most affected sectors with the highest incident costs [5]. Any attack of this nature is likely to have knock-on effects on a country's overall economy and the lives of its citizens.

The pandemic, all in all, has had modest effects on the electrical service. Electricity consumption has been reduced by about 10% on average, but with a very uneven distribution on the Italian territory. Fortunately, the phenomenon has been

**221**

involved.

*Italian Crisis Management in 2020*

Industrial Revolution (4IR) [6].

criticality of the situation [7].

*DOI: http://dx.doi.org/10.5772/intechopen.94894*

well controlled and there have been no perceptible effects, but it is easy to imagine the consequences of possible inefficiencies. The effect of the pandemic could be very marked on geopolitical balances, in a context of possible tensions deriving from the rebalancing of the primary energy market and the challenge of the Fourth

The energy issue brings us back to the more general field of critical infrastructures: electricity and energy system, communication networks, infrastructures for the transport of people and goods (air, sea, rail and road), health system, economic-

What happened on the Istituto Nazionale della Previdenza Sociale (the Italian Social Security), website is a symptom of a strong criticality in the Country System, where technical shortcomings make the fundamental rights of citizens even more vulnerable, and how IC and companies must equip themselves to manage crisis situations that are not predictable. For this reason there have been several episodes in Italy which have triggered the alarm by the Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche (CNAIPIC - National Anti-Crime Information Centre for the Protection of Critical Infrastructures). In terms of crisis management, thanks to the experience of avian influenza (H5N1), which has highlighted how the human factor is the most valuable element for any company and as such must be safeguarded and protected, operators of critical infrastructure have been able to develop a series of effective initiatives, as demonstrated by the fact that no essential service, i.e. the supply of gas, water, electricity, transport, etc. has suffered interruptions or dysfunctions in recent months. And this despite the problems related to difficulties in supply, reduced mobility, the presence of staff in quarantine fiduciary and/or infected and considering the

financial circuits, administrative and state organizations and bodies.

commitment of companies to safeguard the health of their workers.

having manpower partly or completely in smart working.

This achievement is the result of an effort which in recent years has seen a significant change in the role of the security managers, which has shifted to the top management in order to bring strategic choices back to specific task forces capable of having a prompt impact on all levels of the company's organization, being equipped with the financial and decision-making capacity appropriate to the

2020 long time crisis and consequent lock down were managed asking to every operators of critical services to maintain business continuity and to guarantee services if critical. This means that not only critical infrastructures at national level, but also critical infrastructures at regional or city or province level had to maintain operation, even having the supply chains partly or completely locked and also even

These lines suggest, first, a reduction in the number of staff working in situ by reducing activities to those that cannot be postponed for business continuity, and to review the maintenance programs, limiting them to those that cannot be postponed and postponing those that are not indispensable, promoting the adoption of smart working at all levels, necessary for the continuity of the service. The Precautionary Principles highlight the need to provide specific training and tools to operators to prevent and combat the threat of cybersecurity, the importance of which is growing today, to equipping all staff with adequate IT support, including the use of

The Office of the Military Advisor of the Presidency of the Council, in consideration of the necessity to guarantee the essential services provided by Critical Infrastructures, has provided the precautionary principles, to which Critical Infrastructure Operators are required to comply in order to contain and contrast the spread of the pandemic, while ensuring the continuity of the supply of essential services, the operability of the facilities and the security of the personnel

#### *Italian Crisis Management in 2020 DOI: http://dx.doi.org/10.5772/intechopen.94894*

*Issues on Risk Analysis for Critical Infrastructure Protection*

over the value chain.

**infrastructure**

competitive advantage.

The human factor has become evident as the cornerstone of any service, from the provision of essential services falling within the competence of the Critical Infrastructures, which have involved a particular attention to the continuous security and business protocols to be followed, to the most disparate production sectors. It is also necessary to remember how the interconnection between the different sectors and services now characterizes our reality, and therefore how the so call "What-If Analysis" s fundamental in the development of decision support tools for crisis management. In this context is clear that resilience is founded on risk analysis and the drawing of recovery plans, together with measures for an increased control

**2. Addressing complexity and impacts of pandemic in critical** 

priority for Countries, Critical Infrastructures, and companies.

Infrastructure systems has been explored and assessed [2, 3].

value chain is strongly dependent on external complexity.

Dealing with complexity and reducing uncertainty during 2020 crisis is a

Complexity could represent a risk but also an opportunity to create a new

are strong interdependent both within and between infrastructure systems [1]. Nowadays, complexity and uncertainty assess the search for new and effective management strategies and methods. Embracing unpredictability and planning to adapt is crucial to manage the complexity that cannot be eliminated, although, it can be reduced to manageable levels. Complexity and vulnerability of Critical

Society is dependent on composed critical networks, becoming more complex as

Complexity is related with composite systems and problems that are dynamic, unpredictable, and multi-dimensional. It consists of a collection of interconnected relationships and parts. Unlike traditional "cause and effect" or linear thinking, complexity science is characterized by nonlinearity [4]. Complexity management needs to consider several layouts of complexity, in fact an IC or a company internal

For each area of complexity regulation, as avoidance and reduction related to causes, transfer, and division, exist several theories, approaches and methods. Effective complexity management aim to develop an appropriate and effective

incident response plan. Finally, complexity must be addressed proactively. In fact, in such complex scenario, different actors (institutional and non) have responded to the crisis in multiple ways, according to the regulations issued. Moreover, these troubled times show how strategic and essential are some sectors. In the crisis generated by the pandemic it has been confirmed that the daily life of the citizens depends on the reliability of the Critical Infrastructures (CI) to supply essential services such as energy and water. In recent years, Critical Infrastructure control systems have become more complex, with increasingly interconnected devices; a trend that will probably continue with the Internet of Things. The need for increased resilience to resist extreme events of both natural and malicious origin has become more acute. With Critical Infrastructure continuously exposed to threats, especially cyber-attacks, there are severe security implications, most notably in the energy sector which is ranked as one of the most affected sectors with the highest incident costs [5]. Any attack of this nature is likely to have

knock-on effects on a country's overall economy and the lives of its citizens. The pandemic, all in all, has had modest effects on the electrical service. Electricity consumption has been reduced by about 10% on average, but with a very uneven distribution on the Italian territory. Fortunately, the phenomenon has been

**220**

well controlled and there have been no perceptible effects, but it is easy to imagine the consequences of possible inefficiencies. The effect of the pandemic could be very marked on geopolitical balances, in a context of possible tensions deriving from the rebalancing of the primary energy market and the challenge of the Fourth Industrial Revolution (4IR) [6].

The energy issue brings us back to the more general field of critical infrastructures: electricity and energy system, communication networks, infrastructures for the transport of people and goods (air, sea, rail and road), health system, economicfinancial circuits, administrative and state organizations and bodies.

What happened on the Istituto Nazionale della Previdenza Sociale (the Italian Social Security), website is a symptom of a strong criticality in the Country System, where technical shortcomings make the fundamental rights of citizens even more vulnerable, and how IC and companies must equip themselves to manage crisis situations that are not predictable. For this reason there have been several episodes in Italy which have triggered the alarm by the Centro Nazionale Anticrimine Informatico per la Protezione delle Infrastrutture Critiche (CNAIPIC - National Anti-Crime Information Centre for the Protection of Critical Infrastructures).

In terms of crisis management, thanks to the experience of avian influenza (H5N1), which has highlighted how the human factor is the most valuable element for any company and as such must be safeguarded and protected, operators of critical infrastructure have been able to develop a series of effective initiatives, as demonstrated by the fact that no essential service, i.e. the supply of gas, water, electricity, transport, etc. has suffered interruptions or dysfunctions in recent months. And this despite the problems related to difficulties in supply, reduced mobility, the presence of staff in quarantine fiduciary and/or infected and considering the commitment of companies to safeguard the health of their workers.

This achievement is the result of an effort which in recent years has seen a significant change in the role of the security managers, which has shifted to the top management in order to bring strategic choices back to specific task forces capable of having a prompt impact on all levels of the company's organization, being equipped with the financial and decision-making capacity appropriate to the criticality of the situation [7].

2020 long time crisis and consequent lock down were managed asking to every operators of critical services to maintain business continuity and to guarantee services if critical. This means that not only critical infrastructures at national level, but also critical infrastructures at regional or city or province level had to maintain operation, even having the supply chains partly or completely locked and also even having manpower partly or completely in smart working.

The Office of the Military Advisor of the Presidency of the Council, in consideration of the necessity to guarantee the essential services provided by Critical Infrastructures, has provided the precautionary principles, to which Critical Infrastructure Operators are required to comply in order to contain and contrast the spread of the pandemic, while ensuring the continuity of the supply of essential services, the operability of the facilities and the security of the personnel involved.

These lines suggest, first, a reduction in the number of staff working in situ by reducing activities to those that cannot be postponed for business continuity, and to review the maintenance programs, limiting them to those that cannot be postponed and postponing those that are not indispensable, promoting the adoption of smart working at all levels, necessary for the continuity of the service. The Precautionary Principles highlight the need to provide specific training and tools to operators to prevent and combat the threat of cybersecurity, the importance of which is growing today, to equipping all staff with adequate IT support, including the use of

dedicated connections, VPN systems and anything else in order to ensure adequate levels of cybersecurity, including the issue of appropriate rules of conduct by staff working in smart working mode.

Furthermore, is required to prepare all the necessary measures related to sanitization.

The Companies are invited to organize the personnel involved in activities that cannot be postponed at the work sites or field operations in teams composed of the minimum number of people necessary for the safe execution of the various activities. The composition of each team, to increase its resilience, must not, where possible, change over time and specific procedural measures must be taken to avoid, or limit to a minimum, physical interaction between several teams.

With regard to the management of the control and management rooms, given that it is necessary to ensure their functionality in all conditions, it is recommended that all useful measures be taken to contain the pandemic; organizing the staff into several teams and adopting specific and more stringent safeguards for this type of personnel, for example, measures and/or adequately equipping several rooms, possibly in different locations, to allow the alternation of shifts in different rooms and/or sanitized each shift change [8]. Another taken measure was the "voluntary segregation": the provision of temporary accommodation for groups of people who will operate in the control center for a period of not less than 14 days without physical contact with external personnel. The spaces to which such staff have access will be forbidden to those who do not implement voluntary segregation. To guarantee the continuous rotation of the activities, a second team of staff is set up at the same time, already in isolation at their homes.

Telespazio has set up a three-level system for its Space Center which, before entering the control room, requires a further period of voluntary quarantine within a camp facility located at the Fucino site [9].

The theme of cyber-security is particularly relevant in an increasingly interconnected world where threat vectors multiply and can affect the vulnerabilities of Critical Infrastructures. Moreover, the low level of cybersecurity preparedness of the country system is also reflected in low awareness among citizen-users.

In view of the above, we can say that for the management of emergencies and crises first of all it is necessary to develop a culture of security, supported by the necessary tools and strategies, also considering that we are moving towards the increasing digitalization of any area of the country. In order to do this we can combine the creation of high potential and distributed networks, to avoid in case of stress of infrastructure use, domino effects. It is not possible today to imagine an area of the country that is not covered by essential infrastructures and services that respond to adequate minimum levels of service delivery and security, especially cybersecurity.

It is therefore also essential to start a training process in line with the needs of the world of work and thus adapt to the new professions, together with a plan for the conversion of skills towards new professional qualifications [10].

A fundamental and new aspect of this crisis, which has led to a rethinking of the management of Critical Infrastructures, is that there was a clear " day before" (in Italy between 10th and 11st March) and a lack of clarity in the "day after". There is still the sensation of a prolonged crisis and the passage to a remote working that has reduced social relations. This situation has also led to a discontinuity in the visibility that the employer has towards his employees (with respect to how he is and what he feels) that had never been experienced before, while the knowledge of the human model is crucial.

When we make a reading of complexity, we consider a company (or a CI) and analyze it in all that is the flow of its value chain and we retrace all the places and moments of a not physiological complexity.

**223**

infantry).

*Italian Crisis Management in 2020*

part of crisis management).

**and production conversion**

caused by the 2020 pandemic.

resilience.

objectives.

their production.

*DOI: http://dx.doi.org/10.5772/intechopen.94894*

One type of challenge for Critical Infrastructure Protection is about the dependencies and interdependencies among different Critical Infrastructures [11]. In the context of this extremely long lock-down we had an enormous complexity of relations with suppliers and with those who had to remain in continuity and we would find in the re-opening a strong discontinuity, also in understanding for example the rules with which it was possible to re-open and the responsibilities (in fact, the provision of a suitable team that knows how to interpret the rules is also

**2.1 The Italian production strategy during the 2020 pandemic: statal measures** 

Italian SMEs have worked out an appropriate response strategy to the crisis

Starting from the importance of the role of each individual entrepreneur, through the constant and daily collection of information on a formal and informal

It emerged that the creation of balanced strategic levers, the make/buy balance, together with the dialog with the stakeholders represented a fundamental element for the conception of a response strategy that represented an example of business

The crisis has certainly been, and still is, an opportunity to examine which lessons are learning for the future creation of resilience-oriented protocols [12]. There are many Italian companies that have reacted to the crisis by reconverting

Phase two, co-existence with the pandemic, began on 4th May 2020. The Prime Minister's Decree issued by the Government has made mandatory the use of the mask in closed places accessible to the public, such as public transport and shops. Wearing the mask is mandatory in all situations where "it is not possible to

Given the emergency and lack of access to this personal protective equipment, more and more companies have chosen to make a concrete contribution and boost their activities after the lockdown by aiming at the reconversion of production chains to manufacture masks. Initiatives that are born to make available the expertise and skills of entire sectors forced by the emergency and the upheaval of daily habits to rebuild their missions and restructure their short, medium- and long-term

Siare Engineering, an Emilian company specialized in the manufacture of lung ventilators (the unique company in Italy), at the outbreak of the emergency increased its production and changed its export market. In mid-March the company delivered 300 machines to the Civil Protection, originally destined for countries such as South Korea, India, the Philippines and Vietnam, its traditional clients. The company was supported by specialized Army technicians with the aim of producing over 2300 machines, tripling production. Siare Engineering's efforts were supported by companies such as Ferrari, FCA and Magneti Marelli [14].

Grafica Veneta, a Paduan company active in the printing sector, has reconverted its production to produce 2 million masks. These products, even though they could not be intended for healthcare workers, provided (at a time of dramatic shortage) an initial protection to the population, and were distributed free of charge to the population by the Civil Protection and the Alpini (Italian Army's mountain

basis, it was possible to identify the strategic levers and focus on new core

businesses, based on corporate liquidity, assets and resources.

continuously guarantee a safe distance" [13].

#### *Italian Crisis Management in 2020 DOI: http://dx.doi.org/10.5772/intechopen.94894*

*Issues on Risk Analysis for Critical Infrastructure Protection*

a camp facility located at the Fucino site [9].

moments of a not physiological complexity.

working in smart working mode.

sanitization.

dedicated connections, VPN systems and anything else in order to ensure adequate levels of cybersecurity, including the issue of appropriate rules of conduct by staff

The Companies are invited to organize the personnel involved in activities that cannot be postponed at the work sites or field operations in teams composed of the minimum number of people necessary for the safe execution of the various activities. The composition of each team, to increase its resilience, must not, where possible, change over time and specific procedural measures must be taken to avoid,

With regard to the management of the control and management rooms, given that it is necessary to ensure their functionality in all conditions, it is recommended that all useful measures be taken to contain the pandemic; organizing the staff into several teams and adopting specific and more stringent safeguards for this type of personnel, for example, measures and/or adequately equipping several rooms, possibly in different locations, to allow the alternation of shifts in different rooms and/or sanitized each shift change [8]. Another taken measure was the "voluntary segregation": the provision of temporary accommodation for groups of people who will operate in the control center for a period of not less than 14 days without physical contact with external personnel. The spaces to which such staff have access will be forbidden to those who do not implement voluntary segregation. To guarantee the continuous rotation of the activities, a second team of staff is set up at the same time, already in isolation at their homes. Telespazio has set up a three-level system for its Space Center which, before entering the control room, requires a further period of voluntary quarantine within

The theme of cyber-security is particularly relevant in an increasingly interconnected world where threat vectors multiply and can affect the vulnerabilities of Critical Infrastructures. Moreover, the low level of cybersecurity preparedness of

In view of the above, we can say that for the management of emergencies and crises first of all it is necessary to develop a culture of security, supported by the necessary tools and strategies, also considering that we are moving towards the increasing digitalization of any area of the country. In order to do this we can combine the creation of high potential and distributed networks, to avoid in case of stress of infrastructure use, domino effects. It is not possible today to imagine an area of the country that is not covered by essential infrastructures and services that respond to adequate minimum levels of service delivery and security, especially cybersecurity. It is therefore also essential to start a training process in line with the needs of the world of work and thus adapt to the new professions, together with a plan for

A fundamental and new aspect of this crisis, which has led to a rethinking of the management of Critical Infrastructures, is that there was a clear " day before" (in Italy between 10th and 11st March) and a lack of clarity in the "day after". There is still the sensation of a prolonged crisis and the passage to a remote working that has reduced social relations. This situation has also led to a discontinuity in the visibility that the employer has towards his employees (with respect to how he is and what he feels) that had never been experienced before, while the knowledge of the human

When we make a reading of complexity, we consider a company (or a CI) and analyze it in all that is the flow of its value chain and we retrace all the places and

the country system is also reflected in low awareness among citizen-users.

the conversion of skills towards new professional qualifications [10].

Furthermore, is required to prepare all the necessary measures related to

or limit to a minimum, physical interaction between several teams.

**222**

model is crucial.

One type of challenge for Critical Infrastructure Protection is about the dependencies and interdependencies among different Critical Infrastructures [11].

In the context of this extremely long lock-down we had an enormous complexity of relations with suppliers and with those who had to remain in continuity and we would find in the re-opening a strong discontinuity, also in understanding for example the rules with which it was possible to re-open and the responsibilities (in fact, the provision of a suitable team that knows how to interpret the rules is also part of crisis management).
