WEBINARHow to build smarter AI apps with Python and MongoDB. Register now >
NEWHow to build smarter AI apps with Python and MongoDB. Register now >
Image of QC2 logo

← Back to Trust CenterCloud Italy Strategy: QC2 (Critical)

The Cloud Italy Strategy, governed by the Italian Agency for National Cybersecurity (ACN), outlines the security and qualification requirements for cloud services used by the Italian public administration. Within this framework, the QC2 (Critical) classification is reserved for data and services whose compromise could affect essential societal functions, including health, safety, and the nation’s economic and social well-being. Qualification for QC2 requires meeting a stringent baseline of security, infrastructure reliability, and scalability standards.

MongoDB has completed a self-attestation to demonstrate that MongoDB Atlas meets the requirements and controls necessary for the QC2 classification. This self-attestation verifies that MongoDB’s control environment for Atlas—which includes adherence to ISO 9001, ISO/IEC 27001, 27017, 27018, ISO 22301, ISO 20000-1, and CSA STAR Level 2—aligns with the ACN’s criteria for managing critical workloads and data. MongoDB Atlas can be found in ACN's Catalogue of Digital Infrastructures and Cloud Services.

FAQ

What is the Cloud Italy Strategy and QC2?

The Cloud Italy Strategy is a national framework designed to ensure the security, reliability, and autonomy of cloud services used by the Italian Public Administration (PA). It categorizes data and services into three levels: QC1 (Ordinary), QC2 (Critical), and QC3 (Strategic). QC2 (Critical) is the qualification level required for cloud services that manage "Critical" data—information whose compromise could impair essential societal functions, public health, safety, or the economic well-being of the country. To meet QC2 requirements, a provider must satisfy 366 specific controls regarding security, processing capacity, and infrastructure reliability.

Why is QC2 important to MongoDB customers?

With MongoDB Atlas meeting QC2 requirements, Italian Public Administration entities and organizations serving the Italian public sector can confidently store and manage critical workloads in the cloud. This qualification ensures that MongoDB Atlas aligns with the strict cybersecurity standards set by the ACN, enabling the digital transformation of essential public services.

What MongoDB products and services are in scope of this qualification?

MongoDB’s self-attestation for QC2 covers MongoDB Atlas hosted on qualified cloud infrastructure. This includes the core database service and integrated features required for managing critical data workloads. You can find the specific entry for MongoDB Atlas in the ACN’s official Catalogue of Digital Infrastructures and Cloud Services (Card ID: PA-4141).

Are MongoDB’s cloud service providers QC2 qualified?

Yes. MongoDB Atlas is hosted on Amazon Web Services (AWS), Google Cloud (GCP), and Microsoft Azure, all of which have achieved the necessary ACN qualifications (such as QI2/QC2) to host critical workloads. This ensures that the underlying infrastructure layer meets the same rigorous Italian national standards as the MongoDB Atlas service layer.

Who performed the evaluation of MongoDB for QC2?

In accordance with ACN regulations for the QC2 level, MongoDB has completed a self-attestation of compliance. This attestation is supported by independent, third-party audits of MongoDB’s control environment, which include certifications for ISO 9001, ISO/IEC 27001, 27017, 27018, ISO 22301, ISO 20000-1, and CSA STAR Level 2. These global standards form the evidence base for meeting the ACN’s 366 specific security and quality requirements.

Can my organization be qualified by association?

Organizations operating on MongoDB Atlas are not automatically qualified by association. Each Public Administration entity is responsible for classifying its own data and ensuring its specific implementation meets ACN guidelines. However, using a QC2-qualified service like MongoDB Atlas significantly streamlines the process, as customers can leverage MongoDB’s documented compliance and the ACN catalogue listing as evidence for their own digital transformation and migration projects.

Where can I see MongoDB’s official QC2 status?

MongoDB Atlas is publicly listed in the ACN Catalogue of Digital Infrastructures and Cloud Services. This serves as the official registry for qualified cloud services in Italy.

This page is for informational purposes only, and MongoDB does not intend the information or recommendations presented here to constitute legal advice. Each customer is responsible for independently evaluating its own particular use of MongoDB's services as appropriate to support its legal and compliance obligations.

View our other compliance offerings

GDPR →
FedRAMP® →
HIPAA →

Ready to get started?

Launch a new app or migrate to MongoDB Atlas with zero downtime
Start with 512MB FreeContact