The institutional response to subsea critical undersea infrastructure (CUI) threats has accelerated across Europe since the sabotage of the Nord Stream pipelines in September 2022, with new coordination mechanisms at NATO, a Joint Communication at EU level in February 2025, and a wave of national legislative responses. Across these instruments, the direct executive authority for action appears most concentrated at the operational phase of the infrastructure lifecycle. This paper develops a Lifecycle × Layers of Risk matrix that combines five phases of subsea infrastructure (governance and planning, manufacturing, installation, operation, repair) with three transversal layers of risk (cybersecurity, normative-legal, geoeconomic). The matrix is applied in two movements: to the documented record of recent incidents and exposure patterns (2016–2025), and to the Italian case, where Legge 26 gennaio 2026, n. 9 established the Agenzia per la Sicurezza delle Attività Subacquee (ASAS) as a dedicated national agency for underwater security with explicit responsibilities for subsea infrastructure of national interest. The first application suggests that documented cases distribute across the lifecycle but cluster at the operational phase in ways that appear shaped by incident legibility. The second suggests that Italian subsea infrastructure has documented exposures at every phase of the lifecycle, and that the ASAS mandate covers functions across the lifecycle while its direct instruments are most developed at the operational phase, with consultative or coordinative authority at the other four. The two readings together support a two-fold use of "structural" that the paper develops: the structure of response capacity concentrates direct instruments at the operational phase, while the structure of risk generation at the other four phases reflects market, supply-chain, and inter-jurisdictional conditions accessible primarily through indirect, supranational, or industrial-policy levers.
Marchetti, Raffaele; Valeriani, Manfredi; Leandro, A.; Leccese, G.; Marchionna, G.. (2026). The operational-phase bias: A lifecycle reading of the Italian CUI response. In C. Bueger & M. Doğrul (Eds.), 6th Maritime Security Conference Proceedings: Building resilient maritime security in an age of grey zone threats and challenges (pp. 283-307). NATO Maritime Security Centre of Excellence (MARSEC COE).
The operational-phase bias: A lifecycle reading of the Italian CUI response
Marchetti R.
;Valeriani M.;
2026
Abstract
The institutional response to subsea critical undersea infrastructure (CUI) threats has accelerated across Europe since the sabotage of the Nord Stream pipelines in September 2022, with new coordination mechanisms at NATO, a Joint Communication at EU level in February 2025, and a wave of national legislative responses. Across these instruments, the direct executive authority for action appears most concentrated at the operational phase of the infrastructure lifecycle. This paper develops a Lifecycle × Layers of Risk matrix that combines five phases of subsea infrastructure (governance and planning, manufacturing, installation, operation, repair) with three transversal layers of risk (cybersecurity, normative-legal, geoeconomic). The matrix is applied in two movements: to the documented record of recent incidents and exposure patterns (2016–2025), and to the Italian case, where Legge 26 gennaio 2026, n. 9 established the Agenzia per la Sicurezza delle Attività Subacquee (ASAS) as a dedicated national agency for underwater security with explicit responsibilities for subsea infrastructure of national interest. The first application suggests that documented cases distribute across the lifecycle but cluster at the operational phase in ways that appear shaped by incident legibility. The second suggests that Italian subsea infrastructure has documented exposures at every phase of the lifecycle, and that the ASAS mandate covers functions across the lifecycle while its direct instruments are most developed at the operational phase, with consultative or coordinative authority at the other four. The two readings together support a two-fold use of "structural" that the paper develops: the structure of response capacity concentrates direct instruments at the operational phase, while the structure of risk generation at the other four phases reflects market, supply-chain, and inter-jurisdictional conditions accessible primarily through indirect, supranational, or industrial-policy levers.| File | Dimensione | Formato | |
|---|---|---|---|
|
2016 CAVI-Istanbul.pdf
Solo gestori archivio
Tipologia:
Documento in Post-print
Licenza:
Tutti i diritti riservati
Dimensione
399.19 kB
Formato
Adobe PDF
|
399.19 kB | Adobe PDF | Visualizza/Apri |
Pubblicazioni consigliate
I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.



