Sri Lanka Cyber Security Strategy 2025-2029 Explained

Sri Lanka is moving more public services, business processes and everyday transactions into digital systems. That creates convenience and economic opportunity, but it also increases the impact of compromised accounts, unavailable services, ransomware, data exposure and attacks on critical systems.

The National Cyber Security Strategy of Sri Lanka 2025-2029 is the country’s current roadmap for addressing that problem at national level. Cabinet approved its implementation in July 2025, and the strategy was formally launched on 19 September 2025 alongside the National Cyber Security Operations Center (NCSOC).

The strategy is important because it treats cyber security as more than an IT department problem. Its stated vision is a secure, trusted and inclusive digital ecosystem in which Sri Lanka can realise the benefits of the evolving digital economy. It connects law and governance, technical readiness, skills, public awareness, incident response, critical infrastructure protection and cooperation.

This article explains what that direction means in practical terms, without treating the strategy as a guarantee that every objective has already been achieved.

Where Sri Lanka is starting from

Sri Lanka is not beginning from zero. The country’s first Information and Cyber Security Strategy was introduced in 2018 and implemented for the 2019-2023 period. The Cabinet Office says the 2025-2029 strategy was developed by Sri Lanka CERT with World Bank support, building on that earlier work.

There is also an external benchmark worth understanding. In the International Telecommunication Union’s Global Cybersecurity Index 2024, Sri Lanka is in Tier 2: Advancing. Under that edition of the GCI, Tier 2 covers overall scores from 85 to below 95, while Tier 1 is the highest category, called Role-modelling.

The national strategy explicitly states an ambition to move from T2 to T1. That is a useful target, but the GCI should not be mistaken for a direct measurement of whether every system in a country is secure. ITU assesses national commitments across five pillars: legal, technical, organisational, capacity development and cooperation. Its methodology also notes that countries with similar overall scores can differ significantly at individual pillar level.

In other words, moving upward requires coordinated national capability, not simply buying more security products.

The strategy as a security system

A useful way to understand the strategy is as several layers that have to reinforce each other.

A practical map of Sri Lanka’s National Cyber Security Strategy from national direction to operational resilience.

Original interpretation diagram for this article. It groups the strategy’s stated priorities into connected security layers rather than implying that one control can deliver national resilience by itself.

The Cabinet decision summarises four broad strategic areas: strengthening the legal and regulatory framework, improving knowledge, enhancing cyber security preparedness and response capabilities, and increasing collaboration. The published strategy expands that direction around legal frameworks, technical capability, institutional structures, capacity development and cross-sector alignment.

These areas are interdependent. A technically capable monitoring centre is less effective if organisations do not know what incidents to report. A strong law is less useful if institutions lack people who can implement controls. Training alone cannot compensate for excessive privileges or unpatched critical systems. National resilience comes from making the layers work together.

1. Governance, law and accountability

Cyber security decisions become difficult when responsibility is unclear. Who owns a risk? Who coordinates a national incident? Which systems count as critical? What minimum controls should an institution implement? When should an incident be escalated?

The strategy places legal and administrative frameworks near the centre of the national response. This matters because digital trust depends on more than criminalising malicious activity. Organisations need clear mandates, responsibilities, standards and escalation paths.

For a government institution, this should eventually translate into practical governance such as an accountable security owner, documented risk decisions, asset and data ownership, incident-response responsibilities, supplier requirements and management reporting. Policy becomes useful when it changes operational behaviour.

The strategy also says cyber security initiatives should protect privacy and civil liberties. That is an important design constraint. Security monitoring should be purposeful and governed rather than becoming an excuse for uncontrolled collection of personal information.

2. Critical digital infrastructure needs resilience, not only prevention

Some digital systems have consequences far beyond the organisation operating them. Immigration, taxation, transport, finance and other essential services can affect large parts of society when they become unavailable or compromised.

The strategy therefore gives critical digital infrastructure special attention. The practical security objective is not to assume attacks can always be prevented. It is to reduce the probability of compromise, detect abnormal activity quickly, contain incidents and restore essential services safely.

That means resilience needs controls before, during and after an incident:

Stage	Practical capability	Why it matters
Before	Asset inventory, hardening, patching, identity controls, segmentation, tested backups	Reduces exposed attack paths and limits blast radius
Detect	Central and local logging, endpoint and network visibility, threat intelligence, alert triage	Shortens the time between malicious activity and investigation
Respond	Defined authority, containment playbooks, evidence preservation, communication paths	Prevents confusion during a high-pressure incident
Recover	Tested restoration, clean backups, continuity plans, lessons learned	Restores services without simply reintroducing the original weakness

The strategy’s emphasis on preparedness is therefore as important as its emphasis on protection.

3. NCSOC turns part of the strategy into an operational capability

The National Cyber Security Operations Center was formally launched on the same day as the strategy, 19 September 2025. It operates under Sri Lanka CERT and is intended to provide continuous monitoring, threat intelligence, early warning and coordinated incident response for government and critical digital infrastructure.

Government reporting at launch stated that NCSOC would provide 24-hour monitoring for 37 institutions managing critical digital infrastructure. That number describes the launch scope reported in September 2025, not necessarily a permanent ceiling. NCSOC material in 2026 also shows ongoing awareness and onboarding activity with public institutions.

This distinction matters. A national SOC is not a magic shield around every connected system. Central monitoring depends on telemetry quality, onboarding, local controls, escalation procedures and people at participating organisations who can act on an alert.

A useful operational chain looks like this:

Local system telemetry -> detection and correlation -> analyst investigation -> coordinated containment -> institutional recovery -> lessons fed back into controls

If any link is weak, the value of the whole chain falls. For example, a high-quality alert is of limited use if nobody has authority to isolate the affected endpoint.

4. Sri Lanka needs security skills at several levels

The strategy identifies capacity development and a skilled cyber security workforce as national priorities. This should not be interpreted as a need for penetration testers alone.

A resilient digital economy needs different kinds of security capability: secure software development, system and cloud administration, identity engineering, SOC analysis, digital forensics, incident response, governance and risk, privacy, security architecture, audit, threat intelligence and security-aware leadership.

It also needs ordinary staff to recognise common threats and know how to report them. A finance employee who identifies a fraudulent payment request early can be part of the security system even without a technical role.

For students and early-career professionals, this creates a useful lesson: build strong foundations before chasing tool names. Networking, operating systems, identity, web technologies, databases, scripting, cloud concepts and security principles remain valuable because national capability ultimately depends on people who understand how systems actually work.

For a broader learning roadmap, see Cybersecurity in Sri Lanka: Skills, Careers and What Beginners Should Learn.

5. Public awareness is a national control

The strategy includes public awareness and online safety, including attention to schoolchildren and vulnerable communities. That belongs in a national cyber strategy because many attacks deliberately bypass technical controls by targeting people.

Phishing, account takeover, fraudulent messages and impersonation can affect citizens even when the underlying platform has strong infrastructure security. Public guidance should therefore be actionable: how to verify a message, use multi-factor authentication, protect recovery methods, update devices, report suspicious activity and respond after an account compromise.

Awareness also has to evolve. Repeating “do not click suspicious links” is not enough when fraudulent communication can arrive through social media, messaging apps, QR codes, voice calls or convincing AI-generated content. Education should explain verification habits rather than rely only on recognising obvious spelling mistakes.

6. Cooperation is part of the defence model

Cyber incidents rarely respect organisational boundaries. A compromised supplier can affect customers. A malicious domain may target several banks. A vulnerability in a widely used product can create exposure across government and private organisations at the same time.

The strategy therefore emphasises collaboration among government, the private sector, academia, civil society and international partners. At operational level, useful cooperation can include timely incident reporting, threat-indicator sharing with appropriate safeguards, coordinated vulnerability handling, sector exercises, joint training and lessons learned after incidents.

International cooperation matters as well because infrastructure, cloud providers, software supply chains and attackers can all cross national borders. Sri Lanka CERT’s role as a national coordination point is important in that environment.

7. Standards-driven and risk-based security is more sustainable

The strategy’s mission describes its initiatives as risk-based, standards-driven and future-oriented. Those words are useful when translated into engineering decisions.

Risk-based does not mean accepting weak security. It means directing effort according to assets, threats, likelihood and impact rather than treating every system identically. A public information page and a system holding sensitive citizen records should not receive the same security priority.

Standards-driven means organisations can use established frameworks and control baselines instead of inventing security programmes from scratch. The exact framework should fit the organisation and any applicable requirements, but the principle is consistent: define controls, assign responsibility, collect evidence, test effectiveness and improve.

Future-oriented is particularly relevant to AI, cloud services and changing software supply chains. New technology should be threat-modelled before broad deployment rather than secured only after an incident. The same principle applies to AI systems: AI security requires conventional security controls plus attention to model, data and agent-specific trust boundaries.

What the strategy means for a Sri Lankan organisation

Most organisations do not need to wait for a national programme to begin improving resilience. The strategy’s direction can be converted into a practical internal baseline now.

Start by knowing what you operate and what matters. Maintain an inventory of important systems, internet-facing services, privileged accounts, sensitive data, cloud resources and critical suppliers. Assign owners rather than leaving assets as anonymous IT objects.

Then reduce common paths to compromise. Use multi-factor authentication where appropriate, especially for privileged and remote access. Remove unnecessary privileges. Patch exposed systems. Segment important environments. Protect and test backups. Centralise useful security logs and make sure somebody actually reviews actionable alerts.

Prepare for failure as well as prevention. An incident plan should identify who can make containment decisions, how to contact key people when normal systems are unavailable, how evidence will be preserved and how public or regulatory communication will be handled. Exercise the plan before a real incident.

Finally, treat suppliers and new digital projects as part of the attack surface. Security requirements should enter procurement and system design early, not appear as a checklist immediately before launch.

What the strategy does not mean

A national strategy is a direction and coordination mechanism. It is not evidence that every government service, business or citizen is already protected.

The formal launch of NCSOC also does not eliminate the need for local security teams and controls. Central visibility complements endpoint hardening, secure development, identity governance, backups and institutional incident response. It cannot replace them.

Similarly, the ambition to reach Tier 1 in a future Global Cybersecurity Index should be understood carefully. ITU’s GCI measures national cybersecurity commitments across defined pillars. The 2024 report explicitly notes that activities can vary in quality and impact in ways the index does not measure. A stronger tier would be a useful signal of national progress, but resilience still has to be demonstrated in how institutions prevent, withstand and recover from real incidents.

How progress should be judged

The strongest implementation evidence will be outcomes and capabilities rather than announcements alone. Useful questions include:

Are critical institutions able to detect and escalate incidents faster?
Are incident-response responsibilities clear and exercised?
Are critical services designed and tested for recovery?
Are security requirements built into digital-government projects and procurement?
Is the cyber workforce growing across technical and governance roles?
Are citizens receiving practical, current online-safety guidance?
Are public and private organisations able to share relevant threat information safely?
Are lessons from incidents producing measurable control improvements?

These questions align the strategy with operational resilience. They also make progress easier to discuss without assuming that installing a security product or opening a new facility completes the work.

A significant step, with implementation now the real test

Sri Lanka’s National Cyber Security Strategy 2025-2029 gives the country a current national direction for securing digital transformation. Its value is in the way it connects governance, critical infrastructure, operational monitoring, incident response, skills, public awareness and cooperation.

The next challenge is implementation. Cyber resilience is built through repeated work: identifying risk, reducing exposure, detecting attacks, responding coherently, recovering safely and learning from what happened. The strategy and NCSOC can provide national coordination, but sustainable security will depend on institutions, businesses, professionals and citizens turning those priorities into everyday practice.

Sri Lanka's National Cyber Security Strategy 2025-2029 Explained