Fostering cyber resilience in Bhutan

In 2018, Bhutan initiated the development of a National Cybersecurity Strategy (NCS), followed by the launch of the Critical Information Infrastructure (CII) identification process in 2020.

In 2023 the World Bank launched a series of advisory support activities to inform and streamline the preparations for the ACCESS project. As part of this effort the World Bank partnered with NRD Cyber Security, which worked closely with the BtCIRT to prioritize initiatives under the NCS and refine its strategic focus, taking into account the country’s digital landscape, available resources, and institutional capacities. This collaboration culminated in the finalization of the NCS and the development of an accompanying NCS Action Plan for its implementation which were both approved by the government in September of 2024.

At the same time, the NRD Cyber Security team supported the BtCIRT in creating a methodology for identifying CIIs. This involved:

• Reviewing the national policy environment
• Analyzing international methodologies and best practices
• Facilitating stakeholder consultations
• Ultimately selecting the most suitable approach for the country.

In addition to the methodology, a comprehensive CII protection program was also developed.

The deliverables produced through this engagement laid the foundation for a robust national cybersecurity framework, positioning the country to strengthen its cyber resilience and advance its cybersecurity maturity in the years to come.

To empower the GovTech Agency to lead the key national cybersecurity initiatives, such as the implementation of the NCS, identification of CIIs, and prepare the agency for the implementation of the cybersecurity activities under the ACCESS project, the World Bank engaged the NRD Cyber Security team to provide advisory support to the BtCIRT in defining the GovTech Agency’s responsibilities in delivering two of the NCS strategic goals – the incident response and CII Protection (CIIP).

Over the course of the five-month engagement, NRD Cyber Security team conducted a comprehensive analysis of the RGoB’s IT architecture and the GovTech Agency’s mandate. This included mapping existing cybersecurity functions with the new ones, emerging from a newly adopted NCS.

Then, the team delineated the GovTech Agency’s cybersecurity tasks and responsibilities across different areas of cybersecurity, which concluded in a set of actionable recommendations and an implementation plan for the GovTech and its departments.

The adoption of the NCS will represent a pivotal moment in Bhutan’s journey towards becoming a fully-fledged cybersecurity nation. It is anticipated that the recommendations provided throughout this project will contribute to a more streamlined approach to managing these significant changes within GovTech Agency. This will be achieved by ensuring that all stakeholders within the Agency are fully aware of their respective tasks and responsibilities.

To further support the implementation of the NCS, particularly in the areas of incident response and CIIP, the World Bank launched a follow-on phase of advisory support in 2024. This new phase aimed to strengthen the RGoB’s cybersecurity foundations, with a specific focus on preparing the BtCIRT to implement high-priority NCS initiatives and enhance its capacity to coordinate cybersecurity initiatives planned under the ACCESS project.

NRD Cyber Security team assisted the BtCIRT in defining the cybersecurity responsibilities of key national stakeholders to support the implementation of the NCS’s strategic objectives. This work was built upon previous efforts by the NRD Cyber Security team to clarify cybersecurity roles and responsibilities within the GovTech framework.

The assignment began with a review of the country’s unique national IT architecture. This was followed by a series of online and in-person consultations with relevant stakeholders. Based on these discussions, the team mapped national IT assets and their ownership, organizing them into distinct clusters and assigning associated cybersecurity tasks and responsibilities accordingly. A set of recommendations was developed to improve the current allocation of roles across government institutions.

The resulting analysis serves as a strategic tool for GovTech, enabling it to better plan and align future cybersecurity initiatives, including the establishment of a Government Security Operations Center (G-SOC) and the development of CIIP guidelines, both of which are expected to be implemented under the ACCESS project.

One of the key strategic actions outlined in the NCS was the development and implementation of a National Cybersecurity Risk Assessment (NCRA). To support this, the NRD Cyber Security was engaged by the World Bank to design an NCRA methodology tailored to the country’s specific context.

As part of the assignment, the NRD Cyber Security team conducted a series of stakeholder consultations to define the NCRA’s scope, prepared a best practices review, and presented them during an in-country workshop. Based on the inputs gathered during online and onsite consultations, the NRD Cyber Security team proposed a customized NCRA approach for Bhutan.

The assignment resulted in the delivery of a comprehensive NCRA methodology, accompanied by a detailed NCRA User Guide that outlines step-by-step implementation guidance for institutions required to take part in the NCRA and the BtCIRT, as the NCRA’s leading institution. The NCRA methodology provides a structured framework for identifying, assessing, and mitigating cybersecurity risks across the nation’s CIIs and other institutions of national importance. The NCRA is a foundational component of Bhutan’s efforts to strengthen its national cybersecurity posture and will be rolled out for the first time under the ACCESS project.