When the BtCIRT was established in 2016, it was carried out through a government executive order which mandated the BtCIRT to provide cybersecurity services at Government and National level. In 2018, with the revision of the Information Communication and Media Act (ICMA) of Bhutan, a new Cybersecurity Chapter was introduced empowering BtCIRT to be the center point of contact for the cybersecurity matters at a national level.

Starting from awareness workshops on cybersecurity hygienes, incident response, Vulnerability assessment to developing National Cybersecurity Strategy and initiatives for the Protection of Critical Information Infrastructure of Bhutan are performed by the BtCIRT. Since 2022, BtCIRT is now placed within the Cybersecurity Division under the Government Technology (GovTech) Agency following major Government transformation initiatives.

The ITU and World Bank assessment provided crucial insights that guided the CIRT in defining its role as the nodal body for cybersecurity in the country. The assessment highlighted specific areas where the CIRT needed to focus its efforts to strengthen the nation’s cybersecurity defenses. During the establishment of BtCIRT the organizational structure and key responsibilities were defined to align with key services to be offered which were identified in consultation with key stakeholders and from the previous assessment. In 2023, the ITU conducted a comprehensive assessment of the CIRT to gauge its current maturity level and identify areas for improvement. The CIRT is working to implement the recommendations from this assessment. In addition, the organization has streamlined its plans and programs based on the findings of a recent cybersecurity readiness performance audit and the drafting of national cybersecurity strategy.

While establishing BtCIRT, the team encountered various challenges with lack of in-country human expertise, technical infrastructure, and adequate resources. In addition, navigating legal and regulatory complexities and mismatch of expectations from stakeholders were hurdles. Upon inception also, the team was also challenged since it started with a very broad mandate with limited resources. These lessons emphasize the importance of a clear and focused mandate, strong legal foundations, investment in human capital, and scalable infrastructure and also the importance of actively engaging the stakeholders early on. It is also important to have adequate financial and technical resources and a team of experts to guide the team (at least for a few years) until the CIRT/CERT is mature enough to move ahead on their own.

BtCIRT has been a member of FIRST and APCERT since 2017 and a few years ago we became members of GFCE and CAMP. We have benefited from timely information about cybersecurity trends, threats, vulnerabilities and most importantly the fixes and experiences from the community. In addition we have been able to harness numerous opportunities of remote training and annual drill provided by APCERT, self-paced recorded webinars in FIRST portals, GCCD virtual webinars through CAMP membership. BtCIRT members have also availed opportunities for attending face to face CAMP meetings in South Korea twice in 2022 and 2023, and GFCE conference in Ghana in November 2023. Attending these physical events provided a platform to network with fellow cybersecurity professionals and CERT/CIRT colleagues from other countries; sharing our issues and problems and also learning their different strategies and takes on ensuring cybersecurity in their respective countries. In fact, recently, GFCE and World Bank in cooperation with APC-Hub Secretariat in Seoul, South Korea, hosted a group of delegates in 2024 from Bhutan helping build critical capacity on cybercrime. APC-HUB is a capacity-building training institution dedicated to providing training on combating cybercrime for lawmakers, policymakers, judges, prosecutors, investigators, and other multi-stakeholders in the Asia-Pacific region.

As BtCIRT is part of the Government Technology (GovTech) Agency, we are members of APNIC and ITU. The team has received support from APNIC in conducting technical workshops for the ICT professionals in the country, and also helped in providing funding support for the first edition of the National Cybersecurity Awareness Week in 2021. On the other hand ITU has helped BtCIRT since the inception in various fronts. The recent activities include ITU-Bhutan Joint CyberDrill 2022, CIRT Assessment which included a Tabletop exercise and workshop on malware analysis and reverse engineering, and development of Child Online Protection Guidelines of Bhutan. The team has attended the global cyberDrill virtually in 2020 and 2021 and in 2023, ITU provided the opportunity for BtCIRT to attend the Inter-regional cyber drill in Cyprus in December 2023 in person, and the global cyber drill in UAE in 2024.

As Bhutan has bilateral and multilateral relationships, we have also received assistance from many countries in cybersecurity capacity development.