> For the complete documentation index, see [llms.txt](https://experience-digital-transform.gitbook.io/experience-digital-transformation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/cybersecurity-regulations-regulatory-reference-international-frameworks-and-the-education-sector.md).

# Cybersecurity — Regulatory Reference and Education

Published regulations, key regulatory elements, the Budapest and Hanoi cybercrime conventions, and what student data and EdTech supply chains need from a national cybersecurity framework.

{% hint style="info" %}
Second of two pages on Component 3 Category 3 (Cybersecurity Regulations). This page surveys published regulations, summarises key regulatory elements, covers the Budapest and Hanoi cybercrime conventions, and addresses education sector implications. The first page covers the global landscape, the institutional-home choice, and best-practice applications.
{% endhint %}

## 3. Key Published Regulations and References

| Jurisdiction      | Instrument                                                                                        | Year               | Scope / status                          | Key features and Primer relevance                                                                                                                                                                                                                 |
| ----------------- | ------------------------------------------------------------------------------------------------- | ------------------ | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| European Union    | NIS2 Directive (EU 2022/2555); NIS2 Implementing Regulation (2024)                                | 2023 / 2024        | EU; transposition due Oct 2024          | Most comprehensive current reference. 18 critical sectors. Essential/important entity distinction. 24h/72h incident notification. Risk management measure categories. Reference architecture for developing countries — adapt, do not transplant. |
| Estonia           | Cybersecurity Act; RIA mandate; CCDCOE host nation agreement                                      | 2014 / ongoing     | National; civilian integrated model     | Civilian integration model: digital government authority also runs the national CSIRT. 2007 incident as founding reference. CCDCOE as NATO cyber defence centre. Demonstrates civilian architecture can achieve high security outcomes.           |
| Singapore         | Cybersecurity Act; CSA mandate; CII Protection Framework                                          | 2018 / ongoing     | National; centre-of-government civilian | Dedicated civilian authority under the PMO. 11 CII sectors. Proportionate risk-based approach. Cybersecurity Academy for workforce.                                                                                                               |
| Ghana             | Cybersecurity Act; National Cybersecurity Authority mandate                                       | 2020 / ongoing     | National; dedicated authority, Africa   | Dedicated standalone authority. World Bank-supported CSIRT establishment. Best African practice for institutional design.                                                                                                                         |
| India             | IT Act s.70B (CERT-In); National Cybersecurity Policy; National Cybersecurity Coordinator mandate | 2000 / 2013 / 2024 | National; distributed multi-ministry    | Multi-ministry distributed model: PMO coordination, MeitY operations, MHA cybercrime, MoD military. Illustrates coordination challenges of fragmented architecture.                                                                               |
| Council of Europe | Budapest Convention on Cybercrime (ETS 185); Second Additional Protocol                           | 2001 / 2022        | International treaty; 70+ parties       | Primary international instrument for cybercrime cooperation. Mutual legal assistance framework. Second Additional Protocol (2022) strengthens cross-border access to evidence.                                                                    |
| ITU / Global      | ITU GCI 2024; National Cybersecurity Strategy Guide (3rd ed., 2024)                               | 2024               | Global benchmark and guidance           | Five-pillar assessment framework: legal, technical, organisational, capacity, cooperation. 46 Tier 1 countries in GCI 2024. Strategy guide widely used for developing country framework development.                                              |
| United States     | NIST Cybersecurity Framework (CSF 2.0); CISA mandate                                              | 2024               | National; widely referenced globally    | Most widely adopted voluntary cybersecurity framework globally. CSF 2.0 adds a governance function to the original identify-protect-detect-respond-recover model. CISA as civilian operational authority model.                                   |

## 4. Summary of Key Regulatory Elements

### 4.1 Scope

The scope question in cybersecurity regulation involves two dimensions: which entities are subject to requirements, and which systems and activities are covered. On entities, the universal trend in sophisticated frameworks is toward risk-based differentiation — the most demanding requirements apply to the most critical actors, with lighter obligations for entities whose disruption would have lower societal impact; NIS2's essential/important entity distinction is the most developed expression. On systems, the critical information infrastructure designation is the primary mechanism.

For developing countries, a pragmatic scope approach begins with what is achievable: mandatory requirements for government information systems and designated critical infrastructure operators, with voluntary adoption frameworks and supported good practice guidance for the broader economy. Expanding scope as enforcement capacity grows is more effective than legislating comprehensive scope that cannot be enforced.

### 4.2 Key regulatory obligations

Five categories of obligation appear consistently across effective cybersecurity regulatory frameworks:

* **Risk management measures** — organisations must identify, assess, and address cybersecurity risks: access controls, vulnerability management, patch management, encryption of sensitive data, and supply chain security. NIST CSF 2.0's six functions (govern, identify, protect, detect, respond, recover) provide the most widely adopted organising framework.
* **Incident notification** — operators of critical systems must notify the competent authority within defined timeframes, with sufficient technical detail for scope assessment, response coordination, and warning other potential targets. Confidentiality protections for good-faith reporting are essential for compliance.
* **Business continuity and recovery** — critical systems must have tested plans for continuing operations or recovering rapidly. Backup systems, disaster recovery procedures, and crisis management protocols must be documented, tested regularly, and trained on.
* **Security in procurement and supply chain** — the security of a system depends on every vendor whose software, hardware, or services contribute to it. Supply chain security requirements are among the most challenging to implement but among the most important for developing countries integrating externally-supplied digital government infrastructure.
* **Governance and accountability** — senior management must be accountable for cybersecurity outcomes. NIS2 goes further than most frameworks in making executives personally accountable, including possible temporary management bans for serious non-compliance. The minimum viable provision for developing countries is a designated cybersecurity responsibility holder at senior management level in critical infrastructure operators.

### 4.3 Institutional responsibilities

A functional national cybersecurity framework requires at minimum three institutional functions: the **competent authority** (sets standards, oversees compliance, receives incident reports, enforces requirements — ideally the same body as or closely integrated with the CSIRT); the **CSIRT** (the operational response function); and the **coordination body** (manages inter-ministerial and public-private coordination — may be the same as the competent authority in small countries or a separate centre-of-government function in larger ones).

The independence question in cybersecurity regulation differs from data protection: cybersecurity authorities do not need independence from government in the same way data protection authorities need independence to enforce rights against government. What they need is sufficient authority to compel compliance from other government ministries and critical infrastructure operators — typically requiring either a mandate close to the centre of government or a legal framework that gives enforcement powers regardless of ministry hierarchy.

### 4.4 Implementation mechanisms

For developing countries at early stages of cybersecurity maturity, the sequencing recommended by the ITU and World Bank is: first, establish the institutional home and the CSIRT with basic operational capability; second, adopt a national cybersecurity strategy with clear resource commitments; third, identify and designate critical information infrastructure; fourth, impose incident notification and basic risk management requirements on designated CII operators; fifth, build awareness and hygiene programmes for government systems; sixth, extend requirements progressively to the broader private sector as enforcement capacity develops.

## 5. Implications for Digital Government and the Education Sector

### 5.1 Student data as a cybersecurity target

Educational institutions hold sensitive personal data: student records might contain identity information and academic performance, as well as health and disability data, family circumstances, disciplinary history, and — for higher education — research outputs and intellectual property. This data has multiple threat actors. Identity thieves value student records because educational institutions are often less well-defended than financial institutions but hold equivalent personal information. Ransomware actors target educational institutions precisely because they have high operational dependence on their systems and limited cybersecurity investment, making them likely to pay for restoration of access. Nation-state actors target research institutions for intellectual property and strategic intelligence.

{% hint style="warning" %}
The cybersecurity of student data is not a separate concern from data protection — it is the technical foundation on which data protection rights rest. A learner registry with strong data protection provisions but inadequate cybersecurity is a data protection framework that exists on paper and fails in practice. The regulatory framework governing educational data systems must therefore address both the rights dimension ([data protection law](/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/data-protection-and-privacy-global-landscape-and-foundations.md)) and the security dimension (cybersecurity regulation) as integrated requirements, not as separate compliance exercises.
{% endhint %}

### 5.2 EdTech platforms and supply chain security

Educational technology platforms are a primary cybersecurity attack surface in the education sector. When a government deploys EdTech platforms operated by private sector providers — as most digital education strategies do — it introduces into the education system supply chain the security posture of those providers. A breach can expose the personal data of all students using it, disrupt digital learning services for extended periods, and — where the platform integrates with the national learner registry — potentially compromise the integrity of the entire learner data ecosystem.

Supply chain security requirements for EdTech platforms should be a condition of procurement, not a voluntary standard: evidence of security assessment, penetration testing, incident response procedures, and breach notification capabilities as baseline procurement conditions. This is the application to the education context of the supply chain security requirements that NIS2 and similar frameworks impose on critical infrastructure operators. The education sector is not formally classified as critical infrastructure in most frameworks, but the data it holds about children is among the most sensitive any government system processes.

### 5.3 Digital learning infrastructure resilience

If and when digital learning infrastructure is created, it will be subject to new types of threats where a cybersecurity incident — a ransomware attack on the education ministry's systems, a DDoS attack on the platform hosting digital learning resources, a breach of the national learner registry — could disrupt the educational continuity of all students depending on those systems. For countries that have invested significantly in digital learning infrastructure, this creates a specific resilience requirement: the education system's digital backbone must be resilient enough to maintain continuity of educational delivery through incidents that would be catastrophic for a less prepared institution.

The regulatory instrument for this is the business continuity and recovery obligation: digital education system operators — the ministry, the national learner registry authority, and contracted EdTech platforms — should have tested business continuity plans specifying how educational delivery will continue during a significant incident. This requires not just technical backup systems but operational procedures: how do teachers teach, how do students access materials, how does the registry maintain records when primary digital systems are unavailable? Countries that design these resilience requirements from the outset — rather than addressing them after an incident — are considerably better positioned than those for whom the first incident is also the first test of their continuity planning.

## 6. International Frameworks — Budapest and Hanoi

Any national cybersecurity regulatory framework that includes provisions for international cooperation in cybercrime investigation and prosecution must engage with two international treaty instruments that now operate in parallel.

### 6.1 The Budapest Convention — the established framework

The Council of Europe Convention on Cybercrime (Budapest Convention, CETS 185, 2001) is the original and most operationally developed international cybercrime treaty. It establishes a common set of substantive offences — illegal access, data interference, system interference, computer-related fraud and forgery, child sexual abuse material — and a mutual legal assistance framework enabling cross-border evidence gathering and prosecution cooperation. It currently has 66 state parties including the United States and most Western democracies. Its Second Additional Protocol (2022) significantly strengthens cross-border access to electronic evidence, enabling direct cooperation with service providers across borders under defined conditions.

For developing countries, the Budapest Convention's primary value is the operational quality of its cooperation framework: accession brings access to the Council of Europe's extensive capacity building programmes, the 24/7 network of contact points for urgent assistance, and cooperation pathways with the 66 state parties. The main criticism historically levelled at it by non-Western countries is that it was negotiated without their participation — a European instrument extended globally rather than a genuinely universal one.

### 6.2 The UN Convention against Cybercrime (Hanoi Convention) — the new universal instrument

The United Nations Convention against Cybercrime, adopted by the UN General Assembly in December 2024 and opened for signature in Hanoi, Vietnam in October 2025, is the first universal cybercrime treaty. As of April 2026 it has 74 signatories but only two ratifications (Qatar and Vietnam); it requires 40 ratifications to enter into force. The convention was originally proposed by Russia in 2017, which objected to the Budapest Convention as a threat to internet sovereignty; after seven years of negotiation involving all UN member states, civil society, and the technology industry, the final text is considerably more restrained than Russia's original draft.

The convention's substantive offences largely follow Budapest — illegal access, system interference, computer-related fraud — but extend to a broader range of content-related crimes including grooming and solicitation of minors, and its mutual legal assistance provisions apply to 'serious crimes' punishable by at least four years' imprisonment, a threshold that encompasses a very wide range of offences beyond cybercrime specifically. Human rights safeguards are present but weaker than Budapest's — framed in several key places as options rather than binding obligations. The convention's most genuine addition is a substantial chapter on technical assistance and capacity building for developing countries, which the Budapest Convention lacks.

### 6.3 The practical choice for developing countries

The Council of Europe's own assessment of the relationship between the two instruments is instructive: the UN Convention is broadly consistent with the Budapest Convention, represents a narrow criminal justice treaty, and contains the minimum safeguards necessary for international cooperation. The CoE's position is that states party to Budapest should also accede to the UN Convention — the two are complementary, not alternatives. For developing countries not yet party to Budapest, acceding to both provides the broadest coverage: the UN Convention's universal membership and capacity building provisions, combined with Budapest's more advanced operational cooperation tools and its Second Protocol's electronic evidence framework.

The practical sequencing recommendation is: accede to the Budapest Convention first, as the more operationally mature instrument with immediate practical benefits for cybercrime cooperation; then accede to the UN Convention once it enters into force, to ensure access to the broader multilateral framework. Countries that choose only the UN Convention get broader geographic coverage but less developed operational tools; countries that choose only Budapest get better tools but remain outside the universal framework. The decision should be taken explicitly as part of the national cybersecurity regulatory framework design, not left as an administrative afterthought.

{% hint style="danger" %}
One caution is worth noting. The mutual legal assistance provisions of the UN Convention, precisely because they apply to 'serious crimes' broadly rather than specific cybercrime offences, create an architecture that can in principle be used by governments to request cooperation in investigating conduct that other states would not consider criminal — political dissent, journalism, activism. The human rights safeguards in the convention provide some protection against this, but they are not as robust as those in Budapest. Countries with strong rule-of-law traditions and independent judiciaries are better positioned to exercise the discretion the convention permits in declining requests that conflict with their legal principles than countries where judicial independence is limited.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://experience-digital-transform.gitbook.io/experience-digital-transformation/regulations/component-3-comparative-analysis-of-regulations/cybersecurity-regulations-regulatory-reference-international-frameworks-and-the-education-sector.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.