INFORMATION AND CYBER SECURITY STRATEGY OF SRI LANKA 2.2. Data Protection and Privacy Laws 2.2.1. Currently, the number of cases on stealing customer data is on the rise. However, Sri Lanka lacks appropriate laws to protect customer data. We will, therefore, introduce a data privacy and protection law which governs the collection, use, and disclosure of citizens’ personal data by government and private sector organizations. 2.2.2. 2.3. 2.4. Through this act, we will ensure that all government organizations and private sector firms which maintain citizens’ data have adequate security controls in place and make them liable for privacy violations. Data Sharing Policy 2.3.1. We will also introduce a data sharing policy for government organizations Baseline Security Standards We will facilitate the Sri Lanka Standards Institute to develop baseline information and cyber security standards for information systems, hardware, and software applications. 2.5. Critical Infrastructure Protection Policy We will introduce Critical Infrastructure Protection Policy which will identify and declare infrastructure as critical infrastructure and provide measures necessary for protecting, safeguarding and increasing resilience of critical infrastructure. 2.6. Information Security Policy We will facilitate organizations to develop security policies based on the maturity of their information systems. The information security policy of each organization shall be developed aligning with international standards. Thrust # 3: Development of a Competent Workforce Our Strategy Cyber-attacks and the disruptions to information systems caused by these attacks are increasing exponentially. In this context, it is necessary to ensure the availability of a cadre of knowledgeable and highly skilled professionals in the field of information and cyber security domain to protect, detect, defend and respond to these cyber-attacks. In 2016, skills gap analysis from ISACA estimated a global shortage of 2 million cybersecurity professionals by 2019®. As per the GCI, Sri Lanka requires to expend much effort on building overall human resource capacity to combat emerging cyber threats. In Sri Lanka, to date, there is a distinct lack of initiatives to address the domestic shortage of cybersecurity experts. We will, therefore, aim to implement appropriate strategies to facilitate our workforce to gain and maintain the knowledge, skills, experience and technological capabilities needed to effectively work in the cyber environment. Our strategy is to create a virtuous circle of supply and demand of information and cyber security experts through continuous assessment of the gap between the supply and demand of cyber professionals, increasing learning opportunities to capitalize on cyber security knowledge, and educating youth for building a pool of future cybersecurity professionals