INFORMATION AND CYBER SECURITY STRATEGY OF SRI LANKA Thrust # 2: Legislation, Polices, and Standards Olas No aiN7 Act Our Strategy The number of reported incidents involving cybercrimes against individuals and organization in Sri Lanka is increasing day by day. These include RoE ie) aF Policies and Standards cybercrimes against individuals such as credit card fraud, revenge porn, crimes again property such as worm attacks, hacking, and intellectual property theft, and crimes against governmental and other organizations such as cyber terrorism, hacking of websites, processing of unauthorized information, and hacking into sensitive financial data. To battle cybercrimes against individuals and organizations effectively, it is necessary to enact and formulate appropriate legislation, policies, and standards for ensuring protection of sensitive data, digital transactions, electronic communications, privacy, and freedom of expression in the cyber space. The government of Sri Lanka has taken a number of steps in this regard such as the introduction of the government security policy (2009) based on ISO 27000, and data sharing policy, and the enactment of relevant legislation such as the Electronic Transactions Act No. 19 of 2006, Payment Devices Frauds Act No 30 of 2006, the Intellectual Property Rights Acts, and Computer Crimes Act No 24 of 2007. Sri Lanka ratified the Budapest Convention on Cybercrime in 2015 and became the first country in South Asia to join this convention. Moreover, a Computer Crimes Division was established in the Criminal Investigation Department of Sri Lanka Police in line with the enactment of Computer Crimes Act. To further strengthen our regulatory framework to effectively battle emerging cybercrimes, gaps in the existing policies and laws will be identified, and new legislation, policies, and standards will be drafted and implemented to create a secure cyberspace for individuals and organizations. Data Protection Xai Critical ai ieau Celts ure Protection Policy Sra TAL 87 Policy for Oragnizatio ah Baseline Seto CIN Standards Our strategy is to create an appropriate regulatory framework for securing individuals and organizations in the cyberspace and to strengthen prosecution support for modern cyber offences through the introduction of relevant legislation, policies and standards Our Initiatives 2.1. Introduce a New Cyber Security Act 2.1.1. The government will introduce a new Cybersecurity Act for the establishment of the DIPA and for equipping the agency with the necessary powers to effectively address increasingly sophisticated threats to the nation 2.1.2. The new Act will establish a comprehensive framework for the prevention and management of Cyber Security threats and incidents effectively, and protection of critical information infrastructure.