Institutions with valuable assets around the world are digitizing them quickly, but governance of IT/Security is frequently not considered – even at a basic level. Digitization projects create vast opportunities to share data and innovate. However, inherently, systems that collect personally identifiable, sensible information and transactional data from multiple sources in one place become targets for cyberattacks. The inability of governments to effectively address emerging cyber threats can ruin the confidence people have in the state, its institutions, and the economy, and in turn hamper economic growth.

When implementing projects, we see that, more often than not, functionality is considered as the primary objective of any project; security comes with no priority attached to it. If cybersecurity is considered at all, it is thought of as very technical, something that is put on IT systems as an afterthought, preferably in the shape of another box.

Moreover, a false expectation persists that there is some institution in the country (be it CIRT or IT Ministry) which is responsible for cybersecurity, and which will protect the organization if such a need arises. Organisations tend to forget that cybersecurity is the responsibility of the head of an organization, and when a security incident happens, she or he is held accountable. Donors also tend to forget that in case of a cyber incident, the reputation of both the donor and the implementing organization is hurt, and trust in the newly developed system is lost.

Sometimes processes are deployed and even ITIL or ISO certifications are acquired, with processes described over hundreds of pages, but with no real impact on the organizational culture. At the same time, little time is allocated for capacity building programmes. Two weeks of training may provide a knowledge boost, but it does not produce new habits. So, new knowledge gives way to old habits.