The workshop opened with remarks from Adolfo Campos, Political Officer at the Delegation of the European Union to Panama, Francisco Guinard, Deputy Administrator General of the Panama National Authority for Government Innovation (AIG) and César Moliné, Regional Director from LAC4.

Throughout the session, the importance of Critical Infrastructures (CI) and the relevance of correctly distinguishing them were analyzed, including Critical Information Infrastructures (CII) as a fundamental part of CI. Specifically, the session focused on effective measures and mechanisms to protect CII, drawing lessons from the European Union’s frameworks and Estonia’s leading practices in the field. The discussions emphasized the importance of a combination of updated regulations and security policies with practical exercises and testing, involving collaboration between public institutions and private sector stakeholders.

Most important take-aways for successful CIIP include:

• Critical infrastructure is generally thought of as the key systems, services and functions whose disruption or destruction would have a debilitating impact on public health and safety, commerce, and national security or any combination of those matters.
• It’s crucial to identify and prioritize truly essential services; trying to protect everything equally can dilute resources and jeopardize the most critical systems.
• Modernised cybersecurity laws and regulations are fundamental for safeguarding national networks and infrastructures.
• Understanding how critical infrastructures support key societal functions, like public health, the economy, and national security, helps prioritize efforts, especially for high-impact entities.
• Providers must conduct risk assessments as a mandatory part of their responsibilities. The state may review these processes to ensure they are properly carried out in accordance with applicable laws.
• Clear, well-defined response plans are essential to prevent disruptions from escalating into crises.
• CII operators must remain accountable for the full infrastructure, including outsourced components.
• Governments must not only create targeted policies but also foster the use of advanced, efficient technologies to secure CII.
• Adopting an information security standard provides a reliable roadmap for meeting baseline cybersecurity requirements.
• CII protection should be based on four core principles: operator accountability, risk-based defenses, impact mitigation, and strong collaboration across sectors.
• CIIP is a shared duty between public institutions and the private sector.
• A successful protection strategy requires adequate resources, qualified personnel, robust processes, and suitable technology.
• Regular tabletop and real-time (live-fire) exercises are essential for testing and improving cyber response readiness.
• Penetration testing plays a key role in uncovering critical vulnerabilities in CIIs.
• In case of incidents, forensic capabilities, including malware detection and tailed reports, are needed for thorough analysis and recovery.
• Assigning a designated point of contact in each essential service streamlines coordination during a cyberattack.
• Ongoing information sharing, through reports or events, on evolving threats and cybersecurity practices is vital for keeping defenses current.