Throughout the session, the importance of Critical Infrastructures (CI) and the relevance of correctly distinguishing them were analysed, including Critical Information Infrastructures (CII) as a fundamental part of CI. Specifically, the session focused on effective measures and mechanisms to protect CII, drawing lessons from the European Union’s frameworks and Estonia’s leading practices in the field. The discussions emphasized the importance of a combination of updated regulations and security policies with practical exercises and testing, involving collaboration between public institutions and private sector stakeholders.

Key take-aways for successful CIIP include:

• To ensure the protection of critical information infrastructures, a comprehensive approach is required, including four key elements: resources, the right people, effective processes, and appropriate technology.
• It is necessary to carefully identify and prioritise truly critical services. In an attempt to cover everything without distinguishing what’s genuinely essential, efforts may be spread too thin.
• It is important to consider the critical role that the critical infrastructure plays in various societal services and sectors, such as the economy, national security, or public health.
• It is essential to have a defined response plan in place to ensure that disruptions in critical infrastructures do not escalate into emergencies.
• The security of Critical Information Infrastructure should be guided by four key principles: accountability of the service provider, comprehensive risk-based protection, mitigation of incident impact, and active cooperation among stakeholders to manage interdependencies and respond effectively to cyberattacks.
• The CIIP is a shared responsibility between the state and the private sector.

Led by Perit Kirkmann-Raave, a CIIP Lead Expert at the National Cyber Security Centre of Estonia (NCSC-EE), the session brought together 48 participants from key Guatemalan institutions, including the Presidential Commission for Open and Electronic Government, the Ministry of National Defense, the Ministry of the Interior, and the Secretariat of Strategic Intelligence of the State, among others.