During the seminar participants engaged with a comprehensive set of topics designed to bridge the gap between policy and practice. The seminar addressed cybersecurity governance from a dual perspective: a macro view, examining national and inter-institutional frameworks, and a micro view, focusing on practical implementation within organizations, including CSIRTs.

Key themes included principles and components of cybersecurity governance, aligning organizational governance with national and regional frameworks, and adopting technical and operational best practices to establish clear roles, responsibilities, and processes.

Most important take-aways from the seminar:

• Cybersecurity is more than just security. It is defined as the framework of rules, responsibilities, and practices for managing and directing an organization’s or a nation’s cybersecurity.
• Macro governance is essential to protect societies from the cascading effect, that happens when single breach can cause a domino effect across sectors, threatening national security and economic stability.
• New cybersecurity strategies are being developed across the globe such as the the NIS2 Directive, developed to establish a high and uniform level of cybersecurity across the entire EU.
• The pillars of macro of macro governance are: national strategies, competent authorities, EU-level cooperation and a CSIRTs network.
• It is essential to distinguish between essential entities (those belonging to highly critical sectors) and important entities (those from other critical sectors). The main distinction is that while both have obligations, Essential Entities face stricter supervisory and enforcement measures.
• When developing a cybersecurity governance strategy, it is crucial to keep in mind three key elements: a mandatory national strategy in each member state, its nature as a living document subject to regular updates, and the inclusion of governance structures, policy measures, and objectives for research and education.
• A solid legal foundation is essential, and a national cybersecurity law should be the first step.
• Clear governance must be established by defining leadership roles and responsibilities.
• A national CSIRT should be viewed as a strategic asset rather than merely a technical team.
• Regional cooperation is vital, as partnerships strengthen collective defense.
• Cybersecurity governance is defined as the strategic and operational framework that an organization establishes to manage risks related to information security and digital technologies. Its purpose is to protect digital assets, ensure business continuity, comply with relevant regulations and standards, and foster a strong security culture.
• The key elements of cybersecurity governance include policies and procedures, defined roles and responsibilities, risk management, regulatory compliance, security culture, oversight and auditing, and incident response.
• Cybersecurity governance can be achieved through standards or reference frameworks, which provide a structured and proven approach for developing policies, procedures, and controls aimed at ensuring the confidentiality, integrity, and availability of organizational information systems and data.

LAC4 remains committed to supporting its members in building and strengthening their capacity to implement effective cybersecurity governance frameworks. The 7th LAC4 members-only seminar, attended by 223 stakeholders and policymakers from LAC4 Participant Nations, was specifically designed for cybersecurity professionals and policymakers from member countries, including Antigua and Barbuda, Colombia, the Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Panama, Uruguay, the Bahamas, and members of RedCLARA.

The seminar highlighted the importance of aligning organizational and national governance structures, fostering regional cooperation, and translating policy into practical measures to ensure digital security, institutional resilience, and operational continuity across critical sectors.

Next LAC4 members-only seminar will take place in December 2025.