Nepal's Cybersecurity Regulations

Cybersecurity is the protection of information systems and networks from unauthorized access, use, modification, or destruction. Cybersecurity is essential for ensuring the confidentiality, integrity, and availability of data and services in the digital era. Cybersecurity is also a matter of national security, as cyberattacks can disrupt or damage critical infrastructure, public services, and economic activities.

Nepal is a developing country that is undergoing rapid digitization and adoption of new technologies. Nepal has recognized the importance of building confidence and security in the use of information and communication technologies (ICT) and has formulated various policies and regulations to address the challenges and opportunities of cybersecurity.

According to my search, some of the main policies and regulations that govern cybersecurity in Nepal are:

•  The National Information and Communication Technology (ICT) Policy 2015: This policy defines the key priorities and strategies for the development of ICT in Nepal. It also highlights the need to protect fundamental rights, privacy, and data security of citizens and to enable the investigation and prosecution of cybercrime. The policy also envisages the establishment of a National Cybersecurity Agency (NCSA) to coordinate and implement cybersecurity measures at the national level.

•  The National Cybersecurity Policy 2016: This policy builds upon the ICT Policy 2015 and sets out the goals and objectives for Nepal in maximizing safety and security in relation to the use of ICT. It also outlines the roles and responsibilities of various stakeholders, such as government agencies, private sector, civil society, academia, media, etc. The policy also proposes the development of a National Cybersecurity Strategy (NCS) to operationalize the policy.

•  The Electronic Transactions Act 2063 (2008): This act provides a legal framework to regulate electronic transactions and prevent cybercrime. The act includes provisions for digital signature, intellectual property, electronic records, electronic commerce, etc. The act also defines various cyber offences, such as hacking, unauthorized access, data theft, cyber fraud, cyber harassment, etc. The act also prescribes penalties for cybercriminals and remedies for victims.

•  The Cyber Security Bylaw 2077 (2020): This bylaw is a mandatory cybersecurity regulation for telecommunication service providers (Telcos) and internet service providers (ISPs) to implement security standards and best practices in a systematic way. The bylaw covers various aspects of cybersecurity, such as infrastructure/network security, core system security, application security, data security/privacy, information system audit, cloud security, incident response, security operation center (SOC), cybersecurity awareness and capacity building, etc. The bylaw also empowers the Nepal Telecommunications Authority (NTA) to monitor and enforce compliance with the bylaw.

These policies and regulations aim to create a secure and resilient cyberspace for Nepal that can support its social and economic development. However, there are also some challenges and gaps that need to be addressed to enhance cybersecurity in Nepal. Some of these are:

•  Lack of awareness and capacity: Many users, especially in rural areas, lack awareness and skills on how to use ICT safely and securely. They may fall prey to cyber threats such as phishing, malware, ransomware, identity theft, etc. There is also a need to enhance the capacity of government officials, law enforcement agencies, judiciary, private sector, academia, etc. on cybersecurity issues and best practices.

•  Lack of coordination and collaboration: There are multiple stakeholders involved in cybersecurity in Nepal, such as NTA, NCSA (proposed), Ministry of Communications and Information Technology (MoCIT), Ministry of Home Affairs (MoHA), Nepal Police (NP), Central Investigation Bureau (CIB), Department of Information Technology (DoIT), Computer Emergency Response Team Nepal (npCERT), etc. However, there is a lack of effective coordination and collaboration among them on cybersecurity matters. There is also a need to foster cooperation with regional and international partners on cybersecurity issues.

•  Lack of resources and infrastructure: Nepal faces resource constraints in terms of human resources, financial resources, and technical resources to implement cybersecurity measures effectively. There is also a need to upgrade the infrastructure and technology to cope with the increasing cyber threats
and challenges.

To overcome these challenges and gaps, Nepal needs to take the following steps:

•  Implement the existing policies and regulations on cybersecurity in a timely and effective manner. 
•  Develop and adopt the National Cybersecurity Strategy (NCS) to provide a clear vision, mission, and action plan for cybersecurity in Nepal.
•  Strengthen the institutional and legal framework for cybersecurity, including establishing the National Cybersecurity Agency (NCSA) as a central authority for cybersecurity.
•  Enhance the awareness and capacity building of all stakeholders on cybersecurity issues and best practices, including conducting regular training, workshops, campaigns, etc.
•  Promote the coordination and collaboration among all stakeholders on cybersecurity matters, including establishing a mechanism for information sharing, incident reporting, and response.
•  Foster the cooperation and partnership with regional and international actors on cybersecurity issues, including participating in relevant forums, initiatives, and agreements.
•  Mobilize the necessary resources and infrastructure for cybersecurity, including allocating adequate budget, staff, and equipment; and upgrading the technology and systems.