Protecting Armenia’s critical information infrastructure requires more than technical solutions. It also depends on clearly defined institutional responsibilities, effective public-private cooperation and continuous monitoring of cyber risks. These issues were explored during the ArmIGF 2026 thematic session entitled “Critical Information Infrastructure: From Cybersecurity to National Resilience.”
The session was moderated by Kristina Hakobyan, Board Vice Chair of the Internet Society NGO and Secretary of the Interagency Working Group on the Armenian Internet Governance Forum. The discussion brought together representatives of the Ministry of High-Tech Industry and Artificial Intelligence of the Republic of Armenia, the Information Systems Agency of Armenia, the Public Services Regulatory Commission, Team Telecom Armenia and the International Monetary Fund.
Hayk Voskanian, representing the Ministry of High-Tech Industry and Artificial Intelligence, outlined the key provisions of Armenia’s Cybersecurity Law, adopted in December 2025 and entering into force in 2026. The law establishes the overall framework for protecting critical information infrastructure and defining the responsibilities of relevant institutions. During peacetime, the Information Systems Agency of Armenia is responsible for monitoring critical information infrastructure and responding to incidents, while these functions are transferred to the Ministry in emergency and wartime situations. He also highlighted the need to establish clear criteria for identifying systems that qualify as critical information infrastructure.
Voskanian also presented approaches to establishing a cyber incident observatory, drawing on Japan’s experience. Such observatories can use AI to register and monitor major cyber incidents, facilitating information sharing and enabling faster responses. He stressed that international cooperation is essential in addressing cyber threats, as no country can tackle all cybersecurity challenges independently.
Shant Kasardjian from the Information Systems Agency of Armenia noted that the Agency is working to develop risk profiles for individual organisations by identifying their dependencies on operators, service providers and other systems. He also emphasised the importance of backup solutions, alternative Internet connections, regular testing of these arrangements and ensuring service continuity. Security must be integrated into systems from the design and implementation stages, rather than addressed only after a disruption occurs.
Armen Hunanyan, Head of the Telecommunications Department at the Public Services Regulatory Commission, highlighted the importance of cooperation between the public and private sectors. He noted that while the adoption of the Cybersecurity Law represents an important step, its effective implementation will depend on the development of secondary legislation, clear allocation of institutional responsibilities and practical enforcement. He also emphasised that regulatory measures should primarily focus on prevention, helping operators strengthen their preparedness and ensure the continuity of services.
The discussion also examined the time required to detect cyber incidents and contain their consequences. Referring to international experience, participants highlighted findings from IBM’s annual Cost of a Data Breach Report. According to the figures presented, the average time required to identify a data breach was 194 days in 2024, with a further 64 days needed to contain it. In 2025, these figures decreased to 181 and 60 days, respectively.
Strengthening the professional skills of cybersecurity specialists and improving the capacities of public sector employees were also among the key topics. According to the information presented, the Government’s programme envisages improving cybersecurity awareness among the general public and public sector employees over the next six years. Practical cybersecurity exercises, including Capture the Flag (CTF) training activities, are planned for 2027–2031. Furthermore, two national cybersecurity exercises are envisaged annually, covering different critical infrastructure sectors, from energy and transport to government systems.
Komitas Stepanyan, a cybersecurity expert at the International Monetary Fund, emphasised the importance of introducing cybersecurity education at an early age. He noted that basic digital security knowledge should become an integral part of the education system, while accessible and practical training programmes should continue to support the development of professional cybersecurity skills.
Concluding the discussion, Hayk Voskanian also addressed the safe use of AI in government institutions and organisations operating critical information infrastructure. He noted that guidelines are expected to be developed within the coming year to clarify the appropriate and inappropriate uses of AI tools. As a longer-term initiative, he also presented the concept of a centrally managed AI environment for the public sector, which would ensure the traceability of AI applications and enable responses to be generated using government information databases.
Ultimately, the resilience of critical information infrastructure depends not only on the availability of appropriate legislation and technologies, but also on their effective implementation, clearly assigned responsibilities and coordinated action among all relevant institutions.
