I see these as things that should be developed in relation to Cyber Security in Sri Lanka, and these can be developed as new trends in our country at present. Also, if these things are not updated, we may have to face big challenges in the future.

**

1. Data Protection and Privacy

**

• Establish regulations for the collection, storage, processing, and sharing of personal and sensitive data.
• Outline principles for obtaining informed consent from individuals for data usage.

**

2. Cybercrime Provisions

**

• Commit cybercrimes such as unauthorized access, hacking, data breaches, identity theft, and cyberbullying. Laws should be tightened for this.
• Define punishments and penalties for various cyber crimes to deter potential offenders. It is wise to introduce new rules. For further study see "Cybersecurity Laws and Regulations England & Wales 2024".

**

3. Critical Infrastructure Protection

**

• Identify critical sectors such as energy, finance, healthcare, and transportation that require enhanced cyber security measures.
• Mandate security assessments, incident reporting, and security protocols for critical infrastructure entities.

**

4. Incident Reporting and Response

**

• Mandate organizations to report cyber security incidents to designated authorities within a specified time frame.
• Establish procedures for incident response, including coordination between public and private sectors.

**

5. National Cyber Security Authority

**

• Create a centralized authority responsible for overseeing cybersecurity initiatives, setting standards, and enforcing cybersecurity laws. I see that Sri Lanka CERT|CC is doing a great job on this.

**

6. Information Sharing and Collaboration

**

• Encourage public-private partnerships for sharing threat intelligence and collaborating on cyber security initiatives.
• Establish mechanisms for information exchange between government agencies, the private sector, and international partners.

**

7. Capacity Building and Awareness

**

• Develop educational programs to raise awareness of cybersecurity risks and best practices among citizens, businesses, and government employees. Currently, it appears that this has not really increased in Sri Lanka.
• Promote research and innovation in cyber security to stay ahead of emerging threats.

**

8. Regulation of emerging technologies

**

• Address the challenges posed by emerging technologies such as AI, IoT, and blockchain in terms of security and privacy. Nowadays, AI is gaining popularity in a new way.
• Set guidelines for the responsible development and use of these technologies.

Legislation: Introduce specific laws targeting cybersecurity and AI crimes. This could include laws defining offenses, penalties, and jurisdiction related to cybercrimes involving AI, such as unauthorized access, data breaches, AI-based fraud, AI manipulation for criminal purposes, etc.

Public Awareness and Education: Implement programs to educate the public, businesses, and law enforcement agencies about cybersecurity threats related to AI and how to prevent, identify, and report such crimes.

**

9. International Collaboration

**

• Ratify and enforce international cyber security conventions and treaties to enhance cooperation on cybercrime prevention and response.

1. Regulatory Compliance and Audits

• Mandate organizations to implement cyber security measures, conduct regular audits, and demonstrate compliance with established standards.

**

11. Penalties and Enforcement

**

• Specify fines, penalties, and sanctions for violations of cyber security laws to ensure accountability.
• Define the role of law enforcement agencies in investigating and prosecuting cybercrimes.

**

12. Judicial Process and Digital Evidence

**

• Outline procedures for gathering and handling digital evidence in cybercrime cases, ensuring admissibility in court.

**

13. Reporting Channels for Vulnerabilities

**

• Encourage responsible disclosure of vulnerabilities by creating mechanisms for reporting vulnerabilities without legal repercussions.

For further study see "Cybersecurity incident reporting laws in the Asia Pacific" - https://link.springer.com/article/10.1365/s43439-023-00088-9