Kosovo—Critical Infrastructure Resilience (CIR) Activity

In early 2023, the Government of Kosovo passed the Law on Cybersecurity and the National Cybersecurity Strategy and Action Plan in quick succession. Since then, the U.S. Agency for International Development has been playing a pivotal role in advancing these developments. The DAI-led USAID Critical Infrastructure Digitalization and Resilience (CIDR) program facilitates the Critical Infrastructure Cybersecurity Working Group—Kosovo’s first platform for a wide range of cybersecurity for critical infrastructure stakeholders—which contributed directly to the passage of the Law on Cybersecurity. Through CIDR, USAID is also helping design Kosovo’s first-ever Cybersecurity Agency, with a mandate to propose, implement, and oversee cybersecurity measures in Kosovo.

While the Law on Cybersecurity is a key first step, Kosovo requires additional support to create and implement a comprehensive legal and regulatory framework for cybersecurity critical infrastructure aligned with European Union directives. As critical infrastructure sectors rapidly digitalize, key sectoral mechanisms, such as sectoral Computer Emergency Response Teams, are underdeveloped.

To fill the gap, USAID designed the Critical Infrastructure Resilience (CIR) Activity to improve cyber governance and build capacity in the Government of Kosovo and among critical infrastructure operators to plan for, respond to, and recover from cyberattacks. It will focus on the e-government, telecommunications, and energy sectors.

CIR has three objectives:

• Governance: Strengthening cybersecurity governance for—and institutional coordination with—critical infrastructure operators and oversight bodies.
• Capacity building: Building short- and long-term technical and human capacity to plan for, respond to, and recover from cyber incidents.
• Technology and procurement: Supporting the identification, prioritization, and procurement of cybersecurity technology solutions.

Sample Activities

• Establish CSA in accordance with the new laws.
• Provide demand-driven assistance to the government to strengthen Kosovo’s cybersecurity critical infrastructure policy and legislative framework.
• Bolster the competitiveness of cybersecurity private sector firms.
• Improve the ability of the relevant government stakeholders and operators’ evolving technical needs.
• Enhance the government institutions’ and critical network operators’ ability to procure work, supplies, or services from suppliers in alignment with cybersecurity, CI, and national security best practices.
• Pilot public awareness campaigns about critical infrastructure protection, cyber threats, and vulnerabilities.