The Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) is developing a cybersecurity framework to protect the country’s critical infrastructure, the systems that keep essential services running.
The project, titled “Development of a Cybersecurity Framework for Critical Infrastructure Protection,” aims to strengthen cybersecurity governance, improve institutional accountability and make the systems underpinning Zimbabwe’s digital economy more resilient, The Herald reported on 15 October.
POTRAZ is developing the framework under the ICT Policy and Regulation Institutional Strengthening (iPRIS) programme. The programme is funded by the European Union, Sweden and Luxembourg and implemented by Stockholm University’s SPIDER centre with the Swedish Post and Telecom Authority and the Luxembourg Regulatory Institute, according to SPIDER. It runs from 2023 to 2028 and covers telecoms regulators in 43 African countries.
POTRAZ took part in the follow-up phase of the eighth iPRIS cohort in Nairobi, Kenya, from 5 to 9 October. African and European representatives reviewed progress on national reform projects launched at the cohort’s first meeting in Sweden in May, TechTrends Kenya reported.
Zimbabwe was represented by Benita Moyo, Tendai Mapaona, Tineyi Mathew Chiwambutsa and Tanyaradzwa Angellah Johnson, the POTRAZ team working on the framework.
Ms Johnson said cybersecurity and privacy safeguards must keep pace as emerging technologies and digital services spread. She said that if services such as healthcare are digitised, measures must be in place to protect sensitive information and preserve people’s privacy.
She also outlined Zimbabwe’s legislative approach, which brings cybercrime definitions and cybersecurity provisions together in one law. Zimbabwe’s Cyber and Data Protection Act [Chapter 12:07], passed in 2021, combines data protection with cybersecurity and cybercrime provisions.
Professor Fredrik Blix, a cybersecurity researcher and lecturer at Stockholm University, said effective protection requires attention to organisational practice and governance as well as technical controls. “Zimbabwe’s draft regulation provides a good example of cybersecurity governance,” he said.
The framework’s focus on governance points to clearer responsibilities and accountability for the organisations that operate critical infrastructure.
Beyond the framework, POTRAZ has stressed that organisations must comply with the Cyber and Data Protection Act, particularly its licensing requirements for data controllers that process personal information. The regulator began mandatory inspections of organisations that process personal data on 1 September, starting with sectors that hold large volumes of sensitive data. TechBytes Africa has set out what inspectors will ask for and how to become a certified Data Protection Officer.
The framework comes during a busy month for cybersecurity in Zimbabwe and abroad. The government is investigating a wave of WhatsApp Business account takeovers, and in France, attackers took control of refrigeration systems in hundreds of supermarkets, an incident TechBytes Africa covered in Hackers turned French supermarket freezers into ovens.
No timeline for finalising the framework was given.
