Protecting Armenia’s critical information infrastructure requires more than technical solutions. It also depends on clearly defined institutional responsibilities, effective public-private cooperation and continuous monitoring of cyber risks. These issues were explored during the ArmIGF 2026 thematic session entitled “Critical Information Infrastructure: From Cybersecurity to National Resilience.”
The session was moderated by Kristina Hakobyan, Board Vice Chair of the Internet Society NGO and Secretary of the Interagency Working Group on the Armenian Internet Governance Forum. The discussion brought together representatives of the Ministry of High-Tech Industry and Artificial Intelligence of the Republic of Armenia, the Information Systems Agency of Armenia, the Public Services Regulatory Commission, Team Telecom Armenia and the International Monetary Fund.
Hayk Voskanian, representing the Ministry of High-Tech Industry and Artificial Intelligence, outlined the key provisions of Armenia’s Cybersecurity Law, adopted in December 2025 and entering into force in 2026. The law establishes the overall framework for protecting critical information infrastructure and defining the responsibilities of relevant institutions. During peacetime, the Information Systems Agency of Armenia is responsible for monitoring critical information infrastructure and responding to incidents, while these functions are transferred to the Ministry in emergency and wartime situations. He also highlighted the need to establish clear criteria for identifying systems that qualify as critical information infrastructure.
Voskanian also presented approaches to establishing a cyber incident observatory, drawing on Japan’s experience. Such observatories can use AI to register and monitor major cyber incidents, facilitating information sharing and enabling faster responses. He stressed that international cooperation is essential in addressing cyber threats, as no country can tackle all cybersecurity challenges independently.
Shant Kasardjian from the Information Systems Agency of Armenia noted that the Agency is working to develop risk profiles for individual organisations by identifying their dependencies on operators, service providers and other systems. He also emphasised the importance of backup solutions, alternative Internet connections, regular testing of these arrangements and ensuring service continuity. Security must be integrated into systems from the design and implementation stages, rather than addressed only after a disruption occurs.
Armen Hunanyan, Head of the Telecommunications Department at the Public Services Regulatory Commission, highlighted the importance of cooperation between the public and private sectors. He noted that while the adoption of the Cybersecurity Law represents an important step, its effective implementation will depend on the development of secondary legislation, clear allocation of institutional responsibilities and practical enforcement. He also emphasised that regulatory measures should primarily focus on prevention, helping operators strengthen their preparedness and ensure the continuity of services.
