Sri Lanka’s Cyber Security Bill: A Unified National Response to Illegal Operations

The landscape of illegal cyber operations has evolved from isolated criminal acts into a complex domain of state-sponsored espionage, large-scale financial disruption, and systemic threats to national sovereignty. For a nation like Sri Lanka, the transition toward a unified national response is not merely a technical upgrade but a fundamental shift in legal and regulatory philosophy. The current fragmented approach, where individual sectors like banking or telecommunications manage their own security protocols, has proven insufficient against sophisticated actors who exploit the gaps between these silos. By centralizing authority under a National Cyber Security Agency (NCSA), the government aims to create a cohesive shield that integrates intelligence, defense, and legal enforcement.

This development is anchored in the long-awaited Cyber Security Bill, which seeks to replace or augment the aging Computer Crimes Act No. 24 of 2007. The 2007 Act, while pioneering at the time, was designed for an era before the ubiquity of cloud computing, IoT, and advanced persistent threats (APTs). The new regulatory framework introduces the concept of Critical Information Infrastructure (CII), identifying sectors such as energy, healthcare, and finance as vital to national security. Under the proposed law, operators of CII will be subject to mandatory security audits, rigorous incident reporting requirements, and minimum-security standards. This mirrors international trends seen in the European Union’s NIS2 Directive and the United States’ National Cybersecurity Strategy, signaling Sri Lanka’s intent to align with global norms.

“

By centralizing authority under a National Cyber Security Agency (NCSA), the government aims to create a cohesive shield that integrates intelligence, defense, and legal enforcement.

From a RegTech perspective, this shift creates a significant compliance burden but also a massive opportunity. Financial institutions and government contractors will need to invest in automated compliance monitoring and real-time threat detection systems to meet the NCSA’s reporting windows. The legal implications are equally profound; the bill clarifies the state’s power to intervene during a 'cyber security emergency,' a provision that has sparked debate among civil society groups regarding the balance between national security and digital privacy. Legal experts are closely watching how the NCSA will handle data sovereignty and the cross-border nature of cybercrime, especially given Sri Lanka’s status as a signatory to the Budapest Convention on Cybercrime.