What are the main objectives of the National Cyber Security Policy, 2080? What are the major problems and challenges mentioned in the Policy? Explain.

Nepal's National Cyber Security Policy, 2080 provides a national framework for making information systems and digital services more trustworthy and resilient. Its long-term vision is to build a secure and resilient cyberspace. The policy treats cyber security as a combination of people, processes and technology, supported by legal and institutional arrangements, public awareness and capacity development.

Main objectives of the Policy

The Policy states five principal objectives:

1. Establish legal and institutional frameworks for a secure cyberspace. Nepal needs suitable laws, standards, responsible institutions and coordination mechanisms so that cyber security is governed consistently rather than through isolated actions. This objective supports policy implementation, cyber-crime control, standards, audits and incident response.

2. Protect critical national infrastructure while reducing cyber-attack risk. Essential systems used in government, communications, finance, energy, health, transport and other critical services can create national harm if disrupted or compromised. The objective is to identify such infrastructure, assess risk and strengthen prevention, protection, response, continuity and recovery.

3. Strengthen cyberspace through research and human-resource development. The Policy aims to promote cyber-security research, produce competent specialists and improve the capacity of the existing workforce. Education, training, professional development, cyber drills and cooperation with academic institutions are necessary because technology and attack methods continually change.

4. Make services delivered through digital systems reliable and secure. Citizens and organizations must be able to trust digital public and private services. Security should protect the confidentiality, integrity, availability and authenticity of information while reducing interruption, unauthorized alteration and data loss.

5. Promote bilateral, regional and international coordination, knowledge exchange and assistance. Cyber-attacks cross national borders. Nepal therefore needs information sharing, capacity support, cyber-crime cooperation and participation with other countries and regional or international organizations.

Major problems identified in the Policy

The Policy's problem analysis lists five existing weaknesses:

1. Lack of effective legal provisions and institutional structures: Existing arrangements were not sufficiently comprehensive or coordinated to deal with cyber security as a national, cross-sector responsibility. Gaps in law, standards, roles and enforcement make consistent prevention and response difficult.

2. Insufficient physical and technological infrastructure: Effective cyber security requires secure networks, monitoring facilities, testing capability, incident-response systems, protected data centres and resilient infrastructure. Inadequate or outdated facilities increase exposure and slow detection and recovery.

3. Shortage of skilled human resources and research: Nepal lacks enough trained personnel with current expertise in risk assessment, secure system design, monitoring, digital forensics, incident handling and cyber-crime investigation. Limited research also makes it harder to develop solutions suited to national needs.

4. Low cyber-security awareness: Users and organizations may use weak passwords, ignore updates, trust fraudulent messages, mishandle sensitive data or fail to report incidents. Technology alone cannot protect systems when people do not understand risks and safe behaviour.

5. Weak internal and external coordination: Cyber security involves government bodies, law-enforcement agencies, regulators, critical-infrastructure providers, private companies, educational institutions, civil society and international partners. Poor information sharing or unclear responsibility can delay action and leave gaps between institutions.

Major challenges stated in the Policy

The Policy separately identifies six challenges that must be managed:

1. Creating policy and structural measures that reduce cyber-attack risk: Laws, policies, standards and institutions must remain effective despite rapid technological change and evolving attack techniques. The challenge is not merely writing rules but implementing and updating them across sectors.

2. Developing and using skilled manpower through timely research and capacity building: Specialists take time to educate and retain. Training must remain current, research must address emerging risks, and competent personnel must be placed where they can protect and investigate systems.

3. Identifying and protecting national critical infrastructure: Authorities must determine which systems are critical, understand their dependencies and risks, establish proportionate standards, and maintain continuity without unnecessarily disrupting essential services.

4. Controlling unauthorized access to public, commercial and personal information and data: The expansion of online systems creates more identities, devices and data to protect. Access control, secure development, encryption, monitoring, accountability and privacy safeguards must operate together.

5. Ensuring reliable digital systems and cyber security in citizen services: Digital government and other citizen-facing services must remain available and trustworthy. Security failures can interrupt essential services, expose personal data and reduce public confidence, so resilience and recovery are as important as prevention.

6. Achieving national and international cooperation and coordination: Incidents may involve several agencies, service providers and countries. Timely exchange of technical information and evidence must be reconciled with law, privacy, institutional responsibilities and differing capabilities.

In summary, the Policy's objectives respond directly to its diagnosis: legal and institutional gaps require stronger frameworks; infrastructure risks require protection of critical systems; the skills shortage requires research and capacity development; insecure digital services require reliability measures; and borderless threats require broad cooperation. Successful implementation therefore depends on sustained coordination, competent people, enforceable standards, secure infrastructure and continuous review rather than a one-time technical project.