Nepal’s Cybersecurity Landscape: A Comprehensive Evaluation of Existing Policies, Challenges, and Strategic Recommendations

1. Introduction and Context

1.1 Overview of Nepal’s Current Cybersecurity Landscape

Nepal’s rapid shift toward digitalization, evidenced by the growing use of e-governance systems, mobile banking, and online platforms, has outpaced the development of its cybersecurity infrastructure and policies [1]. This imbalance has exposed government institutions, private organizations, and citizens to escalating cyber threats. The present cybersecurity landscape in Nepal can be summarized by several critical factors:

A. Recurring Data Breaches and Minimal Accountability:

A string of high-profile breaches underscores the vulnerability of Nepal’s digital environment. Most recently, the personal information of 7,400 students from the Institute of Engineering (IOE) was put up for sale on the dark web, leaking names, addresses, dates of birth, and phone numbers [2]. Earlier incidents include:

2017: Department of Passport hacked; NIC Asia Bank breach attempted to transfer USD 4.4 million via the SWIFT system [3], [4].
2019: Foodmandu breach affecting 50,000 users [5].
2020: Vianet exposed data of 160,000 customers; Tribhuvan University saw 406 faculty members’ data leaked; Nepal Electronic Payment System (NEPS) hack led to unauthorized ATM withdrawals [6], [7], [8].
2023: Source code of Nepal Rastra Bank offered for sale on the dark web [9].
2025: Ministry of Federal Affairs compromised by “Funksec” [10].

In regions with strict data protection laws, such as under the General Data Protection Regulation (GDPR) in the European Union, breaches of this magnitude would trigger immediate legal obligations, significant financial penalties, and robust public notification [2], [11]. By contrast, enforcement in Nepal remains limited, leaving affected citizens with few remedies or assurances.

B. Limited Resources:

Many public and private institutions in Nepal operate with constrained budgets, hampering the acquisition of essential cybersecurity tools and the recruitment of skilled professionals [12]. SMEs, in particular, struggle to allocate funds for modern security systems or specialized training, resulting in persistently high vulnerability levels.

C. Low Awareness:

While internet and mobile penetration have surged supported by expanding telecom coverage, basic cybersecurity literacy remains low among citizens [1]. Phishing scams, identity theft, and social engineering attacks thrive when users lack familiarity with safe online practices, such as verifying suspicious links and employing strong password policies.

D. Inadequate Infrastructure:

Nepal’s ICT backbone, including broadband networks and data centers, is still evolving. Many organizations rely on legacy systems that are rarely updated or patched. Public Wi-Fi hotspots and e-service portals, though promising for digital inclusion, often lack adequate security configurations, amplifying the risk of cyberattacks [1].

E. Skill Gaps:

There is a pronounced shortage of trained cybersecurity experts, limiting Nepal’s ability to mount effective defense, detection, and response measures [12]. Although some academic and private institutions have introduced cybersecurity courses, the demand for qualified professionals far exceeds the current supply.

F. Fragmented Policy Environment:

Nepal has enacted initial legal instruments such as the Electronic Transactions Act (2006) and the Cyber Security Byelaw (2077) but these measures lack the comprehensiveness and enforcement rigor seen in more developed jurisdictions [11], [13]. There is no standardized breach reporting protocol, and data protection regulations remain underdeveloped, leaving private and public entities to navigate uneven or outdated guidelines.

G. Government Response and Challenges:

Government handling of breaches has often been reactive and ad hoc. Investigations typically occur only after public reporting, and systematic follow-up legal action, thorough audits, or mandatory public disclosure is not consistent [4], [9]. A more robust and transparent process, featuring inter-agency cooperation and timely public communication, would align Nepal’s approach with global best practices.

H. Impact on Public Trust and Economic Growth:

Repeated cyber incidents with minimal regulatory response erode public confidence in digital platforms. This environment not only discourages foreign investment in Nepal’s tech sector but also slows the adoption of e-commerce and other digital services. As data becomes an increasingly critical resource, Nepal’s lack of strong cyber protections poses economic and reputational risks.

In sum, Nepal’s cybersecurity posture reveals an environment where rapid digital adoption collides with limited technical resources, outdated infrastructure, and weak regulation. The rising frequency of data breaches, often with minimal legal recourse, reinforces the urgent need for a coherent and enforceable cybersecurity framework. Addressing these gaps will require bolstering technological safeguards, implementing stronger legal provisions, and elevating cybersecurity awareness, ensuring a safer digital future for all citizens.

1.2 Key Policy Instruments and Cybersecurity Initiatives

Nepal’s cybersecurity landscape, described in Section 1.1, rests on a series of policy measures, legal frameworks, and institutional efforts. While these initiatives represent important steps toward a safer digital environment, several gaps remain especially when measured against evolving best practices in digital identity and privacy.

A. National Cybersecurity Policy (Draft) and Cyber Security Byelaw (2077)

Nepal has a draft National Cybersecurity Policy, supplemented by the Cyber Security Byelaw (2077), which provides a set of technical guidelines for ICT infrastructure security [11]. These frameworks aim to address data protection, incident response, and critical infrastructure defense.

However, implementation gaps persist. For instance, while the Byelaw mandates routine audits and prescribes penalties for violations, regulators often lack the necessary technical resources or trained professionals to enforce compliance [12]. Moreover, the frameworks do not yet fully reflect the “minimal disclosure” or “directed identity” principles emphasized in Learning Digital Identity, which could lower the risk of large-scale data breaches by limiting the overcollection of user data [13].

B. NTA’s Cyber Security Public Advisory

The Nepal Telecommunications Authority (NTA) issues periodic advisories on phishing, malware, Wi-Fi safety, and password hygiene, partially aligning with the “human integration” theme in Learning Digital Identity [13]. These guidelines underscore the need for user education to reduce social engineering attacks.

Nonetheless, public awareness campaigns are sporadic and often poorly funded. This shortfall hinders the effective dissemination of best practices, such as using multifactor authentication (MFA) or adopting cryptographic identifiers for online transactions. According to the “pluralism of operators and technologies” principle [13], an effective awareness program would empower users and organizations to choose from a range of secure identity solutions without relying solely on administrative logins.

C. Electronic Transactions Act (2006) and Ancillary Legislation

The Electronic Transactions Act (ETA) remains a core legal instrument governing electronic contracts, digital signatures, and limited cybercrime provisions [11]. Despite its foundational role, the ETA lacks clarity on emerging threats like AI-driven fraud, large-scale identity correlation, and data brokerage abuses.

Learning Digital Identity points out that a fundamental challenge in digital identity is bridging autonomy and consent [13]. Updating the ETA to explicitly define how consent must be obtained, along with adopting user-friendly mechanisms for attribute sharing, could align Nepali law with global privacy standards such as the EU’s GDPR [2].

D. National Computer Emergency Response Team (NepCERT) Initiatives

The government has signaled intent to strengthen the national CERT or create a more robust NepCERT tasked with real-time threat intelligence, incident handling, and advisory issuance. If resourced properly, NepCERT could mitigate phishing and ransomware risks by coordinating with ISPs and major public institutions.

Realizing a future-proof cyber defense also depends on adopting identity metasystem principles, i.e., establishing encapsulating protocols and consistent user experiences to prevent repeated credential compromise [13]. Current CERT proposals seldom address identity design systematically, risking persistent vulnerabilities in user authentication flows.

E. Public-Private Collaborations

Nepal’s banks, telecom operators, and fintech startups occasionally partner for cybersecurity exercises or joint training, signifying a small but growing recognition of the need for multi-stakeholder approaches.

In practice, these collaborations tend to be narrowly scoped and centered on operational concerns rather than a holistic identity framework. A broader approach, integrating the “seven laws of identity” [13], would encourage minimal data retention, robust encryption protocols, and genuine user control of data sharing.

F. Alignment with Global and Regional Benchmarks

While Nepal has participated in regional forums (e.g., SAARC) and UN-led programs for cybersecurity capacity building, consistent alignment with global identity standards remains a work in progress. Implementing decentralized identity protocols (as recommended in Learning Digital Identity) could reduce duplication across government services and avert privacy disasters by allowing ephemeral relationships where only necessary data is shared [13].

Comparisons to frameworks like Estonia’s e-Residency or India’s Aadhaar system often overlook the complexities of local infrastructure, cultural attitudes to privacy, and trust in governance. Maintaining context-appropriate digital identity solutions is crucial to ensuring effective adoption and reducing the risk of misuse.

1.3 Emerging Trends and Practical Gaps

Building on the policy frameworks and ongoing initiatives described in the previous sections, Nepal faces a dual imperative: consolidate and enforce existing measures while embracing next-generation solutions for identity, privacy, and security. Several factors point to areas of considerable opportunity and risk:

A. Rise of Digital Services and Fintech

Nepal’s escalating embrace of mobile banking, peer-to-peer payments, and digital wallets has produced a vibrant fintech ecosystem. Yet security concerns, particularly around unauthorized transactions and identity theft, persist.

According to Learning Digital Identity, robust fintech growth requires user-centric or self-sovereign identity constructs [13]. Such architecture enables minimal data disclosure for routine payments and ephemeral relationships for one-off transactions, dramatically reducing breach scope if a payment processor is compromised.

Heightened Threats to Critical Infrastructure

Sectors like energy, banking, transportation, and telecom are prime targets for ransomware and denial of service attacks. While some critical infrastructure providers have begun adopting more advanced encryption and access controls, the vulnerability of older legacy systems remains high [14].

Embedding verifiable credential mechanisms (as recommended in Learning Digital Identity) can enhance both employee authentication and supply chain integrity for critical sectors [13]. This approach ensures that only properly credentialed vendors or employees can, for example, modify control settings in a power substation.

B. Cloud Adoption and Remote Work

Accelerated by the pandemic and cost advantages, organizations in Nepal are moving core operations to cloud services or hybrid environments. Without multifactor authentication or consistent identity governance across these environments, the attack surface widens, fueling unauthorized access incidents.

By leveraging cryptographic identifiers and consistent user experiences, two pillars of a user-centered identity metasystem organizations can unify how employees log in across premise and cloud-based apps [13]. This not only improves security but also streamlines compliance checks.

Data Localization Versus Cross-Border Integration

Discussions around data localization and sovereignty have taken center stage, especially as more Nepali enterprises store data abroad. Governments worldwide increasingly favor local data residency rules for sensitive information. While such provisions may enhance oversight, they also complicate cross-border collaboration [1], [14].

Strong policy alignment, along with a decentralized, privacy-respecting identity framework, can allow data sharing in under-regulated contexts without forcing providers to choose between global interoperability and national compliance. Citing Learning Digital Identity, adopting directed identity and structured consent ensures minimal, context-specific data exchange [13].

c. Cultural and Behavioral Barriers

Low cybersecurity literacy, limited trust in institutions, and a preference for in-person processes still hold back the adoption of advanced digital identity systems. Many local businesses prioritize short-term revenue over secure designs, seeing security features as extra costs rather than strategic investments.

A more risk-aware culture fostered by government outreach, private sector leadership, and community-driven initiatives can bridge this gap. Educational campaigns about smart identity agents and secure authentication flows can empower individuals to safeguard personal data, consistent with the “human integration” principle in Learning Digital Identity [13].

1.4 Practical Next Steps and Recommendations

Nepal’s legal instruments, capacity-building efforts, and emerging digital economy underscore the need for immediate, targeted actions to secure the nation’s cyberspace. While Sections 1.1 to 1.3 highlighted the overall landscape, key policy instruments, and emerging trends, the following recommendations aim to translate broad objectives into actionable measures:

A. Enhance Enforcement and Governance Mechanisms

Streamline Regulatory Oversight:

Establish a clear chain of command among the Ministry of Communication and Information Technology (MoCIT), Nepal Telecommunications Authority (NTA), and any future National Cybersecurity Council to avoid jurisdictional overlaps.

Mandatory Breach Notification:

Institute a legal obligation for organizations to report cybersecurity breaches within a defined timeframe, along with minimum thresholds for disclosure. This will foster accountability and early incident containment [2], [11].

B. Incorporate Digital Identity Metasystem Principles

Adopt “Minimal Disclosure” and “Directed Identity” Approaches:

Encourage public and private services to store only essential user data and utilize context-specific identifiers. By doing so, the scope of potential data breaches is naturally reduced [13].

User-Centric Identity Pilots:

Initiate pilot projects perhaps starting with local government services that test cryptographic identifiers or self-sovereign identity (SSI) models for routine administrative tasks. An early success in areas like property records or birth registration could build momentum for broader adoption.

C. Capacity Building and Training

Targeted Certification Programs:

Develop specialized curriculums in partnership with universities, focusing on digital identity design, encryption, and incident response. Government scholarships or subsidies can bolster participation, thereby addressing the acute shortage of cybersecurity professionals [12].

Culture of Security and Privacy:

Employ nationwide awareness campaigns on topics like password management, phishing recognition, and safe digital transaction practices. Tie these to concrete incentives, such as discounted government services for users who adopt multifactor authentication.

D. Risk-Based Identity Solutions for Critical Sectors

Federated Identity for Financial Institutions:

Enable banks to adopt a standardized, secure login across multiple channels, web, mobile, and ATM networks coordinating with the central bank’s guidelines. This can reduce login friction for consumers and unify threat intelligence across institutions.

Adaptive Access Controls:

For high-risk operations (e.g., controlling power grids or issuing large government payments), deploying verifiable credentials that can restrict privileges based on time, location, or the presence of cryptographic proofs [13]. These solutions limit damage from stolen or misused credentials.

E. International Collaboration and Knowledge Exchange

Regional Cybersecurity Agreements:

Engage with SAARC and similar bodies to exchange threat intelligence, share best practices, and develop consistent standards for digital identity management, especially for cross-border financial transactions.

Technical Partnerships:

Collaborate with global tech hubs, open-source communities, and academic alliances (e.g., Internet Identity Workshop forums) to stay updated on emerging protocols and to co-develop pilot projects demonstrating robust, user-friendly identity meta systems [13].

F. Long-Term Regulatory Evolution

Refine the Electronic Transactions Act (ETA):

Update definitions around consent, data portability, and secure digital signatures. Incorporate explicit mandates for encryption standards, privacy impact assessments, and user recourse avenues (i.e. how users can challenge the misuse of their data).

Draft a Comprehensive Data Protection Framework:

Modeled in part on international norms (e.g., GDPR), it should recognize varying degrees of risk in data collection and enable fluid, multi-pseudonymous interactions that safeguard personal liberties [13].

1.5 Conclusion and Strategic Outlook

Nepal’s cybersecurity ecosystem is best characterized as a rapidly evolving domain where policy, technology, and social awareness must converge to address escalating threats. Sections 1.1 through 1.4 have revealed how fragmented legal frameworks, legacy infrastructure, finite resources, and uneven public understanding contribute to Nepal’s vulnerability to data breaches and malicious cyber activity. Yet they also highlighted several promising paths forward:

A. Strong Foundations in Policy and Institutions

Instruments like the Electronic Transactions Act (ETA), the Cyber Security Byelaw (2077), and the draft National Cybersecurity Policy reflect the government’s willingness to legislate and regulate.

Agencies such as the Nepal Telecommunications Authority (NTA) and the nascent NepCERT offer operational anchors for incident response and advisory issuance.

B. Gaps Highlighting the Need for Modern Digital Identity

Conventional administrative identity systems usernames, passwords, and uniform ID numbers are ill-suited to address the complexities of real-world interactions, as outlined in Learning Digital Identity [13].

Nepal’s reliance on multiple, redundant databases invites privacy risks and complicated credential management, hinting at the necessity for a secure, user-friendly identity metasystem that unifies stakeholder efforts.

C. Emerging Opportunities for Transformation

Fintech, cloud adoption, and e-governance expansions can serve as catalysts for adopting cryptographic identifiers, consistent user experiences, and other advanced features drawn from the “seven laws of identity” [13].

Practical strategies like minimal disclosure, ephemeral relationships where warranted, and robust access controls for critical infrastructure can lower both the likelihood and impact of cyberattacks.

D. Balancing Privacy, Security, and User Autonomy

While organizations understandably emphasize security, they must not ignore user consent and data minimization. Embedding encryption and multi-factor authentication from the ground up curtails threats yet respects personal autonomy.

Broader public awareness and risk-aware culture can emerge from well-funded outreach, consistent training programs, and tangible incentives (e.g., cheaper government services for secure logins).

E. Strategic Alignment for Sustainable Impact

Short term:

Strict enforcement of existing byelaws, mandatory breach reporting, and incident simulations bolster immediate defenses.

Medium-term:

Government-led or consortium-based identity pilots, forging public-private partnerships to adopt verifiable credentials in banking, local e-services, or property registration, help normalize advanced identity protocols.

Long term:

A robust, decentralized, and user-centric identity layer backed by updated legislation positions Nepal to thrive in an era defined by cross-border digital interactions, the Internet of Things, and AI-driven service delivery.

Ultimately, trust remains the cornerstone of any digital ecosystem. By merging the principles championed in Learning Digital Identity notably user control, contextual integrity, and modular identity architectures with rigorous policy enforcement, Nepal can reduce the “attack surface” of its digital domain. A cohesive cybersecurity posture ensures that citizens, businesses, and government agencies alike can harness the full benefits of digital transformation without sacrificing security or privacy.

Chapter 2: Key Observations from Core Documents

2.1 Observations from National Cyber Security Policy 2080

A. Fragmented Policy Statements

The National Cybersecurity Policy 2080 (Draft) contains general guidelines on risk assessment, capacity building, and stakeholder collaboration. However, many sections remain incomplete or vague in scope, limiting clarity around enforcement mechanisms.

Coordination among government, private sector, and academia is mentioned but not systematically mapped out echoing the need for pluralistic models of participation advocated in Learning Digital Identity [13].

B. Limited Integration of Modern Identity Approaches

While the draft mentions the necessity of secure authentication and access control, it stops short of explicitly referencing cryptographic identifiers or decentralized identity protocols, which could help mitigate the “proximity” and “autonomy” problems identified earlier [13].

Emphasis on local data centers is a positive sign for data sovereignty, yet the draft policy does not fully explore how user-centric identity can work in synergy with local infrastructure to reduce overcollection and protect privacy.

C. Potential Areas of Alignment with Existing Laws

The policy references the Electronic Transactions Act (2006) and the Cyber Security Byelaw (2077) as cornerstone legislation. However, the lack of cohesive cross-referencing indicates a need for more robust bridging articles or sub-regulations to ensure that new policy initiatives do not contradict existing regulations [11].

A comprehensive identity metasystem could seamlessly integrate with the national CERT structure to enhance incident reporting for identity-related breaches—a synergy point left untouched by the policy’s current draft.

2.2 Observations from NTA’s Cyber Security Public Advisory

A. Wide Range of Practical Guidance

The Cyber Security Public Advisory released by the Nepal Telecommunications Authority (NTA) covers topics such as phishing awareness, Wi-Fi security, password best practices, mobile device security, and physical security of hardware. This broad thematic scope underscores NTA’s attempt to raise baseline cyber hygiene [1].

The lack of a unifying user experience remains evident. Users must navigate separate checklists and security tips, which can be cumbersome running contrary to the “consistent experience across contexts” principle in Learning Digital Identity [13].

B. Focused on Individuals, Less on Organizational Strategy

Much of the advisory speaks directly to end users, offering tips on safe internet usage, e.g., verifying suspicious links, avoiding public Wi-Fi for sensitive transactions, or adopting strong passwords.

Relatively limited space is devoted to enterprise-level practices, such as implementing single sign-on (SSO) or adopting “least privilege” role-based access controls. Encouraging organizations to standardize identity management could significantly reduce credential-related attacks.

c. Opportunity to Incorporate SSI Concepts

Several guidelines implicitly favor minimal data sharing (e.g., not reusing passwords and limiting personal details in social engineering calls). This resonates with the “minimal disclosure” principle, a hallmark of modern identity frameworks [13].

The advisory could evolve by promoting short-lived (ephemeral) credentials for basic verifications or by highlighting verifiable credentials for secure logins, thus turning high-level advice into actionable identity strategies.

2.3 Observations from Other Official and Draft Documents

A. Nepal Cybersecurity Policy Draft

Another draft policy overlaps significantly with the National Cyber Security Policy 2080 but places slightly more emphasis on collaboration with international bodies such as the ITU and SAARC. However, it still lacks an implementation roadmap for identity-proofing or advanced threat detection [14].

The document briefly acknowledges self-sovereign identity (SSI) as an emerging trend, suggesting the authors are aware of decentralized identity. Yet no specific guidelines or pilot programs are outlined.

B. Cyber Security Byelaw (2077)

Already cited in Chapter 1 (Section 1.2), this Byelaw contains prescriptive measures for annual security audits, firewall configurations, and other technical standards essential building blocks for secure hosting environments [11].

However, the Byelaw does not extensively address role-based access control (RBAC), attribute-based access control (ABAC), or verifiable credential architectures key practices for ensuring context-driven identity utility. Aligning these approaches with Byelaw provisions could help standardize identity solutions across ISPs, banks, and government agencies.

c. Internal Government Memos and Unofficial Guidance

Some agencies have circulated internal memos urging staff to adopt multi-factor authentication or restrict social media usage on official devices. While helpful, these measures are often ad hoc and inconsistent across different institutions.

Formalizing these guidelines into a unified, cross-department identity management policy could unify fragmentation, reduce duplication, and align operational protocols with modern identity metasystem concepts [13].

2.4 Common Challenges and Areas for Further Focus

A. Enforcement Gaps:

Most documents recommend rigorous security practices but lack well-defined compliance metrics.

B. Identity Silos:

Policies often address identity from a single organization perspective, inhibiting a multi-operator identity ecosystem that fosters interoperability.

C. User Centric Design:

Although some guidelines reference user-friendly security, few concrete steps are outlined for “directed identity” or ephemeral relationships that would give users more control.

D. Evolving Threats:

None of the reviewed documents provide robust frameworks for handling emerging attacks (e.g., deepfakes, advanced AI-enabled threats) in identity verification.

Chapter 3: Challenges for Poor and Developing Countries

Poor and developing countries, including Nepal, grapple with unique obstacles that hinder the establishment and maintenance of effective cybersecurity infrastructures. While wealthier nations can swiftly adopt advanced security tools and identity metasystems, countries with limited budgets and institutional capacity must devise adaptive approaches that prioritize practicality, affordability, and gradual scaling.

3.1 Limited Resources

A. Budget Constraints
Government agencies and private enterprises in developing countries often operate on tight budgets, which restricts the purchase of up-to-date cybersecurity tools, advanced hardware, and robust identity solutions.
This underfunding undermines basic network defenses, identity management practices, and the adoption of cryptographic protocols recommended in Learning Digital Identity [13].

B. Difficulty Sustaining Tools and Services

Even if donor agencies or international NGOs provide initial funds, maintenance costs such as software updates, licensing fees, and security audits often exceed local operating budgets.

Identity metasystems demand continuous investment in cryptographic key management, user experience design, and policy enforcement, all of which require stable funding sources to remain viable.

C. Cost Efficient Innovation

Given these constraints, open-source software and community-driven solutions become essential. Projects like Let’s Encrypt, for instance, can reduce the cost of obtaining and renewing SSL/TLS certificates, an important step for secure, privacy-oriented web identities [9], [13].

Encouraging local entrepreneurship around user-centric identity solutions, possibly through small grants or incubators, can foster more cost-efficient cybersecurity programs aligned with the “pluralism of operators and technologies” principle [13].

3.2 Low Awareness

A. Lack of Cyber Literacy

Many citizens and small business owners in developing regions lack basic cyber hygiene knowledge, such as the importance of strong passwords, phishing detection, or safe device usage.

From an identity perspective, low awareness often leads to repeated use of a single username/password combination across sites and ignoring best practices like multifactor authentication or ephemeral identifiers.

B. Distrust in Digital Services

Historical reliance on in-person transactions makes communities skeptical of online processes, especially when identity verification requires personal details.

This skepticism is magnified when data breaches or privacy scandals occur, creating a vicious cycle that stifles e-services adoption.

C. Policy Driven Campaigns

Government-led or NGO-driven awareness campaigns can effectively educate citizens on the value of minimal disclosure, cryptographic identifiers, and secure e-transactions.

For maximum impact, campaigns should localize content using culturally relevant analogies, offer multiple language options, and incorporate both offline and online outreach.

3.3 Inadequate Infrastructure

A. Unstable Connectivity

Poor internet coverage or inconsistent bandwidth hinders real-time data validation and identity checks. Organizations dependent on online verification face significant downtime in remote areas.

Offline-friendly identity solutions, such as credential presentations relying on locally stored cryptographic proofs, could work without constant connectivity.

B. Legacy Systems

Government databases often use outdated or incompatible software, preventing secure identity attribute exchange and timely updates.

The “interoperability problem” in learning digital identity shows how siloed, obsolete platforms struggle with modern identity systems, especially when lacking native cryptographic support.

C. Urban-Rural Divide

Rural clinics, local schools, and smaller offices often rely on manual processes or spreadsheets, resulting in limited digital integration.

Implementing a layered approach with offline authentication and incremental modernization can help these sectors transition to secure digital systems.

3.4 Skill Gaps

A. Shortage of Trained Professionals

Nepal lacks enough cybersecurity analysts, digital forensics experts, and specialized IT staff, undermining threat monitoring and maintenance of identity systems.

Educating identity architects with knowledge of cryptographic methods like key rotation and zero-knowledge proofs is essential.

B. Brain Drain

Skilled professionals often seek better opportunities abroad due to higher pay and advanced research facilities.

Government incentives or partnerships could foster local centers of excellence to retain talent and build a sustainable pipeline.

C. Training the Trainers

“Train the trainer” programs can scale knowledge by enabling schools, NGOs, and local businesses to deliver basic cybersecurity and identity management courses.

These courses should cover the “laws of identity” and emphasize minimal data collection for privacy and security.

3.5 Regulatory Gaps

A. Incomplete Legal Frameworks

Acts like the Electronic Transactions Act (ETA) and Cyber Security Byelaw (2077) do not fully address emerging threats, leaving accountability gaps.

Major issues like large-scale breaches, cross-border verification, and AI-driven cyberattacks lack legal precedents.

B. Low Visibility and Reporting

With few breach notification requirements, incidents often go unreported—especially small or local ones—limiting data for policymaking.

A universal identity metasystem could centralize reporting, but only if paired with compliance checks at the organizational level.

C. Global Pressures and Local Realities

Adopting frameworks like the EU’s GDPR demands high capacity, which can burden smaller economies. Adaptations should be realistic and phased.

Local advocacy groups push for user autonomy and data protection, encouraging legal standards like “directed identity” and “minimal disclosure.”

3.6 Identity Solutions for Low-Resource Contexts

A. Mobile-Centric Approaches

High mobile penetration means lightweight apps and offline credentials for low-end smartphones can address some infrastructure gaps.

Telecom partnerships for SIM-based security could support key management and credential distribution if done carefully.

B. Community-Driven Projects

Grassroots and NGO efforts can pilot identity solutions—like verifying microfinance eligibility with minimal data or issuing digital diplomas.

These localized pilots reflect the “polymorphic” nature of an identity metasystem and can scale once proven.

C. Self-Sovereign Principles

Self-sovereign identity (SSI) allows users to control their attributes, revealing only necessary data per interaction—important for privacy in low-resource settings.

SSI supports ephemeral, one-time relationships that reduce enrollment friction and limit the attack surface.

3.7 Conclusion

Countries like Nepal, with limited finances, outdated systems, and low cyber awareness, face serious challenges in protecting digital identities. But these same challenges present an opportunity:

User-centric pilots in local communities can demonstrate the value of minimal disclosure and directed identity.

Grassroots training and government-backed certifications can build long-term cybersecurity capacity.

Policy reforms enforcing breach notifications, data protection standards, and cryptographic best practices can restore trust and reduce risks.

By applying principles from Learning Digital Identity—like pluralism of operators, consistent user experience, and human integration—developing countries can align cybersecurity and identity systems. Despite current barriers, smart reforms, user-first design, and cost-effective tech investments can pave the way for resilient digital ecosystems that empower all stakeholders.

Chapter 4: Proposed Cybersecurity Framework

4.1 Awareness and Education

A. Public Awareness Campaigns

Nationwide Engagement: Launch multimedia campaigns—radio, television, community events—to demystify fundamental cyber threats (e.g., phishing, malware) and promote cyber hygiene.

Informed Consent Practices: Teach users about the law of user control and consent so that they understand how their data may be shared and how to grant or revoke permissions effectively.

B. Integration into School Curricula

Early Introduction to Digital Citizenship: Include basic cybersecurity modules in primary and secondary schools, emphasizing minimal disclosure principles and the risks of oversharing online.

Hands-On Labs: In higher education, labs are provided where students can deploy encryption, manage cryptographic keys, and explore user-centric identity prototypes, reflecting the concept of “human integration.”

C. Continuous Training for Government Employees

Role-Based Courses: Tailor training for administrative staff, finance officers, IT specialists, and law enforcement to ensure each understands their specific security responsibilities.

Periodic Refreshers: Update modules annually to reflect evolving threats and identity management techniques such as decentralized ID proofing.

4.2 Policy and Regulation

A. National Cybersecurity Policy (Finalized)

Clear Definition of Roles: Update the National Cyber Security Policy 2080 (Draft) to define authority roles, inter-agency coordination, and enforcement procedures.

Legally Binding Breach Notifications: Introduce mandatory timelines and standard formats for breach disclosures to combat the “visibility problem.”

B. Data Protection and Privacy Laws

Minimal Disclosure Provisions: Embed “minimal disclosure for a constrained use” into law, limiting unnecessary PII collection and storage.

Consent-Driven Data Sharing: Require explicit, revocable consent for data sharing between government bodies and third parties, in line with GDPR-like frameworks.

C. Incident Reporting Mechanisms

Unified National CERT Portal: Mandate a centralized CERT channel for identity-related incidents to streamline triage and threat intelligence sharing.

Greater Accountability: Enforce penalties or corrective action for failure to report incidents, cultivating a transparent reporting culture.

4.3 Infrastructure and Technology

A. Secure Public Wi-Fi and Networks

Encryption Standards: Encourage WPA3 or higher standards for public hotspots, and promote mutual TLS or VPN usage for sensitive access.

Access Controls: Use layered security (e.g., captive portals with ephemeral credentials) to reduce session hijacking and over-collection of data.

B. Open Source and Low-Cost Solutions

Identity Platforms: Adopt open-source platforms supporting decentralized identifiers (DIDs) and verifiable credentials to avoid licensing costs.

Cloud Security: Standardize encryption at rest, secure SSO, and continuous monitoring guidelines for small businesses using cloud services.

C. Encryption and Key Management

Cryptographic Toolkits: Recommend accredited toolkits aligned with international standards to enable the adoption of RSA, ECC, or post-quantum algorithms.

Central Key Repositories: Establish secure, national or sector-specific key management systems to manage, rotate, and distribute credentials securely.

4.4 Capacity Building

A. Cybersecurity Workforce Development

National Scholarships: Offer subsidized programs to train professionals in identity system design, forensics, and incident response.

Partnership with Academia: Motivate universities to expand research and degree offerings in self-sovereign identity, privacy engineering, and cryptography.

B. Community Cybersecurity Volunteers

Local Outreach: Train volunteers to support rural communities, schools, and municipalities in basic cybersecurity practices—acting as digital-first responders.

Peer-Led Models: Empower volunteers to promote the “seven laws of identity” and advocate for minimal data disclosure.

C. Professional Credentials

Certified Identity Architect: Launch a credential focused on identity metasystem design including standards like PKI, OAuth, and OpenID Connect.

Public Recognition: Encourage businesses to sponsor or hire credentialed professionals to uplift overall identity security standards.

4.5 Collaboration and Partnerships

A. Public-Private Collaboration

Sector-Specific Working Groups: Form alliances in healthcare, finance, and e-commerce to align identity-proofing and authentication best practices.

Shared Threat Intelligence: Facilitate real-time information sharing about major fraud attempts and compromised credentials.

B. International Cooperation

Cross-Border Identity Proofing: Sign MOUs with regional partners to address cross-border cybercrime and e-ID interoperability, especially for migrant workers.

Adoption of Emerging Protocols: Leverage technical aid from ITU or the World Bank to pilot user-centric identity systems in public services.

C. NGOs and Civil Society

Watchdog Role: Enable civil society to ensure data protection compliance and advocate for strong user consent practices.

Research and Prototyping: Collaborate with nonprofits and open-source communities to test identity solutions like digital diplomas and microfinance verification.

4.6 Incident Response and Recovery

A. National CERT (NepCERT) Integration

Centralized Coordination: Designate NepCERT as the main coordinator for identity breach response, supported by real-time dashboards and intelligence tools.
Routine Cyber Drills: Host annual or semi-annual exercises to simulate identity-based attacks and assess readiness.

B. Disaster Recovery Plans

Identity Backup and Restoration: Promote wallet backup strategies to prevent loss of cryptographic credentials from device failure.

Offline Contingencies: Define fallback protocols (paper-based or minimal digital) to maintain service continuity during outages.

4.7 Monitoring and Evaluation

A. Cybersecurity Metrics

KPIs on Identity Management: Monitor MFA adoption, password reuse, login success rates, cryptographic ID usage, and breach trends across sectors.

Privacy Impact Assessments (PIAs): Regularly evaluate how identity systems uphold consent, minimal disclosure, and directed identity principles.

B. Regular Audits

Third-Party Auditors: Require ISPs, banks, and agencies to undergo annual audits by certified firms, as per Cyber Security Byelaw (2077).

Transparent Reporting: Publish audit summaries with risk analyses, improvements, and examples of leading practices.

C. Adaptive Framework

Continuous Feedback Loop: Incorporate insights from public complaints, NGO reports, and sectoral groups into policy revisions.

Scalable Upgrades: As capabilities grow, progressively adopt new standards like post-quantum cryptography and advanced ZKPs to ensure long-term resilience.

Chapter 5: Implementation Strategy

5.1 Phased Approach

Phase 1 (1–2 Years): Awareness and Basic Protections

Launch Public Awareness Campaigns

Incentivize Basic Cyber Hygiene: Provide discounted mobile data plans or government e-service vouchers for users who activate MFA and attend local cyber awareness events.
Pilot Minimal Disclosure Systems: Initiate small-scale user-centric identity pilots in select government offices (e.g., municipal services), demonstrating ephemeral or domain-specific identifiers to reduce data sprawl.

Establish Foundational Policy and Infrastructure

Finalize National Cybersecurity Policy: Integrate mandatory breach reporting and minimal disclosure mandates (as drafted in Chapter 4).
Secure Public Wi-Fi: Require basic encryption and periodic audits of hotspots in high-traffic areas like airports and universities.

Set Up Core Institutional Coordination

Revamp NepCERT: Form a specialized identity risk unit within NepCERT to handle identity-related incidents.
Cross-Agency Task Force: Create a government-wide forum aligning policy frameworks (Electronic Transactions Act, Cyber Security Byelaw) with user-centric identity guidelines.

Phase 2 (3–5 Years): Infrastructure and Capacity Building

Scale Identity Pilots

National Rollout: Expand proven identity solutions from early pilots to more government services (e.g., driver’s license renewals, social welfare disbursements).
Interoperability Standards: Adopt protocols like OAuth 2.0, OpenID Connect, or verifiable credentials to ensure multiple providers can integrate seamlessly.

Enhance Critical Infrastructure Protection

Advanced Access Controls: Deploy robust IAM solutions across power grids, telecom networks, and banks using ABAC/RBAC models.
Zero Trust Security: Implement micro-segmentation and continuous verification strategies to validate identity context for access.

Workforce Expansion and Skill Gaps

Regional Cybersecurity Hubs: Partner with training centers offering certifications in cryptography, forensics, and identity design.
Community-Driven Programs: Develop local volunteer networks to train smaller towns and bridge urban-rural divides.

Formalize Enforcement and Oversight

Regular Audits: Require ISPs, payment gateways, and critical service providers to undergo annual identity-focused audits with public summaries.
Benchmarks and Penalties: Implement tiered penalties for noncompliance, proportionate to data sensitivity and violation frequency.

Phase 3 (5+ Years): Advanced Protections and International Collaboration

Adopt Decentralized Identity at Scale

SSI Ecosystem: Promote self-sovereign identity (SSI) for citizens using cryptographic credentials for public and private services.
Smart Identity Agents: Integrate mobile wallet agents for local proof storage and ephemeral identity use in transactions.

Strengthening Global and Regional Alliances

Interoperable Cross-Border Systems: Join regional frameworks to validate migrant identities and enable secure e-trade.
Joint CERT Exercises: Collaborate with SAARC or similar groups for cyber readiness drills simulating high-level threats.

Incorporate Emerging Tech

Post-Quantum Readiness: Test quantum-resistant algorithms for digital signatures and key exchange in critical sectors.
AI-Assisted Threat Detection: Use machine learning to detect identity misuse, unusual login behavior, and replay attacks.

Continuous Improvement Cycle

Iterative Policy Refinement: Update laws and standards based on emerging threats and evolving digital behaviors.
Feedback Loops: Engage civil society, academia, and private sectors in regular consultations to maintain policy relevance.

5.2 Resource Allocation

Government Funding

Dedicated Cybersecurity Budget: Allocate a fixed percentage of ICT budgets (e.g., 1–2%) for cybersecurity, identity systems, and training.
Prioritized Spending: Focus funding first on awareness, infrastructure updates, and identity system pilots.

International Aid and Technical Assistance

Donor Engagement: Collaborate with global donors and technical bodies (e.g., World Bank, ITU) to co-fund identity and security solutions.
Sustainability Plans: Ensure all externally funded projects include local capacity-building for longevity.

Public-Private Partnerships

Industry Matching Funds: Incentivize co-sponsorship of training programs or pilots through cost-sharing or tax relief.
Revenue-Generating Models: Explore subscription-based identity services, ensuring minimal disclosure is preserved.

5.3 Monitoring and Feedback

Stakeholder Engagement

Periodic Summits: Host forums involving all stakeholders to review progress, share insights, and raise emerging concerns.
User-Centric Feedback: Deploy portals and apps for citizens to report usability issues or privacy concerns directly.

Metrics and Reporting

KPIs and Dashboards: Track metrics such as breach rates, MFA adoption, credential usage, and AI threat detection success.
Public Reporting: Publish quarterly or annual progress reports, including compliance and audit findings.

Continuous Improvement

Adaptive Framework Updates: Use metrics and feedback to revise cyber regulations and identity system guidelines.
Research and Development: Collaborate with universities to refine user-centric identity systems and advance security innovation.

Chapter 6: Conclusion

6.1 Summary of Key Points

Current Landscape and Key Documents (Chapters 1–2)

Nepal’s cybersecurity is defined by instruments like the ETA and Cyber Security Byelaw, but these remain weak in enforcement and clarity.
National policies highlight the need for strong identity systems to support incident response, privacy, and public trust.

Challenges for Developing Countries (Chapter 3)

Issues such as lack of funding, awareness, and legal coherence worsen cybersecurity vulnerabilities in nations like Nepal.
These gaps align with proximity and autonomy issues raised in Learning Digital Identity, amplifying risks.

Proposed Cybersecurity Framework (Chapter 4)

The framework integrates regulation, education, and collaboration, grounded in minimal disclosure and cryptographic identity management.
It seeks to protect against centralization risks while promoting user control and resilient design.

Implementation Strategy (Chapter 5)

The three-phase model allows for gradual adoption and is aligned with Nepal’s technical and financial realities.
Emphasis is placed on sustainability, skill development, and adaptive policymaking to prevent short-lived interventions.

6.2 The Importance of Digital Identity in Cybersecurity

Empowering Users: User control over data is essential for reducing fraud, phishing, and unauthorized sharing.
Reducing Attack Surfaces: Using minimal disclosure and ephemeral credentials lowers stored data and breach risks.
Enhancing Trust in Online Services: Familiar user flows, localized laws, and cryptographic IDs increase confidence and e-service usage.

6.3 Long-Term Benefits

Resilient Digital Economy

As digital services expand, strong identity systems reduce fraud and increase investor and diaspora confidence.
Secure platforms encourage remittances, cross-border collaboration, and sustainable digital growth.

Strong National Critical Infrastructure

Banking, energy, and telecom sectors become more resilient through IAM, zero trust models, and encrypted communications.
Shared public-private threat intel minimizes disruption across essential services.

Culturally Adaptive Systems

Addressing digital divides with offline and mobile-friendly identity ensures no community is left behind.
Customizable identity layers promote participation across rural, low-resource environments.

6.4 Road Ahead and Call for Immediate Action

Finalizing Policy Reforms

The swift adoption of the Cybersecurity Policy and ETA updates must prioritize user autonomy and minimal data use.
Clear statutes improve coordination across stakeholders and reduce institutional delays.

Scaling Identity Pilots

Early pilots (e.g., municipal app verification) should be documented and scaled through incentives and formal standards.

International and Regional Partnerships

Global collaboration offers both technical resources and shared risk mitigation (e.g., AI-based identity theft).

6.5 Final Thoughts

Nepal and similar developing nations stand at a crossroads between digital advancement and systemic cyber threats. This framework—rooted in robust policy, minimal disclosure, user-centric models, and scalable capacity building—offers a locally viable and globally aligned path forward.

By fostering trust, enabling secure participation, and prioritizing resilience, Nepal can shape a digital future that benefits both its citizens and its institutions.

References

Nepal Telecommunications Authority (NTA), Cyber Security Public Advisory, multiple releases.
“General Data Protection Regulation (GDPR)”, Official Journal of the European Union, 2016.
Nepal Police Press Release, “Department of Passport Hack 2017”, 2017.
“NIC Asia Bank Breach Attempts $4.4M Transfer”, The Kathmandu Post, 2017.
“Foodmandu Data Leak Exposes 50,000 Users”, OnlineKhabar, 2019.
“Vianet Data Breach: 160,000 Customers Compromised”, The Himalayan Times, 2020.
“Tribhuvan University Data Leak: 406 Faculty Members Affected”, MyRepublica, 2020.
“Nepal Electronic Payment System (NEPS) Hack: Unauthorized ATM Withdrawals”, The Himalayan Times, 2020.
“Nepal Rastra Bank’s Source Code for Sale on Dark Web”, The Kathmandu Post, 2023.
“Ministry of Federal Affairs Data Hack by ‘Funksec’”, Gorkhapatra, 2025.
Government of Nepal, “Electronic Transactions Act (ETA), 2063”, 2006; “Cyber Security Byelaw, 2077”, 2020.
Central Bureau of Statistics (CBS), “Economic Survey on ICT and Skilled Workforce”, Government of Nepal, 2021.
Windley, P. (2023). Learning Digital Identity. O’Reilly Media.
Kshetri, N. (2017). “Cyber Strategy of Government of Nepal (GoN)”, SSRN Electronic Journal. https://ssrn.com/abstract=3552143

Additional or Implied Sources

National Cyber Security Policy 2080 (Draft Policy Document)
NTA’s Cyber Security Public Advisory (Practical Guidance)
Nepal Cybersecurity Policy Draft (Another Draft Policy with Overlaps)
Cyber Security Byelaw (2077) (Technical Standards & Auditing Requirements)
Windley, P. (2023). Learning Digital Identity, O’Reilly Media

Kebal Bhandari