Ured za reviziju institucija BiH - Канцеларија за Ревизију Институција Босне и Херцеговине

Audit Office of the Institutions of Bosnia and Herzegovina

Activities of BiH institutions to ensure the basic assumptions for cyber security

2022 BH2022cyberSecurityBiH
SCALE
  • - In BiH, there are no official data on the number and type of cyber attacks. Unofficial data indicate that the number of cyberattacks in BiH increased by 1300 times on a weekly basis. Out of 68 institutions in Bosnia and Herzegovina, 24 institutions in Bosnia and Herzegovina had recorded cyberattacks.
COMPLIANCE FOCUS
  • - Public Administration Reform Strategy, 2006
  • - Action Plans implementing the Strategy, last: September 2022
  • - European Union Act on Cybersecurity, 2019
  • - Guidelines for the strategic framework of cybersecurity
PERFORMANCE ASPECT
  • - consequences for the functioning of public administration and the economy
  • - progress in counteracting cyberthreats
1. Reporting - Purpose

[Agencies] did not report to the [Coordinating Ministry] on the poor implementation of the Information Management Policy, even though they were tasked with annual reporting.

2. Design - Framework

The strategic and legal framework of cybersecurity was not adopted, which affects the implementation of information measures and security standards. (…) Postponing the adoption and harmonization of the strategic and legal framework of cyber security with the EU legislation does not only result in failure to fulfil the assumed obligations, but contributes to the technological backwardness.

3. Structure - Excellence center

Due to the delay in ensuring the necessary conditions, Computer Incident Response Team ( CERT ) was not established and a coordinated approach in managing the response to cyber incidents was not ensured. (…) The consequences are the lack of proactive and reactive measures with the aim of preserving the cyber security of BiH institutions and reducing the consequences of computer incidents.

Code (gexf) to continue analysis with GephiTerminology graph
svg
The items above were selected and named by the e-Government Subgroup of the EUROSAI IT Working Group on the basis of publicly available report of the author Supreme Audit Institutions (SAI). In the same way, the Subgroup prepared the analytical assumptions and headings. All readers are encouraged to consult the original texts by the author SAIs (linked).