What happens when Jamaica’s digital systems fail?

THE EDITOR, Madam:

Jamaica’s digital transformation is accelerating, which brings enormous benefits. It also raises a question that deserves greater attention: what happens when these services are disrupted?

The Government announced plans for a new national cybersecurity law. The proposed legislation is expected to strengthen protection of Jamaica’s critical digital infrastructure and provide a clearer framework for standards, oversight and incident response. Jamaica has also completed a Cybersecurity Standards Framework aligned with the internationally recognised framework developed by the US National Institute of Standards and Technology.

The issue goes well beyond stolen data or damaged computers. A serious cyberincident can interrupt everyday life.

Banks process payments electronically. Ports and logistics operations depend on digital platforms. Telecommunications networks support business and emergency communication. Government services increasingly require connected technology to function. When one of these services fails, the consequences can quickly move into the physical world.

Cybersecurity can no longer sit solely with the IT departments. When essential services are threatened, the real issue is whether entities can continue functioning during and after a serious incident.

The National Security Operations Centre provides centralised monitoring and situational awareness of cyberthreats and vulnerabilities, while the Jamaica Cyber Incident Response Team supports the country’s ability to identify and respond to incidents. The government has also proposed the establishment of a National Cybersecurity Coordination and Assurance Council to strengthen national coordination.

But legislation and better technology will only take Jamaica so far.

Organisations responsible for essential services must know which assets are most important, what would happen if they became unavailable, and how operations would continue. Backup arrangements must work in practice, not merely exist in policy. Staff must understand their responsibilities, and third-party risks cannot be ignored.

Physical security matters too. A protected network can still be compromised if someone gains unauthorised access to a server room, communications facility, control system or other sensitive location.

The priority should be to identify what is essential, protect it, test what happens when it fails ,and ensure there is a workable way to continue operating. That means stronger minimum standards, tested continuity, and incident-response plans, closer scrutiny of suppliers, and better integration of cyber and physical security and disaster preparedness.

As dependence on digital infrastructure grows, so does the cost of failure. The objective should not be to slow digital transformation, but to build protection and continuity into it from the start.

RENEE WATKIS