OEA - CP - Resolución CP CSH 2378

PERMANENT COUNCIL OF THE OEA/Ser.G

ORGANIZATION OF AMERICAN STATES CP/CSH-2378/26 12 February 2026

COMMITTEE ON HEMISPHERIC SECURITY Original: Spanish/English

REPORT BY THE SECRETARIAT OF THE

INTER-AMERICAN COMMITTEE AGAINST TERRORISM (CICTE)1 /

(Presented in preparation of the Committee meeting scheduled for February 26, 2026, at 10:00 AM) This Report is submitted in accordance with the provisions established in the Structure for the consideration of substantive issues during regular meetings (2025-2026) , document CP/CSH/INF.602/25, and pursuant to the request of the Presidency of the Committee on Hemispheric Security. Contents

I. ACTIVITIES CARRIED OUT IN 2025........................................................................................2

II. 2026 WORK PLAN .......................................................................................................................4

1 . This report has been prepared by the Cybersecurity Section of the Secretariat of CICTE.- 2I. ACTIVITIES CARRIED OUT IN 2025 During 2025, the Cybersecurity Section of OAS/CICTE continued its support in strengthening the capacities of OAS member states by carrying out more than 100 policy development, training, and awareness-raising activities that impacted more than 28,000 people throughout the region. This cooperation included specialized support for the development of cybersecurity policies, regulatory frameworks and strategies, strengthening the technical capacities of computer incident response teams (CSIRTs) and initiatives to promote public awareness and knowledge on cybersecurity issues. 1) Policy development During 2025, the CICTE Secretariat supported processes for the development of the National Cybersecurity Strategies of Colombia, Paraguay, and Uruguay. The region's maturity in this area of cybersecurity is shown by the fact that in 2016 only six countries had this type of policy, while in 2025

there are already 21, with some of them in their second, third, or fourth version. Of these 21 countries, CICTE has supported 16 member states in the development of this type of cybersecurity policy. Among the activities highlighted this year we can highlight: - The Sixth Meeting of the Working Group on Cooperation and Confidence-Building Measures in Cyberspace, in Santo Domingo, Dominican Republic on November 16 and 17, 2025 under the leadership of the Dominican Republic as the Chair of the Working Group. Topics discussed at the meeting include: sharing up-to-date information on national cybersecurity policies; addressing cyber threats through confidence-building measures; the analysis of inter-American normative and technical frameworks; and consideration of proposals for the classification of the severity of cyber incidents. During the session, the OAS member states elected Canada and Brazil to assume the Chair and Vice-Chair, respectively, of the Working Group in its next session. - Courses for diplomats from OAS member states through a series of National Dialogues on the Application of International Law in Cyberspace, an initiative aimed at strengthening national understanding, legal coherence, and multi-stakeholder participation on the application of international law in cyberspace, where a total of 146 officials from member states were trained. o Chile (28–30 July 2025): Organized together with UNIDIR, the dialogue included a preparatory webinar, a public lecture at the University of Chile, and a high-level workshop focused on the application of principles such as sovereignty, attribution, and due diligence in the Chilean national context. o Mexico (November 11–13, 2025): Organized virtually in collaboration with ICT4Peace, the three-day course addressed fundamental legal principles such as sovereignty, non-intervention, due diligence, state responsibility, human rights, and3international humanitarian law in cyberspace, incorporating Mexico's priorities and perspectives on the matter. - A publication 'A novel approach to the 11 UN standards on responsible behavior of States in cyberspace: guidelines for implementation with a gender perspective', was prepared in partnership with UNIDIR. - Publication of the 2025 Cybersecurity Report: Vulnerability and Maturity Challenges to Bridging the Gaps in Latin America and the Caribbean , a comprehensive update on the state of cybersecurity maturity in the Americas, developed in conjunction with the InterAmerican Development Bank (IDB) and the University of Oxford. 2) Technical assistance and training through CSIRT Americas The network of incident response teams "CSIRT Americas" supports OAS member states in their efforts to strengthen resilience in cybersecurity. The network has 52 CSIRTs members from 22 different countries. Among its activities, the Network organizes an annual meeting for its members to exchange information and experiences on cyber threats. The 2025 edition was held within the framework of the STIC Conference, in Panama, during the month of May, and was attended by 26 heads of national

CSIRTs.

Likewise, 2 editions of CSIRTAmericas Week were held, an activity that promotes collaboration, capacity building and knowledge exchange among the CSIRTs associated with CSIRTAmericas. During the week, training on incident management, threat intelligence, and best practices is offered, along with hands-on simulations to strengthen cybersecurity responses. The 2025 editions of CSIRT Week were held in Mexico and Uruguay during the month of March. The Network offered six virtual sessions in 2025 to promote the exchange of experiences and knowledge among the CSIRTs in the region. Topics covered: threat feed management, building industry-wide communities for information sharing, and secure online shopping. More than 100 incident response professionals participated in these sessions. In addition, 36 CSIRTS team members were certified as auditors in SIM 3 (Security Incident

Management Maturity Model), a model that evaluates the level of maturity of a CSIRT based on governance, incident documentation and operational parameters. SIM3 certification in cybersecurity is crucial for assessing and improving security incident responsiveness. It also helps organizations identify gaps, optimize processes, and ensure efficient incident handling. Finally, the third edition of the CSIRTAmericas Academy's basic cybersecurity route was also organized: a continuous training program developed by the CICTE Secretariat with the support of the CCN-CERT of Spain, which is carried out in virtual format between October 2025 and March 2026. 3) Youth and womens trainings During 2025, the CICTE Secretariat carried out the following editions of the SheSecures and OAS Cyber Challenge initiatives.- 4 - - 13 editions of the SheSecures initiative (Bahamas, Belize, Barbados, Chile, Colombia, Guyana, Haiti, Jamaica, Mexico, Panama, Paraguay, Trinidad and Tobago, Uruguay) with the participation of 1,972 women. - 7 editions of the OAS Cyber Challenge initiative (Honduras, Grenada, Guyana, Mexico, Panama, Paraguay, and Uruguay). A total of 439 young people between 17 and 25 years old participated in this virtual cybersecurity competition. The SheSecures initiative, an online cybersecurity exercise made up of different technical challenges based on real scenarios. Through this initiative, the CICTE Secretariat sought to contribute to closing the gender gap in cybersecurity and promoting diversity in this industry, encouraging and inspiring women to develop their technical skills and learn more about this field. The Youth Academy for Cybersecurity Empowerment was also launched, in partnership with the Government of Jamaica and with the support of the Government of Canada and the SANS Institute. This program is designed to equip 30 young Jamaicans with technical skills in cybersecurity, industry certifications, and hands-on experience. The second #GirlsinCyber Mentoring Fair took place in Montevideo (Uruguay) on October 24,

2025. This event, organized in partnership with the Agency for Electronic Government and the Information Society (AGESIC), directly impacted 34 young women in the academic and professional

certifications, and hands-on experience. The second #GirlsinCyber Mentoring Fair took place in Montevideo (Uruguay) on October 24,

2025. This event, organized in partnership with the Agency for Electronic Government and the Information Society (AGESIC), directly impacted 34 young women in the academic and professional definition stage, strengthening their interest and participation in the field of cybersecurity. Through a practical and interactive approach, the initiative increased participants' knowledge of the various career paths in the sector, reinforced key technical and soft skills, and facilitated direct contact with leaders from the public, academic, international and private spheres. 4) Regional and international events During 2025, the Cybersecurity Symposium + the Regional Initiative for Education and Cybersecurity (RICET) was also held in October in Montevideo, in collaboration with the Agency for Electronic Government and the Information and Knowledge Society (AGESIC) of Uruguay. More than 300 specialists from the region participated in the meeting.

The Tenth Edition of the Cybersecurity Summer Bootcamp was held in León, Spain in July 2025 with the National Cybersecurity Institute of Spain (INCIBE). It had record numbers of participation of 507 professionals from 27 countries. STIC Conference was held in Panamá from May 21 to 23 and from November 24 to 27, 2025 in Madrid. Both events were organized in collaboration with CCN-CERT.

II. 2026 WORK PLAN In 2026, the Cybersecurity Section of CICTE/OAS will continue to support OAS member states in strengthening capacities to prevent, confront, and recover from cyber threats through technical cooperation. Such cooperation shall include:- 5 - - Technical and legislative assistance to develop, update, and implement national strategies and/or cybersecurity legislation as required. - Support for efforts aimed at strengthening capacities in cyber diplomacy, including the

organization of the annual meeting of the OAS Working Group for the Promotion of Cooperation and Confidence Measures in Cyberspace. Including the VII Meeting of the Working Group. - Strengthening national technical capacities and capacity to share information on cyber threats of Computer Incident Response Centers (CSIRTs), to prevent, face, and recover from cyber incidents, mainly through the CSIRTAmericas network. - Implementation of initiatives aimed at developing the cybersecurity workforce in member states, including the professional development of young people and the development of national cybersecurity education frameworks. - Development of initiatives aimed at promoting the role of women and closing the gender gap in cybersecurity. - Organization of regional and international events to strengthen the exchange of information, share best practices and increase the capacity to respond to cyber incidents, promoting national, regional, and international cooperation in cybersecurity.