OEA - CP - Resolución CP CSH 2383

PERMANENT COUNCIL OF THE OEA/Ser.G

ORGANIZATION OF AMERICAN STATES CP/CSH-2383/26 23 February 2026

COMMITTEE ON HEMISPHERIC SECURITY Original: Spanish

REPORT ON PROGRESS AND CHALLENGES IN THE CYBER DEFENSE PROGRAM

OF THE INTER-AMERICAN DEFENSE BOARD

(Presented by the Inter-American Defense Board in preparation for the meeting of the Committee scheduled for February 26, 2026) This report is submitted in accordance with the provisions contained in the Structure for the Consideration of Substantive Issues during Regular Meetings (2025-2026) , document

CP/CSH/INF.602/25.

CONTENTS CYBER CRISIS MANAGEMENT TABLETOP EXCERCISE, ECUADOR 2025..............................2

PARTICIPATION IN THE CONFERENCE OF AMERICAN ARMIES..............................................3

PARTICIPATION IN THE XV SPECIALIZED INTER-AMERICAN NA V AL

CONFERENCE ON TELECOMMUNICATIONS AND INFORMATION TECHNOLOGY.............3

HEMISPHERIC SEMINAR ON CYBER DEFENSE 2025 ..................................................................32CYBER CRISIS MANAGEMENT TABLETOP EXCERCISE, ECUADOR 2025 On July 22 and 23, 2025, the I Interinstitutional Strategic Exercise on Cyber Crisis Management 2025 was held in Quito, Ecuador, specifically in the conference room of the Hotel Dann Carlton Quito, under the management of the Cyber Defense Command of the Army of Ecuador. This activity was planned by the Inter-American Defense Board (IADB) and was the first of its kind for the defense and public security sectors in Ecuador, with participants from the Joint Command of the Armed Forces, the Ministry of Defense, the Ministry of the Interior, the Ministry of Telecommunications, the Telecommunications Sector, and the Petroleum Sector, for a total of 42

participants. The I Interinstitutional Strategic Exercise on Cyber Crisis Management 2025, held in Quito, Ecuador, on July 22 and 23 this year, represented an innovation milestone in cyber crisis management in the country. This was the first exercise of its kind specifically targeting the defense and public security sectors, setting a precedent in cyberspace incident preparedness and coordination. The activity was part of the sustained efforts of the IADB to strengthen regional cyber resilience and promote strategic cooperation among its member countries by facilitating the exchange of knowledge, best practices, and capabilities to address common challenges in an increasingly complex digital environment. In addition, 42 representatives from various national institutions, in particular the Ministry of Defense and the Ministry of the Interior of Ecuador, were guided through three progressive, realistic simulation scenarios. The scenarios, developed with technical support from the IADB, reflected critical cyber challenges tailored to the national context, using advanced artificial intelligence (AI) tools to generate situation-specific threat injectors. Coordination by the IADB enabled dynamic and productive interaction among the participants, underscoring the importance of exercises of this sort as platforms for strengthening strategic decisionmaking capabilities in the event of incidents in cyberspace. The results of the satisfaction survey applied at the end of the exercise revealed a high degree of approval: 96 percent of participants said that the exercise met their expectations. This reflects both the success of the event and the value of the meticulous planning and technical support provided by the IADB. This groundbreaking exercise, designed specifically to address Ecuador's cybersecurity needs, demonstrates the operational and methodological capacity of the IADB to replicate the initiative in other countries in the region. In so doing, the IADB fosters greater hemispheric cooperation and promotes the sustained development of effective and coordinated cyber defense, to the benefit of the Hemisphere's collective security. As a final recommendation, all member and observer countries are invited to disseminate this capability in their respective nations for the implementation of future tabletop exercises. This active collaboration will contribute significantly to building a more resilient Hemisphere better protected against emerging cyber threats.- 3PARTICIPATION IN THE CONFERENCE OF AMERICAN ARMIES The First Plenary Session of the Fifth Specialized Conference, XXXVI Cycle, of the

capability in their respective nations for the implementation of future tabletop exercises. This active collaboration will contribute significantly to building a more resilient Hemisphere better protected against emerging cyber threats.- 3PARTICIPATION IN THE CONFERENCE OF AMERICAN ARMIES The First Plenary Session of the Fifth Specialized Conference, XXXVI Cycle, of the Conference of American Armies (CAA) was held from April 7 to 11, 2025. The event took place in Buenos Aires, Argentina. The theme of the Specialized Conference was “Developing Cyber Defense Capabilities,” and its objectives were to strengthen interaction among all CAA members and to examine specific requirements for developing cyber threat response capabilities. The participation of the IADB in the CAA aligns with the objective of promoting security and defense cooperation among the countries of the Americas, thereby facilitating dialogue and collaboration. In that regard, understanding the current status and initiatives of the various national armies of the CAA is of significant importance. PARTICIPATION IN THE XV SPECIALIZED INTER-AMERICAN NA V AL CONFERENCE ON TELECOMMUNICATIONS AND INFORMATION TECHNOLOGY From October 6 to 10, 2025, the XV Specialized Inter-American Naval Conference on Telecommunications and Information Technology (CNIE-T&TI) was held in Rio de Janeiro, Brazil, with the participation of nine delegations from the region’s navies, the IADB, and the Permanent Secretariat of the Inter-American Naval Conference. The main theme of the Specialized Conference was “Challenges of Cyber Defense and Naval Communications Systems in Degraded, Denied, Intermittent, and Bandwidth-Limited (DDIL) Environments.” The participation of the IADB in the XV CNIE-T&TI aligns with the objective of promoting cooperation in maritime security and defense among the countries of the Americas, thereby facilitating

dialogue and collaboration. In that regard, understanding the current status and initiatives of the various navies that make up the CNI is of great importance. Likewise, the working groups and the exchange of experiences led to the formulation of promising recommendations for the next CNIE-T&TI, notably Recommendation No. 4, in which the IADB proposed adopting the ITU methodology for the proposed technical study, and Recommendation No. 6, in which the Permanent Secretariat of the CNI agreed to work jointly with the IADB to coordinate the development of training programs on HF communications and methodologies for conducting multinational exercises.

HEMISPHERIC SEMINAR ON CYBER DEFENSE 2025

On December 4, 2025, the Hemispheric Seminar on Cyber Defense was held virtually, with 11,388 registered participants from 59 countries. The Seminar focused on the theme “Casos de éxito en la Ciberdefensa” (Cyber Defense Success Stories) and was intended for military and civilian personnel at various organizations in the member countries of the IADB, including:- 4 - • High-level decision makers • Military schools and vocational and technical training schools of the armed forces • Operational units of the armed forces of the countries of the Hemisphere • Think tanks, institutions and organizations related to hemispheric defense and security • Public and private organizations and institutions related to cyber defense. Various topics related to the strengthening of cyber defense capabilities in the Hemisphere were discussed at the seminar. Initiatives such as the creation of a joint school to increase the number of personnel specialized in cyber operations and the conduct of the Cyber Guardian 7.0 exercise were presented. National institution-building experiences were also shared, including cyber defense capabilities in Honduras; the actions of the Secretariat of National Defense of Mexico in the field of cybersecurity; and a strategic overview of cyber threats in Latin America. The progress made by the Dominican Republic in implementing its National Cybersecurity and Cyberdefense Strategy was

highlighted, as were the efforts of the Joint Command of the Armed Forces of Ecuador to strengthen its cyber defense structure. Lastly, Colombia presented a success story involving the Joint Cyber Command in support of national cyber defense. The Hemispheric Seminar on Cyber Defense confirmed that cyberspace has consolidated its position as the fifth domain of warfare and a key component of national security, with crosscutting implications for the land, maritime, air, and space domains. All presentations agreed that hybrid threats, ransomware, disinformation, and the malicious use of emerging technologies increase the vulnerability of States and require coordinated strategic, operational, and tactical responses. There is a clear regional trend toward institutionalizing cyber defense through the creation of joint commands, specialized units, and command-and-control centers. These structures enable the integration of military defense with the protection of critical digital infrastructure and essential state services. All the experiences highlighted that training and the professionalization of human resources are critical factors. The establishment of specialized schools and academic programs—such as EMCO in Spain; master’s programs and specialization courses in Mexico; CEA-IT in the Dominican Republic; and congresses and courses in Honduras and Guyana—demonstrates that developing specialized cyber operators, analysts, and instructors is vital to sustaining permanent cyber defense capabilities. Cyber exercises and simulations—such as Cyber Guardian 7.0, Southern Defensive Cyber, the Inter-American Cyber Defense Challenge, crisis exercises in Ecuador, and planning for COP16 in Colombia, among others—have become essential tools for testing doctrines, validating procedures, measuring response times, and strengthening interoperability among the armed forces, civilian agencies, the private sector, and international partners. The presentations also highlighted persistent gaps in legal frameworks, governance, and resources. Several countries underscored the need to update legislation on cybercrime, data protection, and critical infrastructure; address regulatory complexity and fragmented responsibilities; increase investment in technology, cyber insurance, and infrastructure modernization; and mitigate the shortage of specialized talent and its high turnover.- 5A crosscutting theme was the recognition that no State can address cyber threats alone. International cooperation, the creation of trusted national networks, the coordination of sectoral and

investment in technology, cyber insurance, and infrastructure modernization; and mitigate the shortage of specialized talent and its high turnover.- 5A crosscutting theme was the recognition that no State can address cyber threats alone. International cooperation, the creation of trusted national networks, the coordination of sectoral and national CSIRTs, and joint work with organizations such as the IADB, the OAS, the ITU, CFAC, NATO, and the Southern Command were identified as key enablers for intelligence-sharing, capacitybuilding, and the conduct of multinational exercises. The experiences of the Dominican Republic, Ecuador, and Colombia demonstrated that it is possible to move from strategy to implementation through clear public policies, robust governance structures, critical infrastructure inventories, and specific protocols for high-visibility events. These success stories offer replicable models for other member countries that are in the early stages of capacity building. Finally, the Seminar fulfilled its objective of highlighting success stories, sharing lessons learned and identifying common lines of action to strengthen hemispheric cyber defense. The InterAmerican Defense Board reaffirms its role as an appropriate forum for advancing the development of an “Inter-American Cyber Shield,” promoting interoperability, mutual trust, and sustained cooperation in response to current and emerging threats in cyberspace.