Home / Topics / Cybersecurity

Cybersecurity

In plain words

Sri Lanka CERT, the national cyber response team, gets slightly less project money in 2027. The Ministry of Defence starts new cyber projects of its own. The law to create a cyber security regulator has not yet passed.

Blue tag opens the government document at that pageCalc a figure we worked outAnalysis our viewAmounts are in Rs mn unless stated. Glossary

What this tells us

Protection is not keeping pace with platforms

Projects of the national cyber team, SLCERT, fall to Rs 590 mn. That is 6.2% of the DigiGov-SL platform budget.

Why it matters. More services online means more to attack. The defenders' project budget is flat.

What to watch. SLCERT's 2027 grant, which sits in Volume III and was not available.

MPIP 2027-2029, p. 17 Calc: MPIP 2027-2029

Defence is building its own cyber capability

The Ministry of Defence opens three new lines worth Rs 1,053 mn. The Army funds a Cyber Security Regiment.

Why it matters. Cyber capacity is growing faster in the military than in the civilian response team. The documents do not say how the two will work together.

What to watch. The mandate of the planned cyber regulator.

2027 Draft Detailed Estimate Vol I, PDF p.314, Head 103 2027 Draft Detailed Estimate Vol I, PDF p.334, Head 222 Analysis

There is still no cyber regulator

Cabinet approved the Cyber Security Bill in April 2026. It is not yet law.

Why it matters. The national operations centre can watch for attacks. It cannot require anyone to fix a weakness.

What to watch. The bill reaching Parliament in 2027.

News 1st, 30 Apr 2026 The Morning, 22 Feb 2026

The detail follows, with a source tag on every figure.

Cyber and defence digital lines (Rs mn)

Line	2026	2027	Change
SLCERT projects (NCSOC, National Certification Authority, MATH lab, forensic lab)	600 MPIP 2027-2029, p. 17	590 MPIP 2027-2029, p. 17	-1.7% Calc: MPIP 2027-2029
SLCERT institutional grant	375 Budget Estimates 2026, p. 237	Not found; 435 projected in 2026 Budget Estimates 2026, p. 237	Unknown
MoD Digital and Cyber Infrastructure (new; PIC-approved projects)	0	740 2027 Draft Detailed Estimate Vol I, PDF p.314, Head 103, project 030	New
MoD Digital Forensic Laboratory (new)	0	212 2027 Draft Detailed Estimate Vol I, PDF p.314, Head 103, project 028	New
MoD Cyber Range Platform (new)	0	101 2027 Draft Detailed Estimate Vol I, PDF p.314, Head 103, project 029	New
State Intelligence Service Disaster Management Recovery Center (new)	0	400 (270 hardware, 130 software) 2027 Draft Detailed Estimate Vol I, PDF p.316, Head 103, project 004	New
State Intelligence Service network and PABX (new)	0	65 Calc: Detailed Estimate Vol I	New
Army data centres	100 rev. 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 015	70.1 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 015	-29.9% Calc: Detailed Estimate Vol I
Army telecommunication network modernisation	40 rev. 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 016	244 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 016	x6.1 Calc: Detailed Estimate Vol I
Army HQ LAN and core nodal transport network (new)	0	421 Calc: Detailed Estimate Vol I	New
Army Digital Correspondence and Application Platform (new)	0	300 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 023	New
Army Cyber Security Regiment (new)	0	106.4 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 022	New

Line	2026 revised	2027 draft	Change
Examinations: data security and cyber security software	144.4 2027 Draft Detailed Estimate Vol II, PDF p.443, Head 212, project 007	200 2027 Draft Detailed Estimate Vol II, PDF p.443, Head 212, project 007	+38.5% Calc: Detailed Estimate Vol II

What the lines say

Cyber shifts from operator to regulator. CSRA funding sits inside the two capacity projects. MPIP 2027-2029, pp. 16-17 SLCERT operations stay flat. MPIP 2027-2029, p. 17
Cyber is a sliver of the ministry. SLCERT projects equal 2.3% of the ministry vote. Calc: Appropriation Bill 2027 MPIP 2027-2029

Three trust laws are pending. These are the Digital Economy Bill, the Cyber Security Bill and Online Safety Act revisions. Budget Speech 2027, press-reported text, Daily Mirror The Morning, 22 Feb 2026
SLCERT cannot enforce today. The NCSOC monitors but cannot penalise. The Morning, 22 Feb 2026

Mandate overlap. DPA, CSRA, DEA, SLCERT and TRC mandates are not yet reconciled. Analysis
Rights concerns persist. Civil society questions the Cyber Security Bill. The Morning The ICJ seeks repeal or revision of the Online Safety Act. ICJ

Defence is frozen in nominal terms. At a 4.0% deflator, that is a real cut. Calc: Appropriation Bill 2026 Appropriation Bill 2027 BEFPR 2027
Defence still buys new ICT. Counted defence ICT rises from about Rs 534 mn to about Rs 3.08 bn. Calc: Detailed Estimate Vol I
- All defence ICT lines are domestically funded in 2027. 2027 Draft Detailed Estimate Vol I, PDF p.314, 316, 334, Heads 103 and 222

Law and regulator status

Item	Promised in Budget 2026	Status, Nov 2026	2027 signal
Cyber Security Bill and regulator	NCSOC cited as progress Budget Speech 2026, pp. 18-19	Cabinet approved 30 Apr 2026 News 1st, 30 Apr 2026; with Attorney General by Nov Budget Speech 2027, press-reported text, Daily Mirror	Authority expected in 2027. Slipped.

Pattern. Systems moved. Laws did not. Analysis

Defence ICT bundling. MPIP lists MoD Border Risk Centre servers (Rs 420 mn) and HCI (Rs 250 mn). MPIP 2027-2029, p. 53 Volume I shows one Rs 740 mn line covering three PIC-approved projects. 2027 Draft Detailed Estimate Vol I, PDF p.314, Head 103, project 030 The MPIP items likely sit inside it. Analysis
Army Cyber Regiment. MPIP: Rs 107 mn. MPIP 2027-2029, p. 52 Volume I: Rs 106.4 mn. 2027 Draft Detailed Estimate Vol I, PDF p.333-334, Head 222, project 022 Use Volume I. Analysis