National CIRT Establishment in Burundi

The main goal of the project is to assist the government of Burundi to establish its national Computer Incident Response Team (CIRT) to serve as a trusted, central coordination point of contact for cybersecurity; aimed at identifying, defending, responding and managing cyber threats.
ITU will assist the government of Burundi in building and deploying the technical capabilities and related trainings necessary to establish its national CIRT. Thus it is expected to lead to development of national cybersecurity capacity while moving forward on enhancing regional and international collaboration.

The project aimed to assist the Government of Burundi in establishing its national Computer Incident Response Team (CIRT) to serve as a central and reliable point of contact for cybersecurity coordination. Technical solutions were designed by the contracted service provider and deployed on the Burundi CIRT servers. Equipment was procured in 2017, and the CIRT premises were renovated following recommendations provided during a site assessment visit in February 2019.

The project underwent four extensions between 2013 and 2022 to accommodate various implementation challenges, including equipment procurement, contractor selection, and the COVID-19 pandemic. The initial contractor (IMPACT) ceased operations, and a replacement contract was signed with Deloitte in December 2018 and subsequently extended in October 2021. CIRT software solutions were identified, developed, and partially installed on the Burundi CIRT servers.

However, the project faced significant technical challenges that prevented the full achievement of its objectives. Configuration issues related to the email system on the CIRT servers could not be resolved due to difficulties accessing the Burundi network remotely. As a result, the CIRT was not rendered fully operational, the planned in-person training programme for government officials was not completed, and national awareness-raising activities were not carried out.

The project utilized 81 per cent of the total funds received (two contributions of CHF 138,163.30 and CHF 93,920 from the ARCT partner). A remaining balance of CHF 43,344 was recorded. The project was implemented in partnership with the Agence de Regulation et de Controle des Telecommunications du Burundi (ARCT), which served as the partner, funder, and beneficiary.

Key lessons from the project highlighted the importance of conducting detailed analysis of the deployment environment at the project design stage, ensuring strong leadership commitment and a dedicated team from inception, establishing clear activity timelines with planned start and end dates, and incorporating risk management measures. The project also recommended that future similar initiatives take into account the evolving cybersecurity landscape and leverage synergies with related digital foundation projects in the country.