Summary

  • An order signed on 6 August replaced Timor-Leste’s cable-focused interministerial cyber group with CICDE, a committee whose remit also includes data protection, cyberspace regulation, cybercrime and digital government.
  • The order gives CICDE coordination and oversight functions but leaves project implementation with ministries, departments and other public bodies. Its monthly reports and division of responsibility will show whether the wider mandate reaches operations.

Timor-Leste has widened the government’s cybersecurity coordination table. The Interministerial Committee on Cybersecurity and the Digitalisation of State Services (CICDE, from its Portuguese name) succeeds the group established in October 2025 to coordinate protection of critical systems, particularly the Timor-Leste South Submarine Cable, and international cooperation. The new committee covers that security agenda alongside data protection, cyberspace regulation, cybercrime and the digitalisation of government services.

Its membership is deliberately broad. The Minister of the Presidency of the Council of Ministers chairs it; the Minister of Transport and Communications is vice-chair. Justice, Interior and State Administration are represented alongside the National Strategic Intelligence Service, TIC Timor, forensic police, the Central Bank’s Financial Intelligence Unit, the National Police and the National Communications Authority. The intelligence service’s director-general is to coordinate technical work with assistance from TIC Timor’s executive director.

That architecture does not, by itself, transfer operating responsibility to the committee. The government’s 6 August account says CICDE will coordinate, guide, liaise, monitor and oversee, “without replacing” the ministries, departments and public bodies responsible for implementation. It is to meet monthly and report monthly to the Prime Minister, with policy proposals, draft legislation and reports on its work going to the Council of Ministers.

The remit reaches well beyond incident response. It includes common standards for state systems, interoperability, secure information sharing, digital identity and signatures, data governance and digital administrative procedures. CICDE is also expected to coordinate risk criteria for private suppliers and development-partner support, including sovereignty, sustainability and the possibility of technical, financial or political dependence. These are decisions about how government buys and connects systems as much as how it responds to attacks.

The legal layer is still a separate question. The government submitted a request for legislative authorisation to Parliament on 31 July for a package covering national cybersecurity strategy, cyberspace security, digital services, cybercrime and digital evidence. On 3 September, the Ministry of Transport and Communications said approval was awaited. A 24 September government release repeated the submission date but did not report Parliament’s disposition. The available statements therefore do not establish the proposal’s status on 17 October.

APNIC’s 16 October ecosystem profile says a national CSIRT is in development; it does not establish that the team is operating.

The order sets out a coordination mechanism, not proof of execution. A broad membership can align priorities, but the ministries and bodies that run services still have to turn standards into procurement terms, system changes, incident procedures and accountable owners. The first monthly reports will matter because they can reveal whether CICDE is bridging that gap or mainly documenting it.

Sources: Government order establishing CICDE; cybersecurity package submitted to Parliament; MTC statement on legislative approval, 3 September; 24 September government update; APNIC’s Timor-Leste ecosystem profile.