Ethiopia’s Critical Infrastructure Cybersecurity Framework: INSA Sets Out the Designation Standard

Hirko & Associates Law Office previously published a legal update examining Ethiopia’s Critical Infrastructure Cybersecurity Proclamation No. 1426/2026. That analysis considered the Proclamation’s broader legal framework for protecting infrastructure whose disruption or compromise may have serious consequences for the country. The present update follows that discussion by examining the Critical Infrastructure and Sectors Designation Standard, Version 1.0, issued by the Information Network Security Administration (INSA) in August 2026 (the “Standard”).

The distinction matters. A proclamation may establish the legal basis and institutional responsibilities for a regulatory framework, while a designation standard explains how the framework is intended to be applied in practice. The Standard provides a structured approach for identifying relevant sectors, assessing the criticality of infrastructure, assigning classifications, and reviewing designations over time. It therefore gives organizations a clearer basis on which to consider whether their activities, systems, facilities or services may fall within the critical infrastructure framework.

The Standard should not be read as declaring every organization operating in a listed sector to be critical infrastructure. Rather, it establishes a screening and assessment approach through which particular infrastructure may be evaluated according to its potential consequences for national security, continuity of essential services, public welfare and the wider economy. The practical question is not simply which industry an organization belongs to, but what the loss, disruption or compromise of its relevant infrastructure could mean for Ethiopia. Please read the full details in the attachment.