By Dennis Karugaba, Resident Twinning Adviser Assistant, Digital for Tanzania (D4T)

Finnish cybersecurity experts spent five training days in Dar es Salaam with ICT and cybersecurity professionals responsible for critical digital services, covering how to identify, defend, and recover the systems that essential services run on. The Director General of the Tanzania ICT Commission closed the training on Saturday 17 October.

From 12 to 17 October 2026, ICT and cybersecurity professionals gathered at the PSSSF Building on Sam Nujoma Road in Dar es Salaam to learn how to protect critical information infrastructure, or CII: the networks, systems and data behind services that society cannot do without. The training, Protecting ICT Critical Information Infrastructure (CII2) in the Public and Private Sector, was organised by the Digital for Tanzania (D4T) Twinning project. Mwananchi and The Citizen newspapers reported that 64 ICT professionals graduated at the certificate ceremony on Saturday 17 October, where Dr. Nkundwe Mwasaga, Director General of the Tanzania ICT Commission (ICTC) and Beneficiary Country Project Leader of D4T, spoke at the opening and the closing.

The training was designed for staff responsible for critical services in banking and finance, telecommunications, energy, health, transport and logistics, ports and other essential sectors. It was delivered by three experts from Finland: Kimmo Rousku, an expert in AI, cybersecurity and digital transformation, and Tapani Rinne, an expert in data protection, AI and cybersecurity, both of the Finnish Digital Agency; and Jere Finne, a cybersecurity expert at the National Cyber Security Centre Finland (NCSC-FI), part of the Finnish Transport and Communications Agency (Traficom). Sessions ran on Monday, Tuesday, Thursday, Friday and Saturday. Wednesday 14 October, Nyerere Day, was a public holiday.

64 professionals graduated

5 training days, 12–17 October

27 of 37 invitees answered the feedback survey

19% women among daily attendance

 

What The Week Covered

The programme was built around six areas: identification, management and resilience of critical information infrastructure; CII risk management, dependencies, supply chains and third-party risks; CII audit, assurance and cybersecurity maturity; information integrity, authenticity, cryptography and quantum readiness; artificial intelligence, data protection and emerging cyber risks; and business continuity, incident response and SOC operations. Across 22 topics and a facilitated tabletop exercise, three threads ran through the week. The first was knowing what is critical, using business impact analysis and dependency mapping to identify essential services, the impact if they fail, and what they depend on. The second was looking beyond the organisation’s own walls, to suppliers, service providers and digital supply chains. The third was readiness for the worst day, from AI-driven threats and the post-quantum transition to incident response, crisis management and crisis communication.

Monday set the foundation: what counts as critical in 2026, the current cyber and physical threat landscape, the principles of resilient protection, and how confidentiality, integrity, availability and resilience can guide priorities. Participants then moved to business impact analysis and dependency mapping, identifying which services matter most and what they rely on.

Tuesday widened the lens to the ecosystem around critical services: mapping resources and dependencies, CII regulation and responsibilities in Tanzania in 2026, a risk management framework for CII, and supply-chain and third-party risk. The afternoon turned to artificial intelligence, both as a factor changing cyber threats and defences and as a governance, data protection and risk question.

Thursday focused on assurance: why and how critical systems are audited, how to validate security controls technically beyond compliance, and how standards and maturity models support continuous improvement. A session on quantum readiness and cryptographic agility looked at preparing for the post-quantum transition. The afternoon was a facilitated tabletop exercise built around the compromise of a critical supplier, in which participants practised decision-making, coordination, continuity and recovery.

Friday opened with a debrief of the exercise and its lessons, followed by sessions on integrity, authenticity and cryptographic protection, business continuity and disaster recovery, and the practical protection of hybrid IT, cloud and operational technology (OT/ICS) environments.

Saturday looked at what happens when prevention is not enough: a case study on how data breaches occur, the role of a security operations centre (SOC) and situational awareness, incident and crisis management, and crisis communication and cooperation with internal and external stakeholders. The closing session, From Training to Action, set out key takeaways and short-term improvement priorities before the certificate ceremony.

Voices from the closing

According to Mwananchi and The Citizen newspapers, Dr. Mwasaga said security and trust are fundamental to a digital economy, and that institutions providing digital services must protect their systems from attack and keep them running without interruption, so that citizens and other institutions can use them with confidence. He said participants have been added to the national database of professionals and urged them to pass on what they learned to colleagues at their workplaces.

Mika King, Member State Project Leader for D4T, said the partnership aims to transfer experience and best practice from Europe to Tanzania while allowing it to be adapted to the country’s environment and needs. He said that training which draws on real information security incidents helps professionals trace the source of a problem and identify steps that can prevent it from happening again.

Sofia Sufiani, IT Manager at Tanzania Mortgage Refinance Company (TMRC), told the same outlets that the training improved participants’ understanding of system security, error detection and how to deal with hacking and cybercrime.

Tapani Rinne, of the Finnish Digital Agency, said institutions should identify the information they hold, decide which of it matters most and put procedures in place to prevent unauthorised use, and that protecting digital systems is a job for staff and service users, not for IT professionals alone. Jere Finne, of NCSC-FI, said countering digital threats takes better technology, better work processes and stronger skills among the people who use the systems, and he stressed the value of institutions sharing information about emerging threats. The experts also noted that the growing use of AI offers opportunities to improve services but called for stronger oversight and security.

In its report, TBC News said critical information infrastructure is vital to Tanzania as the country accelerates digital transformation, expands e-government services and deepens financial inclusion through mobile money and digital banking, and that when it is poor, outdated or compromised, the failures cascade across society, the economy and national security. The experts it interviewed stressed preparation. A common mistake, one of them said, is to assume there are no dangers until something happens; organisations should rehearse for breaches and disasters, and exercising, the expert said, is “number one”. As an example of what can go wrong, an expert pointed to a major data breach in Helsinki in 2024. The experts also urged participants to learn about AI, which is developing fast and brings clear benefits but is also a tool for criminals, and welcomed Tanzania’s data governance initiatives, which an expert described as giving the quality and backbone of the operation.

The training was also covered by TBC, the national broadcaster, which interviewed the experts and the Director General (TBC News bulletin on YouTube), by Clouds TV, which spoke to Dr. Mwasaga, Kimmo Rousku and participants including Sofia Sufiani and Mudhihiri Mussa, and by Mwananchi, with an English version in The Citizen. Clouds TV’s report framed digital safety as a government priority in the ICT sector and noted how many fields, from health to business, now depend on technology every day.

Who Took Part

Daily attendance, recorded by the project, ranged from 47 to 58 participants over the five training days. Women made up between 16 and 26 percent of daily attendance, and 19 percent across the week (52 of 268 attendances). The figures are a reminder that closing the gender gap in ICT and cybersecurity remains a priority. Improving cybersecurity, privacy and data protection skills in the private sector and research community, including addressing the gender digital divide, is one of D4T’s stated objectives.

What Participants Said

Participants were invited to give feedback after the training. Twenty-seven of the 37 invited people responded, a response rate of 73 percent. Between 85 and 96 percent of respondents rated each aspect of the training 4 or 5 on a five-point scale. The strongest results were for the quality of course materials and the facilitators’ knowledge, each rated 4 or 5 by 25 of 26 respondents, and 24 of 26 gave the same rating to the overall quality of the training. Asked whether they would recommend the D4T Twinning project to a colleague, 22 respondents answered, which gives a Net Promoter Score of 55: 14 promoters, six passive and two detractors.

The written comments were constructive. The most frequent request was for more hands-on work: short labs, demonstrations, mock exercises and case studies, more group work and fewer slides. The Thursday tabletop exercise was the programme’s main hands-on element, and the comments suggest participants enjoyed it very much and would welcome more. Respondents also raised practical points about the venue and its location in Dar es Salaam, noise, and power interruptions. Others asked that, in the future, the ICT Commission provide an annual calendar of trainings, so that institutions can budget for them, and for the ICT Commission to send official invitations directly to institutions so that more of the relevant professionals can attend. These are useful pointers for future sessions.

Why Protecting Critical Infrastructure Matters For Tanzania’s Digital Transformation

Digital transformation moves more of everyday life onto digital systems: payments and banking, mobile and internet services, health services, ports and logistics, public services. The further this goes, the more the country depends on those systems staying available and trustworthy. The approach taught during the week starts from that dependency. Identify which services are truly critical, map what they rely on, including suppliers and third parties, manage the risks, test the defences, and prepare to respond and recover. For the organisations that run these services, the aim is the one Dr Mwasaga described: systems that stay available and that citizens can trust.

Participants do not work alone. Tanzania has a national computer emergency response team, TZ-CERT, established under section 124 of the Electronic and Postal Communications Act (EPOCA) of 2010 within the Tanzania Communications Regulatory Authority (TCRA), one of the agencies under the Ministry of Communication and Information Technology. TZ-CERT coordinates the response to cybersecurity incidents at the national level and cooperates with regional and international partners. National press reports on the International Telecommunication Union’s Global Cybersecurity Index 2024 described Tanzania as one of the leaders in Africa.

For an operator in banking, telecommunications, energy, health, or government, a national incident response function means a counterpart to report to and coordinate with when something goes wrong. The final day of the training, on SOC and situational awareness, incident and crisis management, and crisis communication, was about making each operator’s own team a capable partner in that network.

An expert interviewed by TBC encouraged participants to use TZ-CERT’s resources and to report incidents to it. TZ-CERT accepts reports from its constituents, which include government bodies, critical ICT infrastructure operators, defence and security organs, financial institutions, academic institutions and the general public. Reports can be made through the online form at tzcert.go.tz, by email to incidents@tzcert.go.tz or by telephone on +255 22 2412039, during office hours from Monday to Friday, 8 am to 4 pm (details as published by TZ-CERT).

The legal framework also recognises critical information infrastructure. The Cybercrimes Act, 2015 allows the Minister to designate a computer system as critical information infrastructure by order published in the Gazette, and it provides for stiffer penalties for offences committed against it. Whether an organisation has a legal duty to report an incident depends on its sector, its licence conditions and the laws that apply to it, since public institutions, communications providers and organisations that handle personal data can each have specific obligations, so organisations should check which apply to them.

The same thinking applies to the country’s long-term plans. Tanzania Development Vision 2050 (Dira 2050) is the framework for the national ambition. The Citizen reported in January that ICTC has built the theme of its annual conference around digital transformation for a prosperous, just, inclusive, and self-reliant nation, reflecting the priorities of Dira 2050. Clouds TV’s coverage also carried remarks that investors are willing to invest in Tanzania because they have confidence in its protection against cyber attacks, a reminder that security supports the investment climate as well as the reliability of services. A digital economy of that ambition needs dependable infrastructure, people who can defend it and organisations that can recover quickly when something goes wrong. Training professionals, adding them to the national database and encouraging them to train their colleagues is one practical way to build that capacity, and it follows the Twinning method’s train-the-trainer approach.

About Digital for Tanzania

Digital for Tanzania is an EU Twinning project supporting the digital transformation of Tanzania through government-to-government cooperation. It is led by HAUS Finnish Institute of Public Management, with the Estonian Centre for International Development (ESTDEV) and Germany’s Federal Ministry for Digital and Transport and Federal Ministry for Economic Affairs and Climate Action (backed by GIZ) as junior partners. The project runs from 14 July 2023 to 31 December 2026 with a budget of €2,000,000, funded by the Delegation of the European Union to the United Republic of Tanzania and the East African Community. The Ministry of Communication and Information Technology (MCIT) is the beneficiary organisation. Mika King is the Member State Project Leader, and Dr Nkundwe Mwasaga, Director General of ICTC, is the Beneficiary Country Project Leader.

The project’s specific objectives are to future-proof Tanzania’s cybersecurity, privacy and data protection framework and skills; to strengthen interoperability, data governance and management capacity in government; and to improve cybersecurity, privacy and data protection skills in the private sector and research community, including addressing the gender digital divide.

 

 

This article was produced with the financial support of the European Union. Its contents are the sole responsibility of HAUS Finnish Institute of Public Management and do not necessarily reflect the views of the European Union.