Cybersecurity Priorities for the First 180 Days of Democratic Transition in Iran

Executive Summary

Phase 1: Immediate Stabilization and Visibility (Days 0 to 10)

The First 72 Hours

Priority actions should focus on preventing irreversible damage and maintaining continuity in the most sensitive environments.

1. 1Telecommunications and internet backbone continuity — Secure physical and logical access around internet exchange points, core routing infrastructure, major telecommunications facilities, and primary data centers. The purpose is not aggressive reconfiguration, but continuity, defensive control, and rapid visibility.
2. 2Privileged access containment — Freeze or strictly review high-risk privileged remote access to critical government, telecommunications, and infrastructure networks. Emergency credential review should begin immediately for the most sensitive administrative roles.
3. 3Interim national cyber coordination cell — Stand up an interim operational coordination capability aligned with the broader transition framework. This should function as a 24/7 incident and decision-support node for critical sectors, especially while more formal institutions are taking shape.
4. 4Sectoral triage — Immediate defensive prioritization should cover electricity, water, transport, telecom, and critical public records. These systems carry disproportionate national risk if disrupted.

Days 1 to 10

The second layer is rapid visibility without destabilizing fragile systems.

1. 1Passive asset discovery and monitoring — Deploy passive monitoring and visibility measures across priority OT, telecom, and government digital environments. Legacy systems should be observed before they are aggressively changed.
2. 2Insider-risk and lateral-movement reduction — Critical networks should undergo emergency access review to reduce unauthorized privilege persistence, internal sabotage risk, and uncontrolled movement between systems.
3. 3Emergency playbooks for operators — Facility operators and technical teams should receive short sector-specific emergency cyber procedures covering communications continuity, incident escalation, credential containment, and manual fallback actions.

Phase 2: Structured Response and Interim Governance (Days 11 to 100)

Days 11 to 40

1. 1Interim CERT/CSIRT capability — A national incident coordination capability should begin operating on a continuous basis to support detection, triage, escalation, threat-information exchange, and recovery support across industrial, telecom, and government sectors.
2. 2Criticality-based classification — Operators, providers, and agencies should be categorized by criticality so limited resources can be assigned rationally.
3. 3Secure remote access for authorized transition personnel — As transition structures mature, identity-based controls should replace improvised access patterns. This reduces both operational confusion and abuse risk.

Days 41 to 100

1. 1Interim cyber authority model — The transition period should define clear operational jurisdictions, ministerial interfaces, and escalation channels for cyber response and critical infrastructure coordination.
2. 2Democratic oversight principles — Any transitional surveillance, lawful interception, or emergency telecom control must be tightly constrained, documented, and subject to democratic and human-rights-compatible oversight.
3. 3Minimum national baselines — Publish the first mandatory baseline requirements for critical operators and telecommunications providers, including incident reporting, severity classification, escalation procedures, and access-control expectations.

Phase 3: Resilience and Long-Term Institutional Foundations (Days 101 to 180)

Days 101 to 130

1. 1OT/SCADA segmentation and containment — Industrial environments should be progressively segmented from business IT and exposed digital dependencies to reduce the blast radius of cyber incidents.
2. 2National telemetry and threat information exchange — Introduce centralized logging expectations, telemetry collection for priority sectors, and secure public-private threat-sharing channels.
3. 3International technical support — The Emergency Phase framework itself anticipates the need for rapid external support where national capacity is insufficient. This should be operationalized in a controlled, transparent, sovereignty-preserving way.

Days 131 to 180

1. 1National cyber governance structure — Transition from emergency coordination to durable national cyber governance, including long-term strategy, accountability, oversight, and implementation milestones.
2. 2AI-enabled resilience measures — Pilot narrowly scoped anomaly detection and resilience validation measures for critical infrastructure, especially where they improve visibility without destabilizing operations.
3. 3Trusted procurement and supply chain security — Introduce procurement principles that reduce long-term dependency on untrusted hardware, software, and unmanaged external service relationships.

Diaspora and International Advantage

Closing Position

This memo is not presented as an official institutional document. It is an author proposal designed to operationalize the public Emergency Phase transition logic in the domain of cybersecurity, telecom resilience, critical infrastructure defense, and accountable cyber governance. Its purpose is to support practical discussion, implementation planning, and expert coordination during a potential democratic transition in Iran.