Rural Gaps in Colombia's National Digital Trust and Security Policy: A Comparative Analysis with the ITU 2021 Guide and Proposal of a Rural Cyber Vulnerability Index (RCVI)

Abstract

CONPES 3995 and the National Digital Security Strategy 2025-2027 relegate structural vulnerabilities of rural Colombia, omitting radio spectrum underutilization, institutional weakness, digital illiteracy, and connectivity deficits. To address this, the country's regulatory framework is evaluated against the ITU 2021 Guide. Using a mixed-method approach with qualitative dominance, 36 regulatory sub-dimensions are scrutinized to support the proposal of a Rural Cyber Vulnerability Index (RCVI) that combines spectral exposure, local institutional capacity, dependence on essential services, and digital literacy. Applying the RCVI to 18 priority municipalities and analyzing Mitú, Bahía Solano, and Puerto Gaitán reveals relative progress; the 2025-2027 Strategy increases convergence with the ITU standard from 31% to 50% of the analyzed sub-dimensions, while a 19% exclusion persists, concentrated in operational preparedness (EP3) and international cooperation (EP7). The RCVI numerical model categorizes Mitú, Barrancominas, Inírida, and Puerto Carreño as high priority (RCVI ≥ 80), demonstrating the stability of the municipal ranking across alternative weighting scenarios (ρ >0.89). The concept of the “dynamic regulatory continuum” (from previous work) is extended through an additional rural cybersecurity layer with priority policies. The RCVI is consolidated as an open-access, replicable, zero-cost tool that provides decision-makers with an objective metric to focus digital security interventions on the most vulnerable areas.