Cyber Risk Barometer
Country profile · Cyber resilience

Monaco

Monaco has a national CERT, CERT MONACO, and our daily collector sees it publishing. Not scored: too little recent World Bank data for a fair score.

Publishing
National CERT
CERT-MC
70.0
Cyber resilience rating
B · Established · first pass, 3 of 7 pillars
Not ranked
Bloch Index rank
no separate Bloch Index score
First pass. This rating covers 3 of the methodology's 7 pillars, scored from evidence we already hold (treaty and adequacy registers, our own CERT list and collector, and passive checks of two government websites per country). It is a starting point, not a verdict: the remaining pillars, a wider government-domain sample and corrections from the countries themselves will move it edition by edition. Version v0.1 first pass, cut-off 2026-10-26.

Our cyber reasoning

The Cyber Risk Barometer rates countries on protection in practice, not on paper: each indicator is a public, checkable fact or something we measure ourselves. The seven pillars, their fixed weights and the A to E bands are set out in the methodology before any country is scored. This page shows every indicator we hold for Monaco, with the evidence behind it.

How the rating is built

Each pillar is scored 0 to 100 from its indicators. The rating is the weighted mean of the pillars scored so far, on the fixed weights published in the methodology. The 4 pillars not yet scored are left out and the weights renormalised, so this is a preview, 3 of 7 pillars.

PillarWeightScorePoints
Gold-standard data protection2050.020.0
National CERT in action15100.030.0
Government cyber hygiene, measured1566.720.0
Weighted mean70.0
Cyber resilience rating70.0 · B Established

Gold-standard data protection

20% of the rating
50/ 100 · 10 of 20 points

Is the country bound by Convention 108/108+, or recognised by the EU or UK as giving equivalent protection?

IndicatorEvidencePoints
✓ Ratified Convention 108+ (CETS 223)P1.108PLUSRatified 2025-03-06; party to Convention 108 since 2008-12-24 checked 2026-10-0810 / 10
✗ EU adequacy decisionP1.EUADQNone on the Commission's list checked 2026-10-080 / 8
✗ UK adequacy regulationsP1.UKADQNot on the ICO's list checked 2026-10-080 / 2
Sources: Council of Europe Treaty Office; European Commission and ICO adequacy lists.

National CERT in action

15% of the rating
100/ 100 · 9 of 9 measurable points (15 in all)

Is there a national CERT, and is it visibly working? Three of the six indicators are measured today from our own list and collector; the other three are still to be measured. Our daily collector reads every working feed, so "publishing" is observed, not declared.

IndicatorEvidencePoints
✓ A national (government-designated) CERT/CSIRT existsP2.EXISTSCERT MONACO4 / 4
✓ It is publishing: our daily collector sees a working feedP2.ACTIVE90Feed working4 / 4
✓ Machine-readable feed (RSS, Atom or JSON) or public advisoriesP2.FEEDFeed published1 / 1
· It is a FIRST memberP2.FIRSTNot yet measured– / 2
· It publishes regularly (12 or more items in the last 12 months)P2.REGULARNot yet measured– / 2
· It publishes an annual report or statisticsP2.REPORTNot yet measured– / 2
  • CERT MONACO (CERT-MC) · National CERT · Europe · languages fr · website · news · alerts · feed · status: feed ok
    WAF returns 403 'Request Rejected' to curl even for the feeds (verified in a real browser); AMSN news feed latest 2026-09-30.
Sources: Our national-CERT list (FIRST teams directory plus hand-added teams) and our daily feed collector; status checked 2026-10-26.

Government cyber hygiene, measured

15% of the rating
67/ 100 · 10 of 15 points

Do the country's own government websites and email domains follow basic security practice? First-pass sample: the national CERT's and the data protection authority's websites.

IndicatorEvidencePoints
✓ DMARC at p=quarantine or p=rejectP6.DMARC2 of 2 domains pass: amsn.gouv.mc, apdp.mc checked 2026-10-264 / 4
✓ SPF record present and not +allP6.SPF2 of 2 domains pass: amsn.gouv.mc, apdp.mc checked 2026-10-262 / 2
✗ DNSSEC: zone signed (DS record)P6.DNSSEC0 of 2 domains pass: none checked 2026-10-260 / 3
✓ HTTPS front page with a valid certificateP6.HTTPS2 of 2 domains pass: amsn.gouv.mc, apdp.mc checked 2026-10-263 / 3
✓ Strict-Transport-Security headerP6.HSTS2 of 2 domains pass: amsn.gouv.mc, apdp.mc checked 2026-10-261 / 1
✗ security.txt with a contactP6.SECTXT0 of 2 domains pass: none checked 2026-10-260 / 2

Domains sampled

DomainDMARCSPFDNSSECHTTPSHSTSsecurity.txt
amsn.gouv.mcCERT MONACO · national CERT✓✓✗✓✓✗
apdp.mcPersonal Data Protection Authority of Monaco (Autorité de protection des données personnelles, APDP) · data protection authority✓✓✗✓✓✗

A first-pass sample of the two government bodies most responsible for cyber and privacy. Passive lookups only: DNS records and the HTTPS front page.

Sources: Our own passive DNS and HTTPS checks of government domains.

Still to be scored

50% of the rating
4pillars to come

These pillars are defined in the methodology with fixed weights and yes / partial / no indicators against a fixed standard. They appear here, with every indicator and its evidence, as each is scored.

PillarWeightMain sources
Citizens' rights protectedDoes a GDPR-grade law give people enforceable rights, and does an independent authority use its powers?20Statutes; regulator sites; our fines data
Incident reporting and transparencyMust serious cyber incidents and personal-data breaches be reported, quickly, and does the public get to know?10Statutes and regulator rules
Cybercrime law and cooperationCan the country prosecute cybercrime and work across borders?10Council of Europe Treaty Office (Budapest Convention); UN cybercrime convention status; FIRST membership
AI and emerging-tech safeguardsAre there binding rules for high-risk AI and for connected-product security?10Statutes

Table: Cyber Risk Barometer · WLD-CRB-57 · Source: Cyber Risk Barometer national-CERT list (FIRST teams directory plus hand-added teams) and daily feed collector, status 2026-10-26; data/ratings.json v0.1 first pass

Context from the Bloch Index

Not scored: too little recent World Bank data for a fair score.

League table context

The connectivity and economic columns shown for Monaco in the league table. Fixed broadband is fetched live from the World Bank; the rest come from the Bloch Index's World Bank snapshot.

IndicatorValueYear
Fixed broadband per 100 people55.72024

Table: Cyber Risk Barometer · WLD-CRB-59 · Source: World Bank World Development Indicators (IT.NET.BBND.P2 live; IT.NET.USER.ZS, NY.GDP.PCAP.PP.CD, GC.DOD.TOTL.GD.ZS, SE.TER.ENRR via the Bloch Index snapshot 2026-10-05)

Memberships

Bloc and treaty memberships exactly as the Bloch Index records them (list updated 2026-08-30), so the two sites group countries the same way. The league table filters by them and the super league compares the EU, China and the United States.

Blocs and treaties

No bloc or treaty memberships are recorded for Monaco in the Bloch Index list.

Data sources

  • National CERT: the Cyber Risk Barometer's list of national CERTs and cyber agencies (FIRST teams directory, plus teams added by hand), and our daily feed collector, which records whether each team's feed is working. Master copy: the "CERTs & sources" tab of our data workbook. No contact data is collected.
  • Cyber pillars: methodology v0.1 (seven pillars, fixed weights, A to E bands), our own design; evidence from treaty offices, official adequacy lists, statutes, regulators and our own passive checks. Not derived from any other country cyber ranking.
  • Economy, Governance and Education: Bloch Index pillar scores and indicators (World Bank World Development Indicators and Worldwide Governance Indicators; OECD Main Economic Indicators for bond yields), snapshot 2026-10-05.
  • Memberships: Bloch Index country-memberships list.
  • Population (used to weight blocs in the super league): World Bank, via the Bloch Index.