Zero-Trust and AI Governance Readiness in MENA Critical Infrastructure

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Zero-trust architecture and AI governance are converging as the twin pillars of criticalinfrastructureprotection, yet no existing public index measures both together for a givencountry. Global indices such as the ITU's Global Cybersecurity Index (GCI), the e-GovernanceAcademy's National Cyber Security Index (NCSI), and Tortoise Media's Global AI Index eachcapture one slice of the picture i.e., legal/technical cybersecurity commitment, or AI capacitywithout connecting either to the specific technical maturity of zero-trust controls onoperational technology (OT) and IoT-heavy critical infrastructure. This paper proposes theZero-Trust & AI Governance Readiness Index (ZAGRI), an evidence-weighted estimationframework that combines five dimensions — regulatory and legal foundation, institutionalcapacity, technical zero-trust maturity, AI governance and oversight, and threat resilience —using a source-credibility weighting scheme applied to publicly available benchmarks,regulatory documents, and threat reporting. We apply ZAGRI to Iraq, with the GCC leaders(UAE, Saudi Arabia, Qatar) and a MENA mid-tier cohort (Jordan, Egypt) as comparisonbaselines. Iraq's estimated composite score is 27.0 (± 9–11, “Nascent” tier), against 51.5 forthe MENA mid-tier and 68.3 for the GCC leaders. The gap is driven primarily by technicalzero-trust maturity and regulatory enactment rather than by the existence of strategydocuments, which Iraq has increasingly produced since 2020. We discuss Iraq's oil-and-gasand electricity sector exposure specifically, and outline a phased roadmap toward measurableimprovement. All results are explicitly scoped as estimates derived from secondary publicevidence, not as a certified or survey-based measurement, and are intended as a directionaltool for policymakers and critical-infrastructure operators rather than a definitive ranking.