Main aim No. 1: Capacity building The public, enterprises and government should have the knowledge, skills and equipment needed to cope with cyber security threats. Knowledge is the prerequisite for being able to build up capacity in cyber security. The challenge is similar to that in raising the level of traffic safety: There is a technical side, similar to having the highest possible standards of vehicle safety and well-constructed roads, etc. The ordinary person does not need to be a qualified mechanic to enjoy traffic safety, but he does need to be an active participant in traffic, with a certain knowledge of what constitutes safe vehicles and safe behaviour – this applying both to his own and to others’ – for his own good and that of other road-users. An active interest in security need not be daunting or difficult; on the contrary, it makes things easier for everyone. Security issues must be a part of people’s use of computers and other equipment from the outset when children are first introduced to them and so on up through the school system. Awareness-raising is a key component in the cyber security strategies of most of our neighbouring countries. It must extend to the design and use of equipment and respect for personal data. In Iceland as elsewhere, part of this knowledge involves how we speak about the subject, i.e. the vocabulary and use of terminology. If the subject is to thrive and develop, it will be necessary to standardise and coordinate this terminology. There must also be a clear division of responsibilities, defining who is to do what, how much responsibility lies with each user and what expectations can reasonably be made of others. Iceland has experts who have worked successfully together for many years. Nevertheless it is a major challenge to develop a reliable foundation on which to build a cyber security culture. The degree to which such a culture is established is one of the factors that investors take into account when they assess countries as potential locations for new projects. Measures 1. Awareness-raising Enhancement of general awareness of cyber security issues. 2. Terminology Relevant international definitions of important terms in cyber security to be collected and translated into Icelandic where necessary. 3. Education Cyber security to be included in all computer-related studies at all school levels. 4. Postgraduate studies Students with first degrees from Icelandic universities to have access to postgraduate studies in cyber security meeting requirements comparable to those made in the other Nordic countries. 5. Design values Secure design and personal data protection to be included in the basic values observed in Icelandic software development. 6. Personal data protection International standards and obligations regarding personal data protection to be taken into account when developing cyber security. 9