Norm 6 – A State should not conduct or knowingly support any ICT activity contrary to its obligations under international law that intentionally damages critical infrastructure or otherwise impairs the use and operation of a critical infrastructure to provide services to the public. As responsible States, G7 countries have reaffirmed support to this norm and promoted it at the international level. Several of them have made clear that the use of sovereign offensive cyber capabilities must be governed in accordance with international law, including humanitarian law. Norm 7 – States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account, inter alia, General Assembly Resolution 58/199 (2003) “Creation of a global culture of cybersecurity and the protection of critical information infrastructure”, and other relevant resolutions. To protect their critical infrastructure from ICT threats, G7 countries have: - - - Established effective regulatory frameworks, requiring companies to increase their level of protection, have appropriate cyber resilience and report cyber incidents – this has notably entailed strengthened cooperation between the public and private sector, especially with operators and systems deemed essential or critical; Promoted regional and international cooperation on this issue, including through the sharing of best practices, information on specific threats and incidents, and the development of confidence-building measures between States; Developed education, training and cooperation programmes and activities to increase their capabilities and resources in this field. Norm 8 - States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at another State’s critical infrastructure emanating from their territory, taking into account due regard for sovereignty. To facilitate the response to appropriate requests for assistance, G7 countries have established clear and operational permanent points of contact. These are usually located within the national CERT/CSIRT and available 24/7. They are shared with other members of Page 4 out of 5 For Official Use Only