Figure 1: 5-step-process to adopt NCSS Step 1 - Establishment of guiding principles and strategic goals arising from the strategy Desired outcomes ? Political assessment Scope of strategy Focused workshops Step 2 -Development of the strategy's content Objectives, measures, actions & KPIs Steering Group Drafting Step 3 - Development of a governance framework Roles & responsibilities, decision making & representation Relationship to political level Step 4 - Compilation and review of the draft strategy SWOT analysis, stakeholder engagement & public consultation Feedback loop Step 5 - Formal adoption Political level with structure and budget 3. NIS Directive: National competent authorities, single contact points and Computer Security Incident Response Teams (CSIRTs). Pursuant to Article 8(1), Member States are required to designate one or more national competent authorities, covering at least the sectors referred to in the Directive’s Annex II and the services referred to in its Annex III, with the task to monitor the application of the Directive. Member States can assign this role to an existing authority or authorities. 10