Fourth step - Compilation and review of the draft strategy. At this stage, the draft strategy should be compiled and reviewed by using strengths, weaknesses, opportunities and threats (SWOT) analysis, which could define whether it would be necessary to revise the content. Following the internal review, stakeholder consultation should take place. It would be essential to also undertake a public consultation to highlight the importance of the proposed strategy with the public, receive input from all possible sources and seek support for the resourcing required to subsequently implement the strategy. Fifth step – Formal adoption. This final step involves formal adoption at political level with an enabling budget that reflects the seriousness which the Member State concerned attaches to cybersecurity. To achieve the objectives of the NIS Directive and, in communicating the national strategy document to the Commission pursuant to Article 7(3), the Commission encourages Member States to provide information on the budget. Commitments concerning budget and necessary human resources are absolutely critical for the effective implementation of the strategy and the Directive. As cybersecurity is still a rather new and rapidly expanding area of public policy, new investments are required in most cases even if the overall situation in public finances calls for cuts and savings. Advice on the process and content of national strategies is available from various public and academic sources, for example ENISA6, the ITU7, the OECD8, the Global Forum for Cyber Expertise and the University of Oxford9. 2.4. Concrete steps that Member States must undertake before the transposition deadline. Prior to the adoption of the Directive, almost all Member States10 had already published documents indicated as NCSS. Section 6 of this Annex lists the strategies currently in place in 6 ENISA, National Cyber-Security Strategy Good Practice 2016). Available at https://www.enisa.europa.eu/publications/ncss-good-practice-guide 7 ITU, National Cybersecurity Strategy Guide (2011). Available at http://www.itu.int/ITUD/cyb/cybersecurity/docs/ITUNationalCybersecurityStrategyGuide.pdf ITU will also release a National Cyber Security Strategy Toolkit in 2017 (see presentation at http://www.itu.int/en/ITU-D/Cybersecurity/Documents/National%20Strategy%20Toolkit%20introduction.pdf) 8 OECD, Cybersecurity Policy Making at a Turning Point: Analysing a New Generation of National Cybersecurity Strategies (2012). Available at: http://www.oecd.org/sti/ieconomy/cybersecurity%20policy%20making.pdf 9 Global Cyber Security Capacity Centre and University of Oxford, Global Cyber Cybersecurity Capacity Maturity Model for Nations (CMM) Revised Edition (2016). Available at: https://www.thegfce.com/binaries/gfce/documents/publications/2017/02/13/cybersecurity-cmm-fornations/CMM+revised+edition.pdf 10 Apart from Greece where a national cyber security strategy is under preparation since 2014 (see at https://www.enisa.europa.eu/topics/national-cyber-security-strategies/ncss-map/strategies/national-cybersecurity-strategy-greece/view) 8