being covered by NCSS and management plans preventing leaks and ensuring the adequate protection of this information. 2.2. Content and procedure for adoption of the national strategies. Pursuant to Article 7 of the NIS Directive, a NCSS needs to include at least the following: i) objectives and priorities of the national strategy on the security of network and information systems; ii) a governance framework to achieve the objective and priorities of the national strategy; iii) the identification of measures relating to preparedness, response and recovery, including cooperation between public and private sectors; iv) an indication of relevant education, awareness-raising and training programmes; v) an indication of research and development plans; vi) a risk assessment plan to identify risks; and vii) a list of the actors involved in the implementation of the strategy. Neither Article 7 nor the corresponding recital 29 specify the requirements for adoption of an NCSS or provide more granularity on the content of the NCSS. As far as process is concerned and additional elements related to the content of the NCSS, the Commission considers the approach set out below as one appropriate way of adopting a NCSS. This is based on the analysis of Member States and third countries' experiences of how Member States have developed their own strategies. A further information resource is ENISA's NCSS training tool available as video clips and downloadable media on its website4. 2.3. Process and issues to be addressed. The process of drafting and the subsequent adoption of a national strategy is complex and multifaceted, requiring sustained engagement with cybersecurity experts, civil society and the national political process if it is to be effective and successful. A sine qua non is senior administrative support at least at State Secretary or equivalent level in the lead ministry, as well as political sponsorship. In order to successfully adopt a NCSS, the following a five step process (see Figure 1) can be considered: First step - Establishment of guiding principles and strategic goals arising from the strategy. First of all, national competent authorities should define some key elements to be included in the NCSS, namely what are the desired outcomes, in the Directive parlance (Art. 7(1)(a) 'objectives and priorities', how do such outcomes complement national social and economic policies and are they compatible with the privileges and obligations arising from being a Member State of the European Union. Objectives should be specific, measurable, achievable, realistic and time-bound (SMART). An illustrative example is the following: "We will ensure 4 https://www.enisa.europa.eu/topics/national-cyber-security-strategies/national-cyber-security-strategiestraining-tool 6