that this [time bound] strategy is founded upon a rigorous and comprehensive set of metrics against which we measure progress towards the outcomes we need to achieve"5 The above also encompasses a political assessment as to whether a significant budget can be obtained to resource the implementation of the strategy. It also entails a description of the intended scope of the strategy and the various stakeholder categories from public and private sectors who should be involved in the drafting of the various objectives and measures. This first step could be achieved through focused workshops with senior ministry officials and politicians moderated by cyber specialists with professional communication skills who can highlight the implications of no or weak cyber security for a modern digital economy and society. Second step - Development of the strategy's content. The strategy should contain enabling measures, time-based actions and key performance indicators for resulting evaluation, refinement and improvement after a defined implementation period. These measures should support the objective, priorities and outcomes set forth as guiding principles. The need to include enabling measures is set forth in Article 7(1)(c) of the NIS Directive. It is recommended that a steering group chaired by the lead ministry be formed to manage the drafting process and facilitate input. This could be achieved through a number of drafting groups of relevant officials and experts around key generic themes, for example risk assessment, contingency planning, incident management, skills development, awareness raising, research and industrial development etc. Separately, each sector (for example energy, transport etc.) would also be invited to assess the implications of their inclusion, including resourcing, and involve the designated operators of essential services and key digital service providers in determining priorities and submitting proposals to the drafting process. Involvement of sectoral stakeholders is essential also bearing in mind the need to ensure a harmonised implementation of the Directive across different sectors, while at the same time allowing for sectoral specificity. Third step - Development of a governance framework. In order to be efficient and effective, the governance framework should be based on key stakeholders, identified priorities in the drafting process and on the constraints and context of the national administrative and political structures. It would be desirable to have direct reporting to the political level, with the framework having a decision-making and resource allocation capability, as well as input from cybersecurity experts and industry stakeholders. Article 7(1)(b) of the NIS Directive refers to the governance framework and specifically requires 'the responsibilities of the government bodies and the other relevant actors'. 5 Extract from the UK's National Cyber Security Strategy, 2016 -2021, page 67. 7