•
•
•
Harmonise existing national laws with Cybersecurity needs;
Develop and maintain appropriate enforcement mechanisms including cross-border
co-operation and mutual assistance;
While maintaining and protecting privacy and civil liberties of individual.
4.6.3 Capacity Development
Cybersecurity being a new and fast evolving field, national Cybersecurity strategies
should address the acquisition of required skills and competencies. It is quite likely that
there will be skills shortages in many areas including across all the stakeholders needed
even just to develop the national strategy. In view of the range of stakeholders and
institutions involved, a training needs assessment is recommended, including those that
are initially ancillary to the Cyber agenda, in order to develop adequate, comprehensive
capacity building programmes. Given the fast pace and unpredictable nature of
developments in Cyberspace, training needs will require continuing reassessment.
Appendix 2 offers some possible approaches.
4.6.4 Awareness
In view of the potential impact on general public, raising awareness across all sectors
and levels of society is a critical component of any Cybersecurity strategy. The awareness
campaign should be designed to sit alongside the capacity building activity, providing a
simpler message to a much wider audience. The Commonwealth Cybergovernance Model
principles emphasise that users have rights and responsibilities, including operating in
Cyberspace with an acceptable level of Cyber hygiene. This includes taking proportionate
responsibility for their ICT systems and for their behaviour on-line. Appendix 2 describes
some of the measures adopted by countries to increase Cybersecurity awareness of
citizens.
4.6.5 Incident response
It is no longer possible to construct the necessary defensive mechanisms to guarantee
that there will never be an incident to jeopardise the safety, security and resilience of the
country’s use of Cyberspace – that is not a viable strategy – therefore, national
Cybersecurity strategies must plan for incidents. Those incidents will often require a
range of stakeholders to pool their knowledge and skills in order to bring swift remedy yet
many of those stakeholders will be commercial rivals in the private sector. Sensitive
commercial and personal data may need to be shared in a trusted, proportionate and
legally-permitted fashion, encouraged and obliged by national policy, while protecting
the interests of the data owners.
Governments are uniquely placed in terms of national visibility, national responsibility
and commercial impartiality to bring representatives from across the public sector,
private sector, civil society and academia together in order to share vital, timely
information about new and novel incidents. Governments are also uniquely placed to
establish operational links with neighbouring governments, to share information of
common and mutual interest in a similar manner. Such relationships often develop
based on personal trust between individuals, operating with the consent of their parent
organisations, within a legal framework.
Page 12 of 33
www.cto.int