A/75/123 With regard to the enhancement of cooperation, including the development of focal points for the exchange of information on malicious ICT use and the provis ion of assistance in investigations, it is important to note the work being done by various government authorities and entities on the preparation of a national incident management protocol, which is aimed at promoting early and coordinated efforts to address cybersecurity incidents that may threaten the economic and social order or national security. The implementation of this protocol is critica l, as it focuses on identifying the incident, examining the facts, considering the threat and identifying the appropriate method of containment or correction. Within the Attorney General’s Office there are three groups responsible for addressing issues related to cybercrime, which provide expert support and assistance in investigations arising from requests for mutual legal assistance in which the malicious use of ICTs is observed. These groups are: (a) the Office of the Prosecutor for Combating Organiz ed Crime; (b) the Office of the Prosecutor for Citizen Security; and (c) the Directorate of the Technical Investigation Corps. In addition to providing assistance in investigations, these expert groups promote, within the Attorney General’s Office, new trends and best practices related to cybercrime and digital evidence. The Directorate of International Affairs of the Attorney General’s Office is supported by the various specialized prosecutors and by the Office’s cybercrime groups in conducting investigations related to cybercrime. The United States Department of Justice has provided training on issues related to requests for mutual legal assistance. In the United States, requesting authorities are required to meet certain evidentiary benchmarks and stan dards in order to gain access to stored electronic communications. Specifically, they must provide articulable a nd chronological facts showing that there are reasonable grounds to believe that the electronic records are relevant and material to an ongoing investigation. They must also demonstrate that there are sound and reliable facts, not merely presumed facts, which indicate that an offence has been committed, and that the email or social network account contains information related to the offence under investigation. Similarly, within the framework of international cooperation, the National Intelligence Directorate carries out two-way coordinated investigations and inquiries in response to direct requests from countries. International cooperation and assistance in information and communications technology security and capacity-building For Colombia, capacity-building is a key issue with regard to technology matters. Digital security risk management is an area in which States, the private sector and academia can work together, and consideration should be given to mechanisms for cooperation and international assistance for that purpose. It is important to involve different stakeholders in the analysis of the cybersecurity issue. Their assistance in both the identification and the adoption of preventive security measures and incident and emergency response measures is very valuable. It is important that States begin by identifying the areas in which they need to strengthen their capacities. For that purpose, they can use as a basis the capability maturity models that have been developed internationally. On that basis, they should design plans that include the development of operational, administrative, human and scientific capacities and physical an d 22/84 20-08285