NORM PACKAGE SINGAPORE CONTENTS 1. Explanation of the Norm Package and Focus of the GCSC 6 2. Norm to Avoid Tampering 8 “State and non-state actors should not tamper with products and services in development and production, nor allow them to be tampered with, if doing so may substantially impair the stability of cyberspace.” 3. Norm Against Commandeering of ICT Devices into Botnets 10 “State and non-state actors should not commandeer others’ ICT resources for use as botnets or for similar purposes.” 4. Norm for States to Create a Vulnerability Equities Process 12 “States should create procedurally transparent frameworks to assess whether and when to disclose not publicly known vulnerabilities or flaws they are aware of in information systems and technologies. The default presumption should be in favor of disclosure.” 5. Norm to Reduce and Mitigate Significant Vulnerabilities 14 “Developers and producers of products and services on which the stability of cyberspace depends should prioritize security and stability, take reasonable steps to ensure that their products or services are free from significant vulnerabilities, take measures to timely mitigate vulnerabilities that are later discovered and to be transparent about their process. All actors have a duty to share information on vulnerabilities in order to help prevent or mitigate malicious cyber activity.” 6. Norm on Basic Cyber Hygiene as Foundational Defense 16 “States should enact appropriate measures, including laws and regulations, to ensure basic cyber hygiene.” 7. Norm Against Offensive Cyber Operations by Non-State Actors 18 “Non-state actors should not engage in offensive cyber operations and state actors should prevent and respond to such activities if they occur.” 8. GCSC Membership 20