identifying the critical elements of both a state’s CII and critical information infrastructures (CII) elements of critical infrastructure is emphasised in the good practice guidance available from the GFCE. This includes the importance of a coordinated approach between all actors involved in CIIP and CIP. An example of a multi-layered, intra-sector and coordinated approach, which integrates the protection of CII and CI is provided by Estonia’s CIP policy.xxv  Personal data, including sensitive personal data, is often compromised as a result of incidents which affect CII and or/CI. At the same time access and monitoring of data is required to identify and manage risks. Therefore, it’s important to recognise that CIIP and/or CIP policies should be consistent with privacy and data protection regulations.xxvi For example, sharing of information on risks and incidents to the national competent authorities might require processing of personal data and therefore should comply with privacy and data protection regulations and protect the right to privacy. ICRC & Australian Red Cross  While cyber security and defence are constantly improving, older systems with outdated or even non-existent cyber security are particularly vulnerable to cyber attacks and will remain a concern in the years to come. Both the public and private sectors have a role to play through industry standards and legal regulation.xxvii  In the health-care sector, for instance, the regulatory environment should be adapted to the increased risk, such as through standardisation requirements, with a view to ensuring resilience in the event of a cyber attack. Cyber security needs to be taken into account in the design and development of medical devices and networks and updated throughout their lifetime, no matter how long they last. Similarly, for industrial control systems, industry standards, whether imposed or self-imposed, are critical. This includes reporting incidents and sharing information between trusted partners.xxviii  In terms of IHL, parties to armed conflicts must take all feasible precautions to protect civilians and civilian objects under their control against the effects of attack. This is one of the few IHL obligations that States must already implement in peacetime, especially with regard to fixed installations. While cyberspace is a virtual global domain, the obligation to take precautions against the effects of attacks extends at least to the physical infrastructure of cyberspace (and to objects whose functioning depends on that infrastructure) located in a State’s territory, or in any territory that may be occupied by a party to the conflict.xxix  Among many other avenues that could be explored,xxx States could consider creating a “digital watermark” to identify certain actors or infrastructure in cyber space that must be protected (such as objects that enjoy specific protection under IHL). The aim would be to help their identification and prevent them from being targeted during armed conflicts. The potentially positive effects in terms of protection against unintended harm by law-abiding actors would however need to be balanced against the risk of disclosing information on critical infrastructure to potential adversaries, including criminals. The prospects of positive effects might depend in part on attribution becoming easier.xxxi Institute for International Cyber Stability  States should develop domestic plans and policies for critical infrastructure cybersecurity (i.e., US Commerce Department, NIST Cybersecurity Framework). States should also invest in training of relevant stakeholders in the different sectors of critical infrastructure. Kaspersky  To address the rapid development of emerging technologies and the resulting changing threat landscape that has the potential to impact the critical infrastructure protection, we suggest the following actions: - a government-industry supply chain security task force to identify best practices, guidelines and lessons learned for secure technology procurement, and evaluation of ICT suppliers’ trustworthiness; - transparency vulnerability management programs to ensure the integrity of critical infrastructure by ensuring operators can fix vulnerabilities before they are exploited by hostile actors; and @DFAT DFAT.GOV.AU