which, in general, Kaspersky products send to our cloud-based Kaspersky Security Network (KSN); and rebuild the source code to make sure it corresponds to publicly available modules. Our Transparency Centers are located in Zurich and Madrid and will soon be launched in Kuala Lumpur and São Paulo. Because of the pandemic, we are launching the remote access to some of the options for executive briefings provided at our Transparency Centers; - Secure and reliable engineering practices confirmed through third-party independent assessments, including the SOC 2 audit by a ‘Big Four’ accountancy firml and ISO 27001 certification (to be publicly announced in February 2020); - Vulnerability Management Program: responsible cooperation with security researchers and a Bug Bounty Program with awards of up to $100k for the most critical flaws found in Kaspersky’s systems. - To support capacity building for greater resilience to supply chain risks, Kaspersky launches its Cyber Capacity Building Program with dedicated training on product security evaluation to help companies, government organizations and academia to develop mechanisms to secure their ICT infrastructure. The training course would be available both online and offline and will include sections on source code review, threat modelling and vulnerability management.  Among industry-led initiatives addressing supply chain security, we would like to highlight the Software Trustworthiness Best Practicesli recently published by Industrial Internet Consortium. There Kaspersky shared its view on non-technical aspects that should be within the scope while measuring user trust in software.  There are some public sector-led best practices aimed at ensuring the security of supply chains in the IoT, and where Kaspersky was invited to participate: 1) the UK Consumer IoT Security Code of Practicelii - which was the basis of the ETSI TS 103 645 standard; and 2) ENISA’s annual studies for the Good Practices for Security of IoT – Secure Software Development Lifecycle.liii  These examples illustrate cooperative work to address existing gaps in software development, and we believe that this format with industry’s engagement in producing guidelines and best practices for addressing supply chain risks has to be applied further. Microsoft  We encourage states to take a holistic approach to supply chain risk management, working to help all stakeholders mitigate risks to security and integrity not just at the procurement stage but also through strong internal controls, such as those related to configuration management, segregation of duties, change management, and access management. More broadly, states can help all stakeholders develop and implement effective approaches to supply chain risk management, which require understanding the lifecycle of threats and then applying a combination of policy, technical controls, operational controls, and vendor and personnel controls in a risk-based manner. Tech Accord  A foundational principle of the Cybersecurity Tech Accord is that its signatories will protect against tampering with and exploitation of technology products and services during their development, design, distribution and use. We strongly support this norm and encourage states to publicly commit to uphold it, including when it comes to considerations of weakening encryption or mandatory key escrow.  The Cybersecurity Tech Accord was partly created to stand for cybersecurity and in opposition to the emergence of an industry focused on selling vulnerabilities and surveillance technologies. We encourage states to not encourage those practices and to proactively seek to prohibit them.  We also encourage states to participate in the Wassenaar Agreement, which regulates transfers of dual used goods and technologies with military applications. However, we also urge states to consider more regular consultations with the industry when it comes to inclusion of new technologies into this framework. @DFAT DFAT.GOV.AU