support of stability and security in the use of ICTs – including national cybersecurity strategies and cybersecurity and cybercrime legislation, and relevant international agreements–, these should be rights-respecting and developed in an open, inclusive, and transparent way.  Examples of good practices can therefore refer to frameworks that include explicit reference to the link between stability and security in the use of ICTs and human rights.vi Furthermore, they are likely to include protections for strong technical standards for the protection of data, networks and infrastructure including strong encryption standards and comprehensive data protection legislation.vii These measures increase stability and security in the use of ICTs in a rights-respecting way. On the other hand, ICT practices which are harmful from a rights-based perspective include arbitrary surveillance, censorship and network disruptions.viii Institute for International Cyber Stability  Kaspersky  We believe that further development of clear industry standards, technical requirements and security measures applied to ICT products and services will help build cyber resilience globally. When malicious cyber incidents occur States should be willing to discuss publicly why the incident rose to the level of violating one of the 11 agreed UN GGE norms and specifically whether international law was breached. Tying specific incidents to specific norms and specific international rules will help clarify what the norms are and the law is as well as implement the 11 norms. This will also serve as a means to socialize or internationalize the norms.  Such standards and best practices have to be industry-led, consensus driven, interoperable and global to ensure they are applied consistently and universally.  A good example of such efforts is the Cybersecurity Act of the European Union, which prescribes the creation of the European Cybersecurity Certification Framework19 through a multistakeholder approach (namely, through a creation of Ad-Hoc Working Groups and the Stakeholder Cybersecurity Certification Group).  An additional example is the publication of draft guidelines on data protection ‘by design’ and ‘by default’ by the European Data Protection Board for a public consultation20. This illustrates how the concept and its technical and organizational measures have to be developed and applied according to industry’s best practices and experience. Kaspersky has also shared its recommendations.ix Greater transparency on Member States’ activities in cyberspace and the rationale that informs their decision-making would reduce uncertainty and contribute to greater stability in cyberspace. In particular, it includes policy directives that outline priorities and intentions, strategy documents on ICT governance; ICT program budgets and roadmaps; descriptions of their initiatives to coordinate and cooperate with the community, including private sector, technical community, academia and civil society, on the beneficial use of ICTs.  Microsoft  In the wake of international ICT incidents, we encourage governments to explain how such actions violate international expectations for responsible behavior. Even coordinated attributions today often fail to explicitly connect the malicious activity with particular norms or international legal standards they have transgressed – including, for example, the Budapest Convention. Tech Accord  First of all, governments should adopt and implement comprehensive national cybersecurity strategies, with the aim of increasing the resilience of their domestic online environment. Whenever possible these should incorporate an international cybersecurity strategy component.  Secondly, we encourage governments to adopt and make public their military doctrines, in particular as they relate to the online environment.  Thirdly, we encourage governments to establish, fund, and maintain Computer Emergency Response Teams (CERT) and ensure that they are able to coordinate, share good practice, and partner in response to an online incident.  Fourthly, we encourage governments to publish detailed statements explaining how they interpret the application of international law to cyberspace. @DFAT DFAT.GOV.AU