to work towards defining a menu of lawful responses that could actually hold violators accountable while deterring others from undertaking similar acts, as outlined in our response to question #4 below.xxiii Tech Accord  Firstly, it is clear that increased transparency around state activity online will help increase the stability and security of our common online environment. The Cybersecurity Tech Accord signatories therefore urge states to issue commitments that they will act in accordance with international law as well as norms of responsible state behavior agreed at the UN.  Secondly, we encourage states to go a step further and be transparent around how they interpret and implement international law and norms. This will not only help solidify these frameworks, but also allow other stakeholders to understand what cyber operations might be seen as permissible and which ones might draw consequences.  Thirdly, we urge states to adopt national critical infrastructure protection frameworks. This would not only serve to implement norm g (see below), but also increase transparency around what particular states consider critical infrastructure under their domestic frameworks.  Finally, we encourage states to develop effective accountability frameworks, which would allow perpetrators to be punished, and at the same time act as a deterrent against future violations. (g) States should take appropriate measures to protect their critical infrastructure from ICT threats, taking into account General Assembly resolution 58/199 on the creation of a global culture of cybersecurity and the protection of critical information infrastructures, and other relevant resolutions; Asia Pacific Network Information Centre  There is work to do to define what entails critical infrastructure. Australia’s submission to the UNOEWG process recognizes well this limitation. Something to consider is whether and how (g) also relates to the GCSC norm to protect the “public core”. If the interpretation is that (g) could include elements such as packet routing and forwarding infrastructure, naming and numbering systems, cryptographic mechanisms of security and identity, etc.; then there is much that related Internet organizations can contribute as best practice implementation. Australian Strategic Policy Institute, International Cyber Policy Centre  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with States’ efforts to protect their own critical infrastructure, examples of implementation include: Global Partners Digital - States conduct a mapping of their critical national infrastructure, and critical information systems - States organise regular critical infrastructure incident exercises/drills and/or conduct (sectoral) cyber risk assessments - States invest in developing a qualified and skilled workforce - National cyber security centres or CERTs have the ability and mandate to support critical infrastructure sectors in case of incidents - States make best practice cyber security guidelines available, like the Australian Government’s Information Security Manual. - States have legislation that describes cybersecurity responsibilities of critical infrastructure sectors in terms of information security and data protection, like the EU NIS Directive and GDPR, as well as Australia’s Security of Critical Infrastructure Act and the Australian Energy Sector Cyber Security Framework (AESCSF), and Indonesia’s 2019 implementing regulation (no. 71) in respect to the 2012 Law of Information and Electronic Transactions law.  A range of good practices resources exist to provide guidance on appropriate measures to protect critical infrastructure (CIP). These include those developed by multistakeholder initiatives, including the Global Forum on Cyber Expertise (GFCE), in collaboration with the Meridian process.xxiv They include reference to the importance of clearly defining critical infrastructure and engaging a wide range of stakeholders, including the technical community and civil society, due to the complex nature of the threat landscape.  These resources recognise that the identification and protection of critical information infrastructure (CII) should also be considered alongside CIP as critical infrastructure is increasingly dependent on ICTs. The importance of clearly @DFAT DFAT.GOV.AU