v. Efforts to protect critical information infrastructures should be undertaken with due regard for applicable national laws concerning privacy protection and other relevant legislation. vi. In providing guidance for the implementation of norms (f) and (g), States note that highlighting particular sectors as critical infrastructure is not intended to be an exhaustive list, and does not impact on the national designation, or not, of any other sector, nor does it implicitly condone malicious activity against a category not specified. vii. The OEWG underscored that all States considered healthcare infrastructure, medical services and facilities to be critical infrastructure for the purposes of norms (f) and (g). The need to affirm the protection of health infrastructure was felt particularly strongly given that the OEWG developed its report in the context of the COVID-19 pandemic. h. States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty (2015 ¶13(h)). i. Implementing this norm involves consideration of appropriate requests for assistance and consideration of the nature of assistance that can be offered in a timely manner. States receiving an appropriate request for assistance following an ICT incident should consider, when possible, reasonable and appropriate: - Acknowledging receipt of the request via the relevant national point of contact; - Determining, in a timely fashion, whether it has the capacity and resources to provide the assistance requested. This may include identifying the expertise in the country from a range of stakeholders; - In its initial response, indicating the nature, scope and terms of the assistance that might be provided, including a timeframe for its delivery; and - In the event that assistance is agreed upon, promptly providing the arranged assistance. - Ensuring that requests for assistance, including relevant processes and resources such as frameworks and templates, and responses are consistent with human rights obligations. ii. Implementation of this norm would be further enabled by the prior existence of national structures and mechanisms, including a national point of contact, templates for assistance requests and confirmation of the assistance to be provided, and through targeted capacitybuilding and technical assistance. Bilateral and multilateral cooperation initiatives, international and regional organizations and fora can play a role in facilitating their development. Approaches that could positively contribute to the implementation of this norm could include: greater public-private-CSO collaboration, nationally and internationally, especially to take preventative actions; improving the capacity of incident response teams through a tailored approach to cyber capacity development; and specialised training to build cyber capacity at all levels of States and across society. i. States should take reasonable steps to ensure the integrity of the supply chain so that end users can have confidence in the security of ICT products. States should seek to prevent the proliferation of malicious ICT tools and techniques and the use of harmful hidden functions (2015 ¶13(i)). i. To implement this norm, States should: - Take steps, including through existing fora, to prevent the proliferation of malicious ICT tools and techniques. In doing so, States should encourage the legitimate activities 14