Microsoft  To effectively consider all relevant information, including the larger context of the event etc., we recommend leveraging the resources, experience and expertise from all relevant stakeholders – including from industry and civil society/academia. This will enable states to develop the best possible big-picture understanding and situational awareness. Tech Accord  First of all, governments should adopt a comprehensive incident response plan that prioritizes the mitigation of the incident. As part of the plan, relevant points of contact within government and critical infrastructures should be identified, and regular exercises should be conducted. Additional activities, such as e.g. staff exchanges could also be considered, assuming the necessary baseline level of trust has been built.  Secondly, governments should develop strategic and operational policies that inform their responses to cyber incidents, e.g. through military doctrine referenced above. Such transparency can increase predictability and promotes common understanding.  Thirdly, initiatives, such as the EU Cyber Diplomacy Toolbox can help make clear what are some of the responses that states can deploy as part of their response to an incident.  In particular it is important that diplomatic, economic, legal, and military options are all considered.  Fourthly, we welcome the fact that governments have begun sharing information and are becoming increasingly aligned in terms of attributing particular cyberattacks. We encourage governments to continue sharing the lessons learnt around different incidents.  Finally, the Cybersecurity Tech Accord signatories encourage governments to exchange information around particular cyberattacks with industry to ensure that the knowledge and situation awareness around a particular incident is as complete as possible. (c) States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs Australian Strategic Policy Institute, International Cyber Policy Centre Global Partners Digital  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with a State’s means and methods to prevent a its territory from being misused, examples of implementation include: - States’ actions in combating common forms of cybercrime, such as phishing, spoofing, DDoS attacks. Other examples include practices of rules-based DNS filtering (for instance at ISP level) and seeking community reports (like Indonesia’s patrolisiber.id). - such as Interpol ASEAN desk’s operations with the Indonesian National Police. - States’ ratification of the Budapest Convention or other international conventions addressing cyber and ICT-related crimes - States possessing operational cyber capacities in policing, law enforcement, counterintelligence and cyber defence - States’ criminalisation of wrongful acts, including computer misuse, through specific cybercrime legislation, updated criminal codes, jurisprudence or police operational policies. - States’ approach to combating cybercrime and enhancing security of the nation’s cyber ecosystem, like the UK’s Active Cyber Defence Program or government (loose) partnerships with ISPs and security researchers. - States declaring policy goals to combat transnational cybercrime, prevent terrorist use of the Internet and other potential wrongful acts, for instance in a national cybersecurity strategy or national cybercrime action plan.  This norm refers to the law of state responsibility and the principle of due diligence, which—under international law—obliges a state to not knowingly allow its territory to be used for acts contrary to the rights of other states. It can also be read to refer to the principle under international human rights law that states must protect against human rights abuses within their territory and/or jurisdiction by third @DFAT DFAT.GOV.AU