The policy also sets out the key stages of applying risk reduction to critical information infrastructures Stages of risk reduction Reducing risks in vital sectors High Financial sector Conduct Sector Baseline • • • Transportation uc d Re eR Impact isk Electricity and water Perform Sector/ National Risk Assessment Define Sector Plans • • • • • Prioritization of Sectors for Implementation Engagement of Stakeholders Identification of Critical National Services Identification of Supporting Critical Information Infrastructure Threat and Vulnerability Assessment Sector and National Cybersecurity Risk Assessment Identification of CII Cybersecurity Requirements Definition of Sector Plans Oil and gas Critical information infrastructure Low High Security vulnerabilities Low Monitor Implementation of Sector Plans • • Implementation of Sector Plans Monitoring of Implementation 11