and pupils in primary and secondary education should be sensitised to cybercrime and cyber security when acquiring digital competences in schools. The EU, together with the Member States, should also make a contribution to this work by building on the work of the Digital Skills and Jobs Coalition52 and by putting in place, for example, apprenticeship schemes in cybersecurity for SMEs. 2.7 Promoting cyber hygiene and awareness With some 95 % of incidents said to be enabled by "some type of human error – intentional or not",53 there is a strong human factor at play. So cybersecurity is everyone's responsibility. This means personal, corporate and public administration behaviour must change to ensure everybody understands the threat, and is equipped with the tools and skills necessary to quickly detect and actively protect themselves against attacks. People need to develop cyber hygiene habits and businesses and organisations must adopt appropriate risk-based cybersecurity programmes and update them regularly to reflect the evolving risk landscape. The NIS Directive not only sets out the responsibilities of Member States to exchange information on cyber-attacks at EU level but also to put in place mature national cybersecurity strategies and frameworks on the security of network and information systems. Public administrations at EU and national level should play a further leading role in driving these efforts forward. First, Member States should maximise the availability of cybersecurity tools for businesses and individuals. In particular, more should be done to prevent and mitigate the impacts of cybercrime on end-users. An example already exists in the work of Europol with the 'NoMoreRansom' campaign54, built up through close cooperation between law enforcement and cybersecurity companies to help users prevent ransomware infections and decrypt data if they are victims of an attack. Such schemes should be rolled out for other types of malware, in other areas and the EU should develop a single portal to bring together all such tools in a one-stop-shop, offering advice to users on prevention and detection of malware and links to reporting mechanisms. Second, Member States should accelerate the use of more cyber-secure tools in the development of e-government and also draw full benefit from the competence network. The adoption of secure means of identification should be promoted, building on the EU framework of electronic identification and trust services for electronic transactions in the internal market, which has been in force since 2016 and provides a predictable regulatory environment to enable secure and seamless electronic interactions between businesses, individuals and public authorities.55 In addition, public institutions, especially those providing essential services, should ensure that their staff are trained in cybersecurity-related areas. Third, Member States should make cyber-awareness a priority in awareness campaigns, including those targeting schools, universities, the business community and research bodies. The Cybersecurity month that takes place every year in October under the coordination of ENISA will be scaled up to achieve a greater reach as a common communication effort at EU 52 53 54 55 https://ec.europa.eu/digital-single-market/en/digital-skills-jobs-coalition. IBM "The Cybersecurity Intelligence Index" 2014, referred to in Securitymagazine.com, 19 June 2014. https://www.nomoreransom.org/. The Regulation (EU) N°910/2014 on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation) adopted on 23 July 2014. Also, the European Commission is providing building blocks and tools for eID and e-Signature interoperability (e.g. Trusted Lists Browsers) through the Connecting Europe Facility Programme. 11