CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND 7. Specific objective 3 – Increasing the national capacity in the area of cybersecurity technology T The acquisition of new technologies for development of domestic ventures shall also be realised through participation in international initiatives that emphasise innovation, and through bilateral cooperation and within international organisations, including the European Cybersecurity Industrial, Technology and Research Competence Centre planned by the European Commission and the EU’s Member States. Moreover, the government shall strive to actively disseminate knowledge and trainings among Polish entrepreneurs and to implement cybersecurity technologies enabling full use of the capabilities of other state-of-the-art digital technologies, including AI-based autonomous systems, in production and service provision processes. Actions shall be taken to stir the increase of cybersecurity competences of research and higher education institutions. By means of legal instruments, the government shall stir higher education institutions to provide teaching helpful in attracting cybersecurity specialist, including as part of first and second-cycle studies, doctoral schools and post-graduate programmes. In order to even the chances of Polish entrepreneurs on the global market, the government shall support development of digital competences of Polish businesses and ensure assistance in applying for funding of innovative solutions as well as consultancy regarding access to new markets and assistance in establishing cooperation with other businesses. 7.2 Focus on developing of public-private cooperation Ensuring security in cyberspace requires joint efforts of the private sector, the public sector and the citizens. The government shall continue to establish an effective public-private partnership system based on trust and shared responsibility for cybersecurity. Among examples of actions aimed at developing the Polish industry and its competitiveness in the digital transformation era is the „Industry 4.0” programme run by the minister competent for economy. As part of this programme, Digital Innovation Hubs will be selected by way of a competitive process which will provide standardised support to entrepreneurs in digital transformation, including in the area of cybersecurity. 9 22 In implementing a new vision of the country’s development and supporting the innovation of the Polish economy, it will be important to set up a system of support for research and development projects in the area of cybersecurity conducted in cooperation with the academia and businesses. 7.3 Stimulating research and development in the area of cybersecurity 7.1 Development of industrial and technological resources for the purposes of cybersecurity he government aims to invest in development of industrial and technological resources for the purpose of cybersecurity by creating the conditions needed for the development of businesses, in particular SMEs and start-ups, as well as research and development institutes which are dealing with a development of new solutions in the area if cybersecurity. The priorities include increased capabilities in the area of designing and producing software, hardware and services used in all branches of the Polish industry to improve its competitiveness. At the same time, public administration shall improve its capacity in initiating and running cybersecurity projects. The government shall also actively participate in the existing and emerging forms of European public-private cooperation, thus promoting Polish business internationally. In view of the dynamically growing IT market, especially in view of the shift to IPv6 communication protocol, and in connection with development of the Internet of Things, Smart Cities, Industry 4.0 as well as Cloud Computing, broadband mobile communication network (5G and next generations) and Big Data, it is necessary to intensify research, development and manufacturing activities in the area of cybersecurity. To this end, research programmes10 aimed at development and implementation of new methods of protection against cyber threats shall be continued in cooperation with the National Centre for Research and Development. In the face of the dynamical development of technologies related to inter alia the Internet of Things, special attention should be paid to the need to ensure product, service and process security as early as at the design stage (Security by Design)11 as well as data protection and privacy (Privacy by Design)12.The government shall disseminate and support the security-by-design approach. In addition, research programmes shall be developed in cooperation with the scientific and academic community in order to, in particular: • • • • • assess the effectiveness of protections and resilience to cyber threats; assess the effectiveness of responding to incidents; develop methods of detecting and analysis new types of cybercrime, cyberterrorism and cyberespionage; study methods of attacks (including attacks of a hybrid nature) and measures to counteract these attacks and mitigate their effects; protect democratic processes against disruption by cyber threats. 10 The Ministry of Digital affairs will continue to cooperate with the National Centre for Research and Development in inter alia the CyberSecIdent – Cybersecurity and e-Identity Programme. 11 Security by design – an approach to the product or system development which consists in considering security and integration of security features from the point of conception. Commission Communication „A European Security Research and Innovation Agenda – Commission’s initial position on ESRIF’S key findings and recommendations”/*COM(2009)691 final/. 12 Privacy by design – an approach to data and privacy protection involving appropriate technical and organisational measures, which are designed to implement data-protection principles taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing. Based on Article 25 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - Official Journal of the EU, L 119, 04.05.2016, pp 1). 23