CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND 5. Specific objective 1 – Development of the national cybersecurity system As part of the legislative work, the minister competent for digitalisation, in cooperation with other ministries and competent authorities responsible for supervision of ICT systems in respective sectors, shall review sectoral and specific regulations which address the subject in question, as well as regulations which might affect other areas, for example personal data protection or critical infrastructure in the context of the National Critical Infrastructure Protection Programme. It shall also be necessary to undertake legislative work to regulate the area of development, acquisition and operation of specialised dual-use tools for the purpose of defensive and offensive operations in cyberspace. 5.1 Implementation and evaluation of the functioning of the provisions regarding the national cybersecurity system T he development of the national cybersecurity system is based on full implementation and evaluation of the functioning of provisions establishing the system, by reference to other regulations, in particular the Act of 26 April 2007 on crisis management (Journal of Laws of the Republic of Poland of 2019, item 1398), the Act of 5 August 2010 on the protection of classified information (Journal of Laws of the Republic of Poland of 2019, item 742) and the National Security Strategy of the Republic of Poland. The evaluation may entail the necessity to introduce respective amendments of provisions which remove barriers to effective information sharing and responding to incidents in a coordinated and unhindered manner. Amendments to regulations regarding the functioning of the national cybersecurity system shall arise also from practical functioning of Directive (EU) No. 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (Official Journal of the EU, L 194, 19.07.2016, p. 1), hereinafter referred to as „the NIS Directive”, at the European level. Experience arising from application 12 The responsibility for drafting amendments to regulations in the area of cybersecurity within their respective remits shall rest on competent ministers as defined in the Act of 4 September 1997 on divisions of the government administration (Journal of Laws of the Republic of Poland of 2019, items 945, 1248 and 1696) and competent authorities in accordance with the Act of 5 July 2018 on the national cybersecurity system. The implementation of the Cybersecurity Strategy shall involve regulating the issues of operational cooperation, including proper coordination of actions and information sharing between authorities responsible for the national security, counter-terrorist efforts as well as internal security and public order. of regulations in this respect shall also be a premise to request amending the provisions of the NIS Directive itself at the EU level in order to improve its effectiveness. Among areas requiring such amendments shall be further specification of responsibilities of digital services providers, specifically ones that provide cloud computing services which will be increasingly used as a data processing model for essential services. Due to rapid pace of changes occurring in area of cybersecurity, it will be necessary to continuously monitor the phenomena taking place there and initiate possible amendments in the law. Proposed directions and plans regarding counteracting cyber threats shall be reviewed by the Advisory Committee for Cybersecurity under the Council of Ministers. It is a consultative and advisory body of the Council of Ministries in cybersecurity matters. Among its remits is also evaluation of operations of CSIRT MON, CSIRT NASK, CSIRT GOV as well as sectoral cybersecurity teams and competent authorities for cybersecurity. 13