Inter-ministerial committee The task of the Inter-ministerial committee to ensure high level political control and alignment with National Security interests and act as an overall coordinator for the cybersecurity of National Critical Information Infrastructure. The Inter-ministerial Committee is the cooperation format that enables to achieve crosssectoral agreements and thereby achieve the goals of the current strategy. The MoICT&NG is responsible for the monitoring and evaluation of the National Cybersecurity Strategy and will initiate the meetings of the Inter-ministerial Committee based on the needs. The National Information Security Advisory Group (NISAG) acts as coordination mechanism at the operative level that involves all relevant stakeholders. NISAG is responsible for fostering information flow and cooperation amongst all Critical National Infrastructure operators both in the public and private sectors. National Critical Information Infrastructure (NCII) Regulators Sectoral regulators supervise NCII operators within their sectors. Thereby they enforce and take lead of the protection of NCII withing their sectors. Regulators monitor compliance and performance of operators and support cross sector collaborations and capacity building. National Critical Information Infrastructure (NCII) Operators The role of NCII operators is to assess threats and vulnerabilities in their respective areas, analyse and report about cyber incidents and ensure compliance of the relevant cyber laws, policies and standards within their organizations. Another role of NCII operators is to design, implement and test institutional business continuity and Disaster Recovery Plans, and participate in cyber drills. Personal Data Protection Office is responsible for the overall enforcement of the Data Protection and Privacy Act, ensuring applicable administrative, civil or criminal sanctions and penalties, amongst others. 3.6.3 Legislative framework Collaborative ICT regulatory measures and tools are the new frontier for regulators and policymakers and they should work towards maximizing the opportunities afforded by digital transformation across industries. Uganda aspires to put its efforts in harmonizing and developing national cyberlaws to achieve the ambitions embarked upon by the Strategy. There is a need for designing a legislation that will enable and enforce incident reporting both in private and public sectors. To improve the trust and confidence towards digital transactions and e-services, GoU will enforce the adoption of digital standards, laws and regulation that ensure security of online transactions. 3.6.4 Action Areas To provide enabling framework and modernize legal environment, GoU will: a) Modernizing legal framework GoU will revise the legislation and bring it in line with the changing cyber and technological environment together with the regional and international Conventions to which Uganda has acceded. Regulative framework for the protection of National Critical Information Infrastructure will be provided to standardize the security requirements and practices for incident and risk handling procedures of the NCII operators. All NCII operators shall know, understand and follow their responsibilities as a key resource of Ugandas national cybersecurity. b) Foster Information Sharing Appropriate information sharing mechanisms/requirement for private and public sector will be established with legal measures. 33 (43) [Draft Version for stakeholder consultation]