Raise the awareness of supply chain security risks Update of the minimal cybersecurity baseline for NCII operators Create effective governance and informed risk management decisions and thereby advocate the investments in appropriate security measures. Promote the Securityby-Design practices and address the supply chain cybersecurity issues in the framework of through awareness initiatives. National Information Risk Register is updated and addresses the supply chain cybersecurity issues. Start the analysis to develop legally binding accreditation system and develop standards to assess the security of hardware, software and IT services deployed in NCII. Update the requirements for minimum cybersecurity baseline of NCIIs (NISF). Include into the baseline the requirements for information sharing and incident reporting. Establish the rules for regular audit. Introduce legal provisions that give the on threat landscape. Vendors, products and services with high risk are identified and communicated to NCII operators. National Information Risk Register is adequate, updated and ready to use for NCII operators. Supply chain cybersecurity issues are addressed in an appropriate level and manner. NISAG, NITA-U NISAG, Sector al Regula tors UNBS NITAU, UCC, MoICT &NG NCII operators implement security measures and are audited regularly. NCII report their cyber incidents to the central level. Sectoral Regulators MoICT &NG, MoS Sectoral regulators MoJCA MoICT &NG 38 (43) [Draft Version for stakeholder consultation]