Global cyberattacks during recent years have caused a massive financial and reputational damage to states states, governments, companies, and private citizens. To improve Uganda’s resilience against such incidents it is essential to detect, analyze, understand, and mitigate cybersecurity risks. Cybersecurity risks involve three components: - Threat. Threat can be technological like malware, geopolitical like adversary nation state, crime like an organized crime group or even environmental like extreme weather conditions. - Vulnerability. Vulnerability is often described as a weakness of computer system which can be exploited. In the cyber ecosystem, vulnerability is more complex and can be technological, organizational, administrative etc weaknesses that leave the ecosystem open to cyberthreats. - Consequence (impact). Consequence can be assessed combining likelihood of the cyber incident with potential impact to the ecosystem or its components. Figure 7. Three components of cybersecurity risk. To mitigate cybersecurity risk and minimize the negative impact of cyber threats, Government will continue the update of National Information Risk Register, develop and regularly update sector based risk scenarios for incident management (for energy, communications, government sectors etc). Both national level and sector oriented cyber risk repositories improve understanding about current cybersecurity risks and allows to forecast and model trends. The responsible regulatory bodies and NCII operators will update periodically the list of their critical services due to continually changing threat landscape. Uganda will establish the mandatory incident reporting for NCII and government sector and aggregate a national level incident register, which is essential for understanding security situation and to plan, develop and implement appropriate security measures for different sectors. For a successful and efficient risk management, Uganda will foster inter-agency cooperation in cybersecurity related matters, especially in information sharing, and will establish special programs for a capacity building for sectors that have less resources for cybersecurity such as MSMEs, healthcare institutions. 3.2.2 Preparedness and incident response Today, organizations’ ability to handle potential incidents is inevitable. Globally, 86,2% of companies are being compromised by at least one successful attack in 2021. Notably, this doesn’t account for attempted attacks or those that went unreported. [9] Even though when global investments to cybersecurity are enormous, due to the dynamics of cyberspace, fast growing number of threats and rapid digitalization, attack surface of cyberthreats is increasing fast. Many of attacks and other incidents can be prevented by efficient threat intelligence, risk awareness and smart technological protection. However, since cyber incidents will continue to take place, appropriate incident management and incident recovery framework shall be established for Uganda. In order to efficiently respond to incidents, Uganda will define clearly national working arrangements for information exchange and incident response. ICT incidents tend to escalate very rapidly, thus the roles of the various organisations and agencies, cooperation arrangements and mechanisms for exchange of information must be defined and organised. Given the need for extensive cooperation with the private sector and with future sector specific CSIRTs (e.g financial, energy etc.), sectoral CSIRTs will develop specific competence (such as security of industrial control systems) that is needed for incident management in specific sectors. 20 (43) [Draft Version for stakeholder consultation]