3.3 Robust cybersecurity ecosystem Implement the strategic plan on the protection of NCII Promote cooperation and understanding of cybersecurity risks in all critical sectors Robust cybersecurity ecosystem Raising awareness of supply chain risks Update of the minimal cybersecurity baseline for NCII operators Create effective governance and management structure for protection of NCII The complex and interconnected nature of cyberspace is such that ensuring holistic cybersecurity becomes a shared responsibility between the Government, private sector and other stakeholders as part of our country’s national critical information infrastructure is run by the private sector. A robust national ecosystem guaranteeing cybersecurity requires the involvement of all key stakeholders, both state and non-state actors, and at national and international level based on collaboration. Assets that are essential to the functioning and security of a society and economy of the country are Critical Infrastructure (CI). National Critical Information Infrastructure (NCII) are ICT systems that operate key functions of the critical infrastructure. The protection of NCII in Uganda is addressed from a risk management perspective. Regular risk assessments guide the identification of national critical infrastructure and services, whose disruption may have a serious impact on the security or economic well-being The protection of National Critical of citizens and harm Uganda’s possibilities to benefit from Information Infrastructure relies on digitalisation. A risk-based approach also enables to prioritize regular and up-to-date risk assessments implementation of programs and policies designed to protect NCIIs. Earlier strategic interventions, i.e. the 2011 NISS recognizes the prominence of protecting critical information infrastructure from disruption and the role of public-private partnerships as one of the guiding principles of Uganda. The Computer Misuse Act addresses the offences in relation with protected computers in certain areas and economic sectors, however, it does not organize transparently the principles and criteria for determining the NCII ecosystem, nor does it outlines minimum cybersecurity baselines addressing NCII operators. The establishment of a security baseline for protected computers, programs or data in sectors specified in NISF and Computer Misuse Act (2011) has been the current practice to address the critical information infrastructure protection in Uganda. In order to enhance the transparency and thereby boost trust between the private and the public sector, the Government will implement the strategic plan on the protection of National Critical Information Infrastructure containing a list of critical sectors to be considered as essential for the maintenance of critical societal and economic activities. The national level risk assessments provided by NITA-U and NISAG will serve as a basis of reviewing the list and any future NCII updates. 22 (43) [Draft Version for stakeholder consultation]