to detect, identify, respond to and recover from cyber threats, but such capabilities are uncoordinated and vary in quality. No official national risk assessment plan has been developed as yet. The Civil Protection Act2 is the official framework for all crisis situations, including cyber-incident or cyberattack. Simulations and training exercises have been conducted in order to better prepare for a cyber-crisis situation, however these exercises are not coordinated at the national level, with the active participation of all relevant stakeholders in all sectors. Iceland’s cyber defence considerations are at a start-up stage of maturity. Iceland’s Cyber defence is mainly being considered in terms of national cyber resilience and the country is prioritising the protection of national CI assets as a priority action of the NCSS. Beyond that it is also part of Iceland’s defence planning. The Ministry for Foreign Affairs is the central authority for defence and in charge of implementation of the Defence Act No 34/2008, due to the absence of a dedicated Ministry of Defence. In accordance with a Memorandum of Understanding (MoU) between the Ministry for Foreign Affairs and the Ministry of Interior now Ministry of Justice, and due to the lack of a standing army, the Icelandic Coast Guard from July 2014 (ICG) is responsible for operational defence activities related to NATO including NATO Iceland Air Defence System, CRC, Host Nations Support and operation of the Keflavik Air Base. The Iceland Crisis Response Unit (ICRU) has been a separate entity within the MFA since 2001. Its main role is to contribute to multilateral organisations and to provide secondments of civilian experts to the field. Iceland has established contacts with the NATO Cooperative Cyber Defence Centre of Excellence (NATO CCDCOE) while material and resources prepared by the Centre, especially the Tallinn Manual, have already been utilised. In 2018, Norway will host NATO's high-visibility exercise Trident Juncture in which Iceland participates, as the defence of Iceland is an integral part of the exercise. In the event of a communications disruption, mechanisms are in place to maintain the operational functionality of the national emergency communications network. Current emergency response assets have been identified. Within both the public and the private sectors, TETRA Systems for Mission Critical Communications are deployed. Furthermore, fibre optic lines and nodes are shared with the public network. The finance sector also conducts crisis response simulations regularly and emergency drills are tested frequently. Culture and Society During consultations, the national capacity regarding cybersecurity culture and society ranges from formative to established stages. The government has recognised the need to prioritise cybersecurity across its institutions, and the risks and threats in cybersecurity have influenced the processes and structures across government institutions but in particular leading agencies. Leading firms within the private sector have begun to place priority on a cybersecurity mind-set by identifying high-risk practices. Among society-at-large, a growing 2 https://www.althingi.is/lagas/nuna/2008082.html (in Icelandic) https://www.government.is/publications/legislation/lex/2017/12/21/Civil-Protection-Act-No.-82-2008/ (English translation) 7 | Cybersecurity Capacity Review Iceland, 2017