Policy and Strategy The policy and strategy dimension of cybersecurity capacity for Iceland was gauged to range from start-up to established stages of maturity. The Republic of Iceland is at an established stage of maturity regarding the National Cybersecurity Strategy factor. Iceland has published the Icelandic National Cyber Security Strategy (NCSS) 2015-2026, approved by the Minister of the Interior in April 2015 together with a three year Plan of Action. The Ministry of the Interior (MoI) was divided into two new Ministries on 1 May 2017, the Ministry of Justice (MoJ) and the Ministry of Transport and Local Government (MoTLG). Since then MoTLG has been the designated coordinating body with a mandate to work towards the revision and the implementation of the National Cyber Security Strategy and the Action Plan and has started consulting across public and private sectors, and with civil society. The NCSS called for the appointment of a special Cyber Security Council (CSC) for government and public sector representatives and a Cyber Security Forum with representatives from private sectors in addition to the representatives in the CSC, in order to address collaboration on cybersecurity topics related to the implementation of the NCSS in Iceland. Iceland’s incident response capacity is at a formative to established stage of maturity. CERTIS – Iceland’s national CSIRT (Computer Security Incident Response Team) – has been established with specified roles and responsibilities with emphasis on the electronic communications market. In particular CERT-IS has the role of national point-of-contact, but does not at this time handle the Government CERT role. However, negotiations regarding this role are underway. CERT-IS has developed incident response processes, but these are and will not be publicly available. However, an incident response plan for Critical Information Infrastructure (CII) incidents has been published and distributed to members of the telecommunications sector. An overall central registry of national-level cybersecurity incidents is not yet operational. CERT-IS records incidents of all levels of severity that are reported to the group, but handling is prioritized by constituency, severity and impact. The registry of incidents is, however, not as of yet publicly accessible in any way. The National Commissioner of the Icelandic Police (NCIP) and CERT-IS aim to cooperate on creating a classification of national level incidents. The members of CERT-IS receive training in an ad-hoc manner. Moreover, CERT-IS collaborates with Nordic countries (Denmark, Finland, Iceland, Norway and Sweden) through the Nordic National CERT Collaboration (NCC). A Nordic cybersecurity exercise took place in 2015 and assessed the quality of the incident response processes, procedures, interactions, and information-sharing mechanisms that exist under the NCC Agreement. Additionally, CERT-IS has good relations with the financial sector and aims to cooperate with a new collaborative forum, the Nordic Financial CERT. The protection of critical infrastructure (CI) considerations are at a formative stage of maturity. A list of general CI assets has been created. The National Commissioner of the Icelandic Police (NCIP) is responsible for identifying these assets. However, the CI asset audit list is not disseminated to relevant stakeholders. Currently there is informal and ad-hoc threat and vulnerability disclosure among CI owners as well as between CI and the government, but the scope of reporting requirements has not been specified. CI owners have some capacity 6 | Cybersecurity Capacity Review Iceland, 2017