CERT-IS has developed incident response processes, but these are and will not be publicly available. However, an incident response plan for CI incident has been published and distributed to members of the telecommunications sector. Moreover, some participants referred to the lack of a catalogue of services provided by CERT-IS, but the position of CERTIS as national CERT is that it should not provide a catalogue of services but a role defined by law. Defining the role of CERT-IS more precisely was a key element in ongoing service contract negotiations during the summer of 2017. Leads for incident response have been designated at the operational level, but national-level coordination has not yet been established. Distinct and formal security roles and responsibilities are not yet allocated across government, critical infrastructure, enterprise, and individual systems. An overall central registry of national-level cybersecurity incidents is not yet operational. CERT-IS records incidents of all levels of severity that are reported to the group, but handling is prioritized by constituency, severity and impact. The registry of incidents is, however, not as of yet publicly accessible in any way. The National Commissioner of the Icelandic Police (NCIP) and CERT-IS are currently discussing an official classification scheme for CI incidents. Participants informed us that through the implementation of the EU NIS Directive, official classification will take place of national level incidents which expose vulnerabilities of national critical assets. The NCIP and CERT-IS aim to cooperate on creating a classification of national level incidents. CERT-IS employees that work on incident handling and analysis receive mostly training in an ad-hoc manner, but baseline training requirements have been established. Budget restraints do limit the availability of training, but CERT-IS does take advantage of lower cost training opportunities that present themselves, for instance trough the Nordic National CERT Collaboration (NCC)18. Review participants indicated that human and financial resources allocated to incident response are not adequate to the cybersecurity threat environment and that incident response is still more reactive than anticipatory. CERT-IS is not a member of FIRST yet, but preparation for FIRST and Trusted Introducer memberships is on the roadmap for 2018. Currently the service of CERT-IS is limited to the telecommunications sector but service contracts are being negotiated with the energy sector and planned with other sectors. In particular, CERT-IS has good relations with the financial sector and aims to cooperate with the planned Nordic Financial CERT. Representatives from the finance sector indicated that an information-sharing platform (currently functioning by email) already exists for incidents-events experienced by banks. There was general agreement among different sector participants that the involvement of CERT-IS in this process would advance its capacity. CERT-IS notes that all opportunities for cooperation and information sharing are welcomed and one project in cooperation with a financial institution is currently under way. Moreover, CERT-IS collaborates with the Nordic countries (Denmark, Finland, Iceland, Norway and Sweden) through the NCC cooperation. This includes technical cooperation and cybersecurity exercises to assess and strengthen cyber preparedness, examine incident response processes and enhance information sharing in the region. A Nordic cybersecurity 18 https://www.itu.int/dms_pub/itu-d/opb/str/D-STR-GCI.01-2017-R1-PDF-E.pdf 21 | Cybersecurity Capacity Review Iceland, 2017