EXECUTIVE SUMMARY The Global Cyber Security Capacity Centre (GCSCC, or ‘the Capacity Centre’) has undertaken a review of the maturity of the cybersecurity capacity of the Republic of Iceland, hosted by Iceland’s Ministry of Transport and Local Government (MoTLG). The objective of this review is to enable the government of Iceland to reassess its cybersecurity capacity in order to prioritise strategic investment in national cybersecurity. Over the period 21–23 June 2017, stakeholders from the following sectors participated in a series of consultations with GCSCC staff: government departments and ministries, legislators and policy owners, criminal justice, law enforcement, academia, as well as the private and financial sectors. The consultations were premised on the Capacity Centre’s Cybersecurity Capacity Maturity Model for Nations (CMM)1, which defines five dimensions of cybersecurity capacity: • • • • • Policy and strategy Culture and society Education, training and skills Legal and regulatory frameworks Standards, organisations and technologies Each dimension comprises a number of factors which, taken together, explain what it means to possess cybersecurity capacity. Factors are further subdivided into aspects and for each aspect there are indicators, setting out those conditions that define the level of maturity achieved in any given aspect. There are five stages of maturity, ranging from the start-up to the dynamic. The start-up stage implies an ad-hoc approach to capacity, whereas the dynamic stage is indicative of a strategic approach and the ability to adapt or change in response to environmental considerations. The five stages of the CMM are defined as follows: - Start-up: At this stage either no cybersecurity maturity exists, or it is very embryonic in nature. There might be initial discussions about cybersecurity capacity building, but no concrete actions have been taken. There is an absence of observable evidence of cybersecurity capacity at this stage. - Formative: Some aspects have begun to grow and be formulated, but may be ad-hoc, disorganized, poorly defined – or simply new. However, evidence of this aspect can be clearly demonstrated. - Established: The indicators of the aspect are in place, and functioning. However, there is not well thought-out consideration of the relative allocation of resources. Little trade-off decision-making has been made concerning the relative investment in this aspect. But the aspect is functional and defined. 1 Cybersecurity Capacity Maturity Model for Nations (CMM), Revised https://www.sbs.ox.ac.uk/cybersecurity-capacity/content/cmm-revised-edition 4 | Cybersecurity Capacity Review Iceland, 2017 Edition, available at