As mentioned above, the strategy is intended to form the basis of collaboration and development in cybersecurity. The strategy itself will not amend the responsibilities and duties of those involved in cybersecurity even though proposals may be made for measures that may involve changes in these areas. D1.2 INCIDENT RESPONSE This factor addresses the capacity of the government to identify and determine characteristics of national level incidents in a systematic way. It also reviews the government’s capacity to organise, coordinate, and operationalize incident response. Maturity Stage: Formative to Established A National CSIRT (Computer Security Incident Response Team), CERT-IS14 has been established with specified roles and responsibilities. CERT-IS has, according to law, the telecommunication sector as its primary constituency which includes certain critical information infrastructure (CII) entities. Other CII entities may sign contracts with CERT-IS. Other entities, outside the primary constituency, are served on best-effort terms. The role of CERT-IS is to analyse cybersecurity threats and to give assistance to its primary constituency members using both proactive and reactive measures to prevent cybersecurity incidents and to minimize their impact. CERT-IS gives advice regarding threats and responses to its primary constituency members and publishes public warnings when needed. According to the participants, each sector is responsible for handling conventional emergencies and preparing accordingly. The approach taken for cybersecurity is similar and an agreement with the national CERT-IS15 has been made that cyber emergencies with national significance will be prioritised. In the event of a cyber crisis the role of CERT-IS is to coordinate responses. As a National CSIRT, CERT-IS is the national point of contact in Iceland. The legal provisions for CERT-IS are stated in the Telecommunication Act no. 81/200316, art. 47a and regulation no. 475/201317 (see also D4.1). No Government CERT exists yet. CERT-IS acts as a national CERT and in particular has the role of national point-of-contact, but does not at this time handle the Government CERT role. However, negotiations regarding this role are underway. 14 https://www.cert.is/en/node/2.html https://www.cert.is/en/node/2.html 16 http://www.althingi.is/lagas/nuna/2003081.html#G47A 17 https://www.stjornartidindi.is/Advert.aspx?ID=f5282f2a-6827-4d98-9fc2-0afd611243d6 15 20 | Cybersecurity Capacity Review Iceland, 2017