However, the CI asset audit lists is not disseminated to relevant stakeholders. Consequently, participants observed that formal internal and external CI communication strategies should be defined across sectors, with clear points of contact. The scope of services by CERT-IS has been limited to the telecommunications sector, but it is currently being expanded to include other CI sectors as well. Currently, there is informal and ad hoc threat and vulnerability disclosure among CI owners as well as between CI and the government, but the scope of reporting requirements has not been specified. CERT-IS has not yet had the opportunity to coordinate information sharing between CI owners due to the lack of service contracts that limit the size and scope of its constituency. However, within the finance sector a specific timeframe for disclosure of incidents has been defined (as soon as possible but no later than 24h) (see D5.7). Participants mentioned the Global Influenza Preparedness Plan21 as an example of how the country could prepare for the organisation and coordination of responses to cyber incidents. CI owners have the capacity to detect, identify, respond to and recover from cyber threats, but such capabilities are uncoordinated and vary in quality. Protection of CI assets includes basic level cybersecurity awareness and data security policies, but no protection processes have been agreed. Representatives from the finance sector mentioned that they have their own plans in the case of national level crisis. In addition, the Financial Supervisory Authority (FSA)22 aims to safeguard the integrity and sound operation of the financial market and conducts periodic examinations of the operation of the stock exchanges23. The NCIP has developed a general response plan for responding to emergencies and it also has provisions for reacting to cyber-induced national level emergencies. CERT-IS has also developed an emergency plan for the telecommunication sector, which scope is at the present time mostly limited to defining the channels of communications and management process during a cyber crisis. 21http://www.landlaeknir.is/servlet/file/store93/item19632/Pandemic%20Influenza%20Preparedness%20Plan _March.06_.pdf 22 https://en.fme.is 23 https://en.fme.is/media/utgefid-efni/FME-arsskyrsla-2016-ENSKA-29072016.pdf 23 | Cybersecurity Capacity Review Iceland, 2017