D1.4 CRISIS MANAGEMENT This factor addresses crisis management planning, the conduct of specialised needs assessments, training exercises, and simulations that produce scalable results for policy development and strategic decision-making. Through qualitative and quantitative techniques, cybersecurity evaluation processes aim to produce structured and measurable results that would solicit recommendations for policymakers and other stakeholders and inform national strategy implementation as well as inform budgetary allocations Maturity Stage: Formative A preliminary cybersecurity needs assessment of measures and techniques that require testing has been undertaken. CERT-IS has conducted limited scope exercises for the telecommunications sector and such exercises are planned every other year. Key stakeholders and other subject matter experts, such as think tanks, academics, civil leaders and consultants are included in the planning process. No official national risk assessment plan has been developed as yet. The Civil Protection Act24 is the official framework for all crisis situations, including cyber-incidents and cyberattacks. Simulations and training exercises have been conducted in order to better prepare for a cyber-crisis situation, however these are not nationally coordinated exercises involving relevant stakeholders in all sectors. CERT-IS plans to conduct exercises for each constituency sector every two years and exercises have already been conducted with the telecommunications sector. CERT-IS participates along with the constituency sectors in larger international exercises, such as the ones held by ENISA, and the Norwegian ‘BlackScreen’ exercise with the energy sector. Moreover, telecommunications companies participate in risk assessment exercises conducted by ENISA25. The finance sector also conducts exercises and crisis simulations. However, one of the sectors that is not participating in such simulations and cyber training activities is the health sector. This is expected to change since the Directorate of Health is now a member of the Cyber Security Council and will participate is future exercises. 24 https://www.althingi.is/lagas/nuna/2008082.html (in Icelandic) https://www.stjornarradid.is/publications/legislation/lex/2017/12/21/Civil-Protection-Act-No.-82-2008/ (English translation) 25 https://www.enisa.europa.eu/topics/cyber-exercises 24 | Cybersecurity Capacity Review Iceland, 2017