According to review participants, increasing awareness-raising efforts concerning risks and threats exist, but there is a general lack of knowledge on the specific actions necessary. Training and education for public services on IT and cybersecurity is available, e.g. through the Information Society Project (see 3.3). However, this training programme is not mandatory for all employees. Another concern noted by participants is the fact that such programmes are neither coordinated nor long term, and therefore it is difficult for employees to retain the knowledge received. Another general concern expressed in interviews was that employees within the public sector do not always follow specific online safety measures such as locking their computer, updating passwords, and not sharing passwords. For example, participants noted that mandatory password update was introduced last year within ministries, and that this has enhanced the understanding and cybersecurity awareness of employees. Moreover, physical penetration testing is now being introduced within some government institutions. Leading firms within the private sector have begun to place priority on a cybersecurity mindset by identifying high-risk practices. Programmes and materials have been made available to train and improve cybersecurity practices. For example, the finance sector is organising trainings for its employees. Also, the energy sector is participating in exercises with Norway in order to promote the understanding of risks to employees. However, participants noted that the private sector needs to ensure trust in their services by their customers, but that this is difficult when many Small and Medium Enterprises (SMEs) do not have sufficient resources to allocate more to cybersecurity. Individuals across society-at-large inconsistently adopt a cybersecurity mind-set, but according to stakeholders, there is a shift towards a more proactive approach to cybersecurity. There was a general sense that a growing number of users feel it is a priority for them to employ good cybersecurity practices. However, cultural aspects and a generally high level of trust, which is ingrained in the Icelandic culture, can inhibit users from thinking about protecting their privacy online and making protection of their personal information online their own responsibility. Phishing attacks were an example used to better express this problem. Participants noted that phishing click rates are very high when the attacks are written in Icelandic, due to the fact that users trust these more than a phishing email in English. Users are not aware that they are part of a security chain and they need to share not only the benefits of the Internet but also responsibilities for a safe Internet. 32 | Cybersecurity Capacity Review Iceland, 2017