8 N AT I O N A L CY B E R S ECU R I T Y ST R AT EGY assessment culture and cyber security risk assessment processes are still fragmentary. Cyber security threats and security gaps have not been adequately analysed and holistically integrated into the process of risk assessment. Furthermore, rapid ICT development presents a challenge to ensuring that cyber security professionals have adequate knowledge, skills and practice. 10. In order to enhance the culture of effective cyber security policy making and implementation and to improve cyber security risk assessment and other requirements, the following changes occurred in 2018: 10.1. The provisions of the Law on Cyber Security were recast to improve organisation, management and control of the cyber security system; the competence, functions, rights and duties of state institutions responsible for cyber security policy making and implementation were specified; the duties and responsibilities of cyber security entities were defined in more detail, and additional cyber security assurance measures were established. 10.2. Regulatory functions of state information resources security, activities of public communications networks, public digital communication services and digital information hosting service providers were consolidated which enabled systematic cyberspace monitoring, and management of cyber incidents occurring in communication and information systems of cyber security entities. The NCSC is the only agency in Lithuania that organises cyber incident management and assists other state institutions, businesses and residents on the one stop shop principle. 11. Consolidation of capabilities aims at developing an integral cyber security management system in Lithuania to represent a systematic approach to the security management planning in any field, encouraging cyber security entities to focus on security management quality, reducing administrative burden falling on cyber security entities, ensuring systematic assessment and evidence-based security management culture, and facilitating optimisation of security expenditure planning. Consolidation of capabilities also aims at ensuring sustainable development of cyber security competences and enhancement of regional cyber security capabilities. 12. The Ministry of National Defence of the Republic of Lithuania and the NCSC continuously cooperate with cyber security entities, consult them on cyber security issues, and organise cyber security exercises. In 2017, the national cyber security exercise Cyber Security 2017 had around 200 participants from over 50 organisations of private and public sector. In cooperation with the Communications Regulatory Authority of the Republic of Lithuania, the Lithuanian Police and the State Data Protection Inspectorate, workshops for representatives of cyber security entities were organised. Participants were familiarised with the requirements of legal acts related to cyber security and had training on management and counteraction to cyber incidents against critical communication and information systems. The Ministry of National Defence will continue to organise national cyber security exercises on a regular basis and will promote continuous improvement of the cyber security skills not only in the national but international cyber security exercises as well. 13. The European Union (EU) and the North Atlantic Treaty Organisation (NATO) acknowledge that cyberspace has been increasingly used as a separate military space or as a tool of hybrid warfare. Cyber tools may be used to sabotage activities of a country’s critical information infrastructure (e.g., the cyber-attack which took place in one of Iran’s nuclear energy objects in 2010), might adversely affect national and public security (e.g., the cyber-attacks on Ukraine’s power plants in 2015 and 2016), economy and social welfare. For this reason, protecting the national cyberspace is a matter of national security for every country. In accordance with the decision adopted during the NATO Warsaw Summit 2016 where cyber space was recognised as the fifth domain of warfare the Lithuanian Armed Forces have become the main cyberspace defence entity for the Republic of Lithuania. The strengthening of cyber defence in order to prevent military cyber threats and effectively manage cyber incidents is a prerequisite for ensuring vital and primary interests of national security. To fulfil the objectives set for the Lithuanian Armed Forces, national cyber defence capabilities will be developed by ensuring interaction between the Lithuanian Armed Forces and the country’s civil capabilities, also capabilities of the Lithuanian Armed Forces to ensure reliable deterrence of aggressors in cyber space. In case of failure to ensure effective deterrence, the Lithuanian Armed Forces would defend the Republic of Lithuania by using military cyber security measures acting autonomously and in cooperation with allies.