CYBER SECURITY STRATEGY OF MONTENEGRO 2018-2021 cyber security experts from public and private sectors, both at local and national level. Indicator of success: an operational platform. d) Setting up of an inter-ministerial working group at technical level which would gather cyber security experts and create capacity to defend against cyber attacks. Indicator of success: the formed inter-ministerial working group. e) Inter-ministerial working group will organise simulations and exercises aimed at efficiency, coordination and communication. Indicator of success: the number of organised exercises at annual level, duration of exercises as well as the number of covered situations. f) Drafting of a rulebook and procedures for exchange of information on cyber incidents, the manner of communication in the event of cyber attacks, and the manner of assistance and cooperation among state authorities. Indikcator of success: a defined rulebook and procedures on the exchange of information on cyber incidents and communication among bodies. 5. Data protection The Law on Data Confidentiality acknowledges the principle of marking information with a certain level of classification and the way of dealing with these data, from those marked with the lowest level of classification whose disclosure would make harmful consequences for functioning of the body, to those with the highest level of classification whose disclosure would endanger or cause irreparable harmful consequences for security and interests of Montenegro. As a result of computerisation of business processes, these data are created, processed and kept electronically, and due to the need for efficient exchange of information, they are all the more transferred through cyberspace. With a view to providing adequate protection and raising the level of culture of handling classified and sensitive information electronically, it is necessary to strengthen the national capacities needed for the implementation of the legally prescribed security accreditation of communication and information systems and processes where classified data are marked as CONFIDENTIAL and SECRET, and also provide a proper management system for security of information in the systems where data marked as INTERNAL are used12, as well as in the systems where unclassified sensitive data are handled. Also, it is necessary to plan national capacities in the long run with the aim of developing domestic cryptographic solutions. PLAN OF ACTION AND INDICATORS: STRATEGIC OBJECTIVE: For the purpose of providing an adequate protection of the important part of information infrastructure, the Government of Montenegro will strengthen the national capacities necessary for security accreditation of communication and information systems and the processes where classified information is used, as well as the capacities in the field of crypto protection. a) In March 2017, a set of legal regulations was adopted necessary for implementing certification of communication and information systems and processes where secret data of higher classification are used. It has been recognised that there is a room for improvement of this set of regulations, particularly in the part of certification of “standalone” machines and inter-connection Law on Data Confidentiality (Official Gazette of Montenegro, No 14/13 of 15 March 2013) and the Decree on detailed conditions and manner of implementing measures of classified information protection (Official Gazette of Montenegro, No 57/10 of 1 October 2010) 12 29