CYBER SECURITY STRATEGY OF MONTENEGRO 2018-2021 With the aim of efficient defence, it is necessary to identify and essentially understand risks related to CII, namely related to the fields of action, different information platforms, systems, functions and technologies that CII is made up from, which is a complex task and a challenge. Bearing in mind that a large part of CII belongs to a private sector, the Government of Montenegro will provide support in identifying risks for critical systems, and, when necessary, establish additional protection measures aimed at protecting national resources. things, exchange of information should be specified, as well as the manners of exchanging information and expertise. The Government of Montenegro will also continue to improve the legislative framework, standards and obligations that the owners of CII must comply with, due to harmonisation with the EU Network Information Security Directive of European Parliament and of the Council. The need for strengthening inter-institutional cooperation has been identified, whereby a special accent will be placed on efficient and timely exchange of information and best practices. In this context, the responsible institutions will work on strengthening communication methods through, among other things, organisation of exercises for crisis communication in the case of cyber incidents and large scale attacks. The exercises will be aimed at defining clear communication procedures in crisis situations as well as their timely revision. PLAN OF ACTION AND INDICATORS: a) Owners of identified CII are required to conduct annual risk analysis. National CIRT, in cooperation with other responsible CIRTs, is in charge of reviewing the analyses, and providing assistance in making analyses where CII owners do not have sufficient capacities. Indicator of success: the number of conducted analyses compared to the number of CIIs, as well as their quality. b) Adoption of secondary legislation for protecting CII. This regulation should define the procedures for communication between owners of CII and responsible institutions, as well as basic technical and organisational measures that owners of CII have to implement. Indicator of success: an adopted Decree on measures for protecting CII. c) National CIRT, in cooperation with other CIRTs, should establish and formalise strategic partnerships with owners of CII, where, among other 28 Indicator of success: the number of formalised partnerships with holders of CII. 4.Inter-institutional cooperation STRATEGIC OBJECTIVE: PLAN OF ACTION AND INDICATORS: a) In order to further facilitate cooperation and communication among institutions, there is a need for appointing contact persons for cyber security on behalf of all actors involved. Indicator of success: the number of appointed contact persons compared to the number of institutions. b) Establishment of a publicly available registry of cyber experts which would be managed by the ministry responsible for this field. Indicator of success: the functioning of registries of cyber experts. c) Development of a platform for dialogue and exchange of information which would connect