CYBER SECURITY STRATEGY OF MONTENEGRO 2018-2021 3. Strengthening capacities of state law enforcement authorities In the previous period, through legislation and strategic documents, Montenegro has followed the main standards, guidelines and recommendations of the EU and NATO regarding the cyber security capacity building. The information security legislation has been harmonised with the EU acquis to a significant extent. In addition, in 2016, the Law on Amendments to the Law on Information Security (Official Gazette of Montenegro, No 040/16) was adopted, providing for two key activities: the formation of the Information Security Council and the protection of critical information infrastructure, which are in line with the NIS Directive (2016/1148)8. In order to strengthen the capacities of state law enforcement authorities, a High-Tech Crime Group has been set up at the Ministry of Interior, and it belongs to the Section for Fighting against Organised Crime and Corruption. The said Group provides for three working positions for staff dealing with the issue of high-tech crime (classical acts of computer crime, child pornography, credit card abuse, and copyright abuse). As of June 2013, a group for testing information technologies has been envisaged within the Forensic Centre of the Police Administration in Danilovgrad. With regard to technical capacities, in addition to computer testing tools, mobile phone testing tools were also procured. The National Security Agency is making significant efforts aimed at creating normative and operational mechanisms for fighting against cyber crime and espionage, which, along with terrorism and organised crime, are becoming the greatest security challenges of today. The agency is working continuously and intensively 8 in order to strengthen cyber security organisational and technical capacities. In order to strengthen the resilience of information systems, the ICT Service at the Ministry of Justice has carried out a series of activities in line with the tasks set out in the Strategy, which greatly reduce the vulnerability of the existing systems of the Ministry in cyberspace. Degree of implementation: Although the state authorities have recognised the need to strengthen their cyber security and cyber crime capacities in the previous period, it is necessary to continuously invest in further improvement of national cyber defence capacities. 4. Incident Response The analysis of the incident reports in Montenegro, which are drafted annually by CIRT, shows an evident trend of growth in the number of reported incidents year after year, as well as an increasing degree of sophistication of the attacks themselves. With the establishment of the national CIRT, a major step has been taken towards increasing the ability of state authorities to respond to cyber incidents affecting Montenegro. Degree of implementation: CIRT has been recognised as a focal point for responding to incidents in Montenegro, however, there is an evident lack of highly specialised personnel for successfully responding to this challenge. In addition to the above, in order to respond to incidents, it is also necessary to implement tasks relating to the completion of the list of local CIRTs, as well as to the trainings for http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC 15