3 Lifecycle of a National Cybersecurity Strategy 3.3.4 Furthermore, it is pivotal that the Strategy is not only developed with approval from the highest levels of government, but that this commitment continues in its implementation phase. The relevant officials should be held accountable and be supported by both political capital and resources. Publishing the Strategy The Strategy should be a public document and should be made readily available. Its broad availability will both ensure that the general public is aware of the government’s cybersecurity priorities and objectives, and also support any effort to raise cybersecurity awareness. Should the Strategy be accompanied by an Action Plan, the latter should also indicate additional opportunities for further engagement and cooperation with civil society and the private sector. Further references available on page 55. 3.4 Phase IV: Implementation The Implementation phase is the most important element of the overall National Cybersecurity Strategy lifecycle. A structured approach to implementation, supported by adequate human and financial resources, is critical to the success of the Strategy and needs to be considered as part of its development. The implementation phase is frequently centred on an Action Plan, which guides the various activities envisioned. 3.4.1 Developing the action plan As with the development of the Strategy, its implementation cannot be the sole responsibility of a single authority. Instead, it requires engagement and coordination of a range of different stakeholders across the government, as well as support from civil society and the private sector. The Action Plan, developed in accordance with the principle of clear leadership, roles and resource allocation (Section 4.8), can support the effective implementation of the Strategy. 3.4.2 The development of the Action Plan is almost as important as the Plan itself. The process, orchestrated by the Lead Project Authority, should serve as a mechanism to bring the relevant stakeholders together to agree on objectives and outcomes, as well as coordinate efforts and pool resources. Determining initiatives to be implemented The National Cybersecurity Strategy highlights the government’s objectives and the outcomes they wish to realise across the different focus areas identified. In the Action Plan, the Lead Project Authority should – in coordination with relevant stakeholders – identify the specific initiatives within each focus area that will help meet those objectives. Examples could include organising cybersecurity exercises, Guide to Developing a National Cybersecurity Strategy 24