4 Overarching principles The increasing reliance on the digital environment for the functioning of societies’ demands increased attention on cybersecurity. However, cybersecurity is not a goal in itself; the Strategy should be aligned with the country’s broader socio-economic objectives and lead to building the trust and confidence necessary to both help realise these objectives as well as protect the country from cyber-threats. Further references available on page 57. 4.5 Fundamental human rights The Strategy should respect and be consistent with fundamental values. The Strategy should recognise the fact that rights that people have offline must also be protected online. It should respect universally agreed fundamental rights, including, but not limited to, the ones found in the United Nations’ Universal Declaration of Human Rights and International Covenant on Civil and Political Rights, as well as relevant multilateral or regional legal frameworks. Attention should be paid to freedom of expression, privacy of communications and personal-data protection. In particular, the Strategy should avoid facilitating the practice of arbitrary, unjustified or otherwise unlawful surveillance, interception of communications, or processing of personal data. In balancing the needs of the State with those of the individuals, the Strategy should ensure that, where applicable, surveillance, interception of communications and collection of data are conducted within the context of a specific investigation or legal case, authorised by the relevant national authority and on the basis of a public, precise, comprehensive and non-discriminatory legal framework enabling effective oversight, procedural safeguards and remedies. Further references available on pages 57 and 58. 4.6 Risk management and resilience The Strategy should enable an efficient management of cybersecurity risks and drive the resilience of the economic and social activities. While the digital environment provides stakeholders with economic and social opportunities, it also exposes them to cybersecurity risk. For example, when organisations use ICT to foster innovation, gain productivity and improve competitiveness, or when governments deploy their services online, cybersecurity incidents can occur, potentially resulting in financial loss, reputational damage, Guide to Developing a National Cybersecurity Strategy 32