3 Lifecycle of a National Cybersecurity Strategy Additionally, related data that can inform the country’s cybersecurity posture should be collected. This could include: information on existing national cybersecurity programmes, international initiatives, private sector projects, ICT and cyber-education and skill-development programmes, cyber-R&D initiatives; data on Internet penetration and infection rates, ICT uptake, technology developments; and insights on future ICT and cybersecurity trends and threats. Relevant information provided by the private sector, research institutions and other stakeholder groups should be included in this analysis as well. For developing countries, it is also crucial to map out the collaborative initiatives with development partners to coordinate technical assistance and investments. Finally, the Lead Project Authority should also investigate similar information at the regional and international levels, and examine sector-specific strategies and initiatives. 3.2.2 Assessing the cyber-risk landscape Building on the information collected in the previous step, the Lead Project Authority should assess the risks the nation faces due to digital dependence. This can be achieved through the identification of national digital assets, both public and private, their interdependencies, vulnerabilities and threats, and an estimation of the likelihood and potential impact of a cyber-incident. This effort embraces the principle of risk management and resilience (Section 4.6), which recognises that risk management is critical to fully realising the benefits of the digital environment for socio-economic development. Furthermore, this initial risk assessment can form the basis for future, more specific risk assessments (further information on the Principle of Risk Management and Resilience and how to conduct risk assessments can be found in Section 5.2). 3.3 Phase III: Production of the National Cybersecurity Strategy The purpose of this phase is to develop the text of the Strategy by engaging key stakeholders from the public sector, private sector and civil society through a series of public consultations and working groups. This broader group of stakeholders, coordinated by the Lead Project Authority, will be responsible for defining the overall vision and scope of the Strategy, setting high-level objectives, taking stock of the current situation (detailed in Phase II), prioritising objectives in terms of impact on society, citizens and the economy, and ensuring the necessary financial resources. As part of this phase, all the cross-cutting principles (Section 4) should be considered and good-practice elements (Section 5) detailed in this Guide should be considered. Guide to Developing a National Cybersecurity Strategy 22