3 Lifecycle of a National Cybersecurity Strategy 3.1.3 Identifying stakeholders to be involved in the development of the Strategy In this step, the Lead Project Authority should identify an initial set of stakeholders to be involved in the development of the Strategy. It should also clarify the roles of the different stakeholders and outline how they will collaborate in order to manage expectations throughout the process. Throughout the process, the Lead Project Authority may need to reach out to additional stakeholders to ensure all pertinent knowledge and expertise is utilised. This would embrace the principle of inclusiveness (Section 4.3), which highlights the importance of cooperation with a range of stakeholders across government, the private sector and civil society. For example, the Lead Project Authority could consider including ICT companies, critical-infrastructure operators, academic experts, and non-governmental organisations working on raising cybersecurity awareness and preparedness, amongst others. Such cooperation mechanism could take the form of an Advisory Committee, that would contribute in providing members to the Steering Committee, as well as be consulted on the various phases. 3.1.4 Planning the development of the Strategy In the final step of the Initiation phase, the Lead Project Authority should prepare a plan for developing the National Cybersecurity Strategy. Once the plan has been drafted, it should be submitted, as applicable, to the Steering Committee and the Executive, for approval, in accordance with the national governance processes. In drafting the plan, the Lead Project Authority should also consider whether the National Cybersecurity Strategy will take the form of legislation or policy, as different options might influence the formal processes that would need to be followed, as well as the timeframe for adoption. The Strategy development plan should identify the major steps and activities, key stakeholders, timelines and resource requirements. It should specify how and when relevant stakeholders will be expected to participate in the development process to contribute input and feedback. It should also identify the human and financial resources needed, and where these could be procured. For example, required expertise could be solicited from intergovernmental organisations, the private sector, academia, or development agencies. Similarly, funding requirements might be addressed through reallocation of dedicated funding streams in existing budgets, or through new funding available from third parties (e.g., international organisations). Particular attention should be placed on securing long-term funding for the full lifecycle of the National Cybersecurity Strategy, including its development, implementation and refinement. For further details on the allocation of resources Guide to Developing a National Cybersecurity Strategy 19