3 Lifecycle of a National Cybersecurity Strategy 3.2 Phase II: Stocktaking and Analysis The purpose of this phase is to collect data to assess the national cybersecurity landscape and the current and future cyber-risk landscape to inform the drafting and development of the National Cybersecurity Strategy. The output of this exercise should be a report that provides an overview of the strategic national cybersecurity posture and risk landscapes to be submitted to the Steering Committee. Before beginning the actual production of the text of the Strategy, the Lead Project Authority should carefully analyse and assess the information gathered during the stocktaking phase to ensure that any gaps in cybersecurity capacity are identified and options for addressing them presented. The analysis should result in an assessment of how far the existing policy, regulatory and operational environments meet the stated objectives of the Strategy and highlight where they fall short. Similarly, it should be used to identify specific key issues, such as educational and training gaps. Lastly, the analysis should result in an assessment of all relevant and desirable outcomes for the Strategy, as well as the potential effects and outcomes of means chosen. Further references available on page 55. 3.2.1 Assessing the national cybersecurity landscape For the National Cybersecurity Strategy to be effective, it needs to reflect the cybersecurity posture of the country. To this end, an analysis of the country’s existing cybersecurity strengths and weaknesses should be conducted, and relevant materials and documents should be consulted in collaboration with relevant stakeholders across government, private sector and civil society. This step should embrace the principle of comprehensive approach and tailored priorities (described in Section 4.2). As part of this effort, the Lead Project Authority should identify assets and services critical to the proper functioning of the society and economy, and map existing national laws, regulations, policies, programmes and capacity as they relate to cybersecurity. The Lead Project Authority should also identify existing soft regulatory mechanisms, such as private-public partnerships, and take stock of capabilities that have been developed to address cybersecurity challenges, such as national Computer Emergency Response Teams (CERTs). Moreover, the roles and responsibilities of existing public agencies with a cybersecurity mandate, such as regulators or data-protection agencies, should be identified and mapped. Guide to Developing a National Cybersecurity Strategy 21