Dimension Constituent Factors of Each Dimension Findings ● Dimension 1 – Cybersecurity Policy and Strategy D1-1: Documented or Official National Cybersecurity Strategy D1-2: Incident Response ● ● ● ● ● ● ● ● ● ● ● D1-3: Critical National Infrastructure (CNI) Protection ● ● ● ● ● ● ● ● ● ● D1-4: Crisis Management ● ● ● D1-5: Cyber Defence Consideration ● ● ● ● ● D1-6: Digital Redundancy ● ● ● ● ● 7 No published national cybersecurity strategy document No institution that coordinates cybersecurity issues No budget assigned to address cybersecurity issues Developing a NCS has commenced Key stakeholder/working groups established Consultations on development NCS underway Need for creation of Malawi CERT lacking CERT’s role in reporting and management of cybersecurity incidents No catalogue in a central registry for incidents at national level No regulation in force that mandates incidents to be reported Institutions, critical to national cybersecurity have been identified No formal coordination mechanisms have been established No formal categorisation of Critical Infrastructure Critical sectors identified No institution responsible for overseeing CI Little interaction among owners of CIs and Government ministries No formal collaboration mechanism. No coordinated response No protection procedures No formal procedures for information sharing No coordinated approach to detect, identify, protect, respond and recover from cyber threats Some training and awareness has been provided No planning for crisis management Little understanding of crisis management from a cybersecurity perspective No evaluation of cybersecurity cybersecurity crisis management protocols National Security Policy under development No national cyber defence policy or strategy No central command and control structure for cybersecurity in the armed forces National security forces do consider cybersecurity dimensions in their operations Limited capacity for national armed forces No National Contingency plans No standard operating procedures Redundancy systems established by operators Emergency response assets have been mapped and identified No proper communication channels