26 Section 4 OUR NATIONAL RESPONSE • • • • have a responsibility to take reasonable steps to protect themselves online and ensure they are resilient and able to continue operating in the event of an incident; responsibility for the security of organisations across the public sector, including cyber security and the protection of online data and services, lies with respective Ministers, Permanent Secretaries and Management Boards; we will not accept significant risk being posed to the public and the country as a whole as a result of businesses and organisations failing to take the steps needed to manage cyber threats; we will work closely with those countries that share our views and with whom our security overlaps, recognising that cyber threats know no borders. We will also work broadly across the range of international partners to influence the wider community, acknowledging the value of broad coalitions; and to ensure Government interventions are having a substantive impact on overall national cyber security and resilience, we will seek to define, analyse and present data which measures the state of our collective cyber security and our success in meeting our strategic goals. to safeguard not only our hardware – our smart phones and other devices – but also the data, software and systems that afford us freedom, flexibility and convenience in our private and professional lives. Businesses and organisations 4.8. Businesses, public and private sector organisations and other institutions hold personal data, provide services, and operate systems in the digital domain. The connectivity of this information has revolutionised their operations. But with this technological transformation comes the responsibility to safeguard the assets which they hold, maintain the services they provide, and incorporate the appropriate level of security into the products they sell. The citizen and consumer, and society at large, look to businesses and organisations to take all reasonable steps to protect their personal data, and build resilience – the ability to withstand and recover – into the systems and structures on which they depend. Businesses and organisations must also understand that, if they are the victim of a cyber attack, they are liable for the consequences. Government Individuals 4.9. The primary duty of the Government is to defend the country from attacks by other states, to protect citizens and the economy from harm, and to set the domestic and international framework to protect our interests, safeguard fundamental rights, and bring criminals to justice. 4.7. As citizens, employees and consumers, we take practical steps to secure the assets we value in the physical world. In the virtual world, we must do the same. That means fulfilling our personal responsibility to take all reasonable steps 4.10. As the holder of significant data and a provider of services, the Government takes stringent measures to provide safeguards for its information assets. The Government also has an important responsibility to advise and inform citizens ROLES AND RESPONSIBILITIES 4.6. Securing the national cyberspace will require a collective effort. Each and every one of us has an important part to play. National Cyber Security Strategy 2016