QATAR NATIONAL CYBER SECURITY STRATEGY Critical Sector. The critical sectors in Qatar include but are not restricted to: §§ §§ §§ §§ §§ §§ Energy, Electricity, and Water Finance Government Healthcare Information and Communications Technology Transportation Critical Sector Organization. An organization that owns and/or operates a substantial portion of CII in Qatar.20 Cyber Crime. Misconduct or crime committed using technology. Examples of cyber crime may include illegal access to systems or information, fraud, identity theft, or content-related offenses such as spam. Cyber Security. The collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies that can be used to protect the cyber environment and organization and user’s assets. Organization and user’s assets include connected computing devices, personnel, infrastructure, applications, services, telecommunications systems, and the totality of transmitted and/or stored information in the cyber environment. Cyber security strives to ensure the attainment and maintenance of the security properties of the organization and user’s assets against relevant security risks in the cyber environment. The general security objectives comprise the following: confidentiality, integrity (which may include authenticity and non-repudiation), and availability.21 Cyber Security Controls. Safeguards or counter measures to ensure the confidentiality, integrity, and availability of information assets, systems, or networks and mitigate the risk to those assets, systems, and networks. Cyberspace. A virtual or electronic environment that results from the interdependent network of information and communications technology (e.g., the Internet, telecommunications networks, computer systems, and embedded processors and controllers) that links people with services and information. Ecosystem. A variety of interconnected and interdependent organizations, systems, and devices that interact for multiple purposes using different processes. Exercise. An interactive engagement (half-day to five days or more) that enables participants to react to a plausible scenario in a risk-free environment. Exercises provide an effective tool for testing incident response plans; validating policies, plans, and procedures; identifying vulnerabilities and reporting requirements; assessing risk and preparedness; discovering interdependencies and response gaps; creating a shared perspective and buy-in among diverse stakeholders; and building a common understanding of roles and responsibilities. An exercise may also be referred to as a simulation, seminar, tabletop, drill, or wargame. 23