A/75/123 France has developed means of assessing incidents, including through a severity scale to help decision makers to conduct analyses and take action. In determining the severity of an incident, France takes into account, among other things, its consequences for the following: – The interests and sovereignty of the nation, and democracy – Domestic and civil security – People and the environment – The economy Other criteria, such as intent, dangerousness, attribution, volume and recurrence, may be taken into consideration. Norm (c): States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs. In order to ensure that its territory is not used to carry out malicious acts, France has: – Required operators of vital importance, namely, operators of national critical infrastructure (see Act No. 2013-1168) and operators of essential services (see Act No. 2018-133), to strengthen the security of their information and communications systems; – Criminalized, in article 323-1 of the Criminal Code, unauthorized intrusions into third parties’ information security systems; – Strengthened, through Act No. 2018-607, the capacity of the National Cybersecurity Agency to detect cyberincidents affecting operators of critical infrastructure; – Encouraged the responsible disclosure of vulnerabilities through Act No. 2016 1321, under which individuals who inform the National Cybersecurity Agency of a vulnerability in a digital product or service are protected from legal action. Norm (d): States should consider how best to cooperate to exchange information, assist each other, prosecute terrorist and criminal use of ICTs and implement other cooperative measures to address such threats. States may need to consider whether new measures need to be developed in this respect. In addition to the information provided above regarding cooperation, France has developed a range of measures to improve cooperation with its partners to prevent the criminal and terrorist use of information technologies, in particular by acceding to the Convention on Cybercrime (Budapest Convention) and supporting the Christchurch Call to eliminate terrorist and violent extremist content online. At the technical level, the National Cybersecurity Agency continues to establish partnerships with its counterparts in many countries in order to encourage the sharing of critical data, such as information on vulnerabilities or faults in products and services. In addition, the government computer emergency response team, part of the National Cybersecurity Agency, is active in several multilateral networks (the Forum of Incident Response and Security Teams, the European Task Force on Computer Security Incident Response Teams, the European Government Computer Emergency Response Team and the Computer Security Incident Response Team Network of the European Union) through which it maintains contacts with computer emergency response teams worldwide. Norm (e): States, in ensuring the secure use of ICTs, should respect Human Rights Council resolutions 20/8 and 26/13 on the promotion, protection and 34/84 20-08285