MINISTRY OF SCIENCE, TECHNOLOGY AND TELECOMMUNICATIONS   Create networks of trust supported by a non-disclosure legal instrument for the safe exchange of relevant information linked to cybernetic crimes. Design expedited procedures for the exchange of confidential information. Specific Objective 5: Protection of Critical Infrastructures  Promote mechanisms for identification and protection of critical infrastructures, as well as for creation specific public policies, as essential step to prevent and/or mitigate cybernetic security incidents aimed at a damaging o discontinuing sensitive operations. By critical infrastructures is understood the group of facilities, systems, equipment, networks, data and services whose interruption or destruction would have a high negative impact on a country’s basic services, seriously affecting the social and economic welfare of all inhabitants. The chain of supply of goods and services supporting the operation of critical infrastructures is a risk to be assessed taking account of the security measures implemented by these suppliers. In view of the foregoing, this objective is seeking to define a series of activities to ensure the continuity, functionality and integrity of critical infrastructures; with the aim of preventing, managing, mitigating and/or restoring its functions before an eventual cybernetic attack. It is crucial that critical infrastructures operators employ specific security frameworks to manage the evolution of security risks in the acquisition of ICT goods and services. For example, the outsourcing of network operations may increase the risks if suppliers of those services are not willing to agree on a minimum standard of provision, including acceptable response time and application of minimum-security measures. As part of the process to safeguard the critical infrastructure, use of the Industrial Systems Control (SCI), Supervisory Control and Data Acquisition Systems (SCADA) should be specifically examined. Industrial systems are now designed with more connection capacity; therefore, they imply a greater threat to cybersecurity. It is crucial that regulatory entities of classified sectors such as the critical infrastructure assume a more significant role and start defining and dictating clear guidelines on cybernetic security and so that regulated entities comply with the existing regulations, standards and good practices of their particular sector as well as those nationally binding. The implementation of guidelines and greater cooperation among the critical infrastructures operators, I C T services suppliers, systems s u p p l i e r s a n d t h e State is vital. - 42 www.micitt.go.cr