1 Suggested methodology for defining Mission and Vision The vision provides long-term direction of where the organization will move and how it expects to be viewed by outsiders, whether they are customers, peers, or sponsors. It speaks to the organization’s reputation and its aims for the future. The vision sets out the long-term path the organization will take and serves to guide strategic decisions.10 Bill Gates set forth one of the most famous ICT visions of all time, characterized by its clarity, brevity, and ambition: “A personal computer on every desk.” Vision is closely associated with the culture of each country, and the CSIRT may embody certain traits like a country’s reputation, efficiency, reliability, efficacy, accountability and innovation. However, vision is important not only for external actors but also for actual operations of a CSIRT or organization, since it will shape the values of the organization11. The vision of an organization should not change over time. These are examples of Visions of some of the National CSIRTs in the region. Since the mission and vision define the CSIRT’s outlook in the medium and long term, it is important that these portions of the CSIRT plan have the buy-in of as many, if not all, of the stakeholders identified in the previous chapter. In this sense, it is helpful to form a working group composed of a plurality of stakeholders to determine these two critical components of a CSIRT plan. Delegates to the working group should be designated by their senior management to ensure that final products have the authority and official approval of participating institutions. At the same time, the number of representatives making up the drafting team should be small enough that progress is efficient and only those with the highest interest and influence in the project participate. Once an appropriate list of stakeholders is identified, several working groups should be established to work independently on the mission and vision. With one person serving as moderator, a variety of questions will help attendees throughout the discussion. VenCERT Vision | Venezuela NCCIC | USA Vision VenCERT services protect and guarantee the defense and security of the Nation and the absolute vigilance of the general interests of the Republic, the preservation of the public peace and the proper enforcement of law throughout the country, according to the powers established in the Constitution of the Bolivarian Republic of Venezuela for the National Government. The NCCIC Vision is a secure and resilient cyber and communications infrastructure that supports homeland security, a vibrant economy, and the health and safety of the American people. In striving to achieve this vision, the NCCIC will: CERTuy Vision | Uruguay To be a reliable computer security incident response center and a reference at national and regional levels. 32 A B C D Establishment • Focus on proactively coordinating the prevention and mitigation of those cyber and telecommunications threats that pose the greatest risk to the Nation. • Pursue “whole-of-nation” operational integration by boarding and deepening engagement with its partners to manage threats, vulnerabilities, and incidents. • Break down the technological and institutional barriers that impede collaborative information exchange, situational awareness, and understanding of threats and their impact. • Maintain a sustained readiness to respond immediately and effectively to all cyber and telecommunications incidents of national security. • Serve stakeholders as a national center of excellence and expertise for cyber and telecommunications security issues. Similar to drafting the mission, for creating the vision, the moderators can pose questions to guide delegates. After gathering the opinions of the participants, the moderator will help with the wording to finalize clear and concise statements. Once this step is complete, the results should be circulated to the wider stakeholder group. It is also important to document the process and ensure that minutes are taken at all meetings clearly stating how the activities were conducted and who participated in them. Once completed, the mission and vision will be used throughout the lifecycle of the national CSIRT. Delegates to the working group should be designated by their senior management to ensure that final products have the authority and official approval of participating institutions. PLANNING Vision • How do you expect clients/ the community will view a National CSIRT? • What values do you expect it to inspire? • Will it help improve the quality of life of people? Why or why not? How? • How will the National CSIRT adapt to changes in technology and management? • How will it be able to stand out in its environment? • What do you understand to be the main purpose of a National CSIRT? • What needs would be covered? • Who should it serve? • What kind of services shall it offer? • What considerations would restrict its operations? • What goals or success factors must be considered for the National CSIRT? 33