N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V A special focus in the next two years will be on the extension of models and best practices to the emergence of 5G and to the publication of the European Electronic Communications Code (EECC). In 2021, the regulatory platform will welcome around 100 companies from all sectors. A roadmap for improving methodologies and functionalities is also being developed over the next three years in collaboration with an industrial partner, the regulators (ILR in Luxembourg, BIPT in Belgium) and the companies concerned. The work carried out by LIST has made it possible to: • develop a risk-based methodology for realtime security monitoring of interdependent services in critical infrastructures, • develop a distributed architecture allowing continuous real-time incidents prevention, detection, reaction, and mitigation for critical infrastructures, • apply new technologies such as DLT/blockchain in order to create resilient infrastructures for certain use cases. The work carried out by LIST has made it possible to build: • a set of standard risk analysis models, LIST is working on a security risk management framework that is directly linked to the work on resilience, and covers the entire regulatory cycle from the processing of security risk management by the regulated entities to the gathering and analysis of risk-related data by the regulator. The aim is to adopt a framework allowing integration of risk management specificities from various regulations and deal with all of them in an integrated manner. The framework has been implemented in a technological platform encompassing a risk management, an incident management, and a data analytics module. The outcome of this work is an improvement of the quality of risk management results and the reduction of the costs involved in compliance. Sector-based and systemic governance of cybersecurity are part of the key benefits of the approach. • a regulatory platform enabling all companies in the relevant sectors to manage their risks, report their risks to the regulator and notify incidents, • data analytics capabilities at sectoral level for regulators. 42