5 National Capacity Development 5.1 State of Play Until 2011, governmental responsibility for cybersecurity in Ireland was spread across a number of different organisations, including both military and civilian authorities. In July 2011, the Government decided to establish the National Cyber Security Centre (NCSC) in what is now the Department of Communications, Climate Action and Environment, bringing responsibility for all cyber security matters into one operational unit. This decision was based on a detailed analysis of the evolving threats to security, and an assessment of the most appropriate type of organisation to respond to issues and to proactively improve the resilience of key infrastructure and services. This organisational concept has since come to represent best practice in Europe, primarily because it allows for the creation of a single critical mass of experience and operational expertise, and for the end to end management of incidents of all types. The first National Cyber Security Strategy, agreed by Government in 2015, set out a series of measures that would be taken to build the capability of the National Cyber Security Centre (NCSC) and to achieve a high level of security for computer networks and Critical National Infrastructure in the State. These measures focusing capacity development within the NCSC on the Computer Security Incident Response Team (or ‘CSIRT’), and a parallel series of measures aimed at improving the network and information security of Public Bodies. The Strategy also established how the resilience of critical national infrastructure would be improved, in part by the transposition of the NIS Directive, and how the national incident response process would be developed through ongoing participation in the National Emergency Management System. The initial focus of the NCSC was to be in the creation of a Computer Security Incident Response Team, within the organisation. CSIRTs are an internationally recognised organisation type with a set of formal roles around cyber security incident response and information sharing. At their most basic, they are designed to act as focal points for information; by taking in and anonymising incident reports from victims, and then sharing the technical details of both incidents and mitigation strategies with their constituents (those bodies they have been assigned to assist), they can ensure that the broader constituent group has a higher degree of situational awareness as to what is occurring. In this way, CSIRTs are expressly designed to obviate some of the structural challenges emanating from the fragmented ownership of IT systems. 19