The CSIRT in the NCSC, called CSIRT-IE, went through an extended phase of capacity building and upskilling. In the early stages, the focus was first on the primary tasks of being able to securely and professionally manage and track incidents and share information with constituents. To do so requires both a pool of trained and experienced staff, and a secure stand-alone IT infrastructure. These have been very significantly developed since 2015, and have resulted in the creation of an expert unit with significant capacity in the full range of cyber security incident response functions. The Defence Forces and An Garda Síochána were central to the early stages of this process, providing both seconded staff and expertise in security, process development and threat intelligence assessment. Also, the UCD Centre for Cybercrime Investigation has been critical in the development of cyber security skills in Ireland; much of the knowledge base that established the NCSC flowed from students and staff of UCD. The development of the CSIRT’s operational capacity was designed to lead to a point where the unit would have a high degree of situational awareness as to cyber security activity in the State, and would have a network of ‘constituents’ with which it could securely share the technical details of incidents, in an anonymised fashion, to allow them take measures to protect their systems and services. These constituents include Government Departments and agencies, and Critical National Infrastructure operators, and number in excess of 130 entities. However, the NCSC was involved in a number of serious cyber security incidents in 2016 and 2017 which pointed both to issues not comprehended in the Strategy. The analysis of these incidents pointed to the need to evolve some of the tools of the NCSC to better respond to future incidents. As such, the NCSC took a series of initiatives during this period to support both critical national infrastructure operators and Government stakeholders. Examples of this include: (i) formalising and augmenting the system of advisories and alerts (which flowed from lessons learned in the incident management process for WannaCry2 and NotPetya), and (ii) the formation in 2017 of the Threat Sharing Group, which acts both as a forum for critical national infrastructure operators, and a means for State Actors (including Gardaí and Defence Forces) to share information with these operators and to engage with cyber security professionals. These same incidents also reinforced the centrality of cyber security to the key security challenges facing the State, and of the need for ongoing and close cooperation with the State’s security services on operational matters. The NCSC has developed significantly in terms of capacity and resources, and its roles have been formally established in law, including responsibilities around Critical National Infrastructure protection and dealing with EU requirements around the security of some 20