Coordinated Incident response and Critical Infrastructure protection Referral to Law Enforcement CERTKiribati shall forward report about incidents that have a potentially criminal background to the responsible law enforcement agencies. Law enforcement should create a single point of contact and ensure that the secure infrastructure provided by CERTKiribati is utilized. The government will form an appropriate institutional structure within the law enforcement agency to handle cases of criminal nature reported by CERTKiribati. Critical infrastructure protection The government is aware that critical infrastructure (such as the airport) is increasingly depending on ICT. For the purpose of this strategy critical infrastructure shall be defined as the essential services that underpin Kiribati’s society and serve as a backbone of the economy, security and health. The sectors included in the Critical Infrastructures are but not limited to Healthcare and Public Health Sector, Energy Provider Sector, Water and Wastewater Sector, Transportation Sector, Information and Communication Technology Sector, Food and Agriculture Sector, Financial Service Sector, Government Facility Sector, Emergency Service Sector, Law Enforcement and Judiciary and Tourism Sector. Significant parts of the today information infrastructure can be considered as critical information infrastructure as a failure or limited operation would cause tremendous impact on the vast majority of citizens. And concerns related to Kiribati National Cyber Security Strategy 2020 possible attacks against critical infrastructure are not limited to information infrastructure – various critical infrastructure providers that do not focus on information infrastructure, such as electricity and transportation provider intensively use ICT. Tremendous impact does therefore not only refer to direct damage but also indirect damages. With this strategy the government lays the foundation to increase the ability of a networks and information systems operated or utilized by critical infrastructure provider to resist, at a given level of confidence, accident or malicious action that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data or the related services offered by or accessible via that network and information system. Critical Infrastructure Assessment The government is committed to strengthen the protection of critical infrastructure against Cyber attacks. This shall include the owner of critical infrastructure as well as operator of services using critical infrastructure. To ensure that the implementation of any mandatory standards is based upon the needs as well as capacities of the affected operators of critical infrastructure the government will carry out a needs and risk assessment, focusing on critical infrastructure provider, including small medium enterprises as well as large enterprises and public and private 11