Critical Infrastructure Protection operators. The government will promote a nation wide as well as regional debate, involving all relevant public and private stakeholders, to define priorities for the long term resilience and stability of critical infrastructure against cyber attacks. The assessment shall be carried out by CERTKiribati and submit a report including recommendations to parliament after endorsement from Cabinet. National Critical Infrastructure Protection Policy After receiving the results of the assessment the government will decide if further action, especially the development of a National Critical Infrastructure Protection Policy is required. Identification of Critical Infrastructure Taking into account the importance of critical infrastructure and the cyber threats the following immediate measures shall be implemented by CERTKiribati: CERTKiribati together with KSWG will identify infrastructure provider in Kiribati that shall be considered critical based on the definition provided above. The identified infrastructure provider shall be identified that they are considered critical. CERTKiribati with the assistance of KCSWG should develop technical Cybersecurity guidelines for operator of critical infrastructure. CERTKiribati should in addition maintain an incident management system as well as Kiribati National Cyber Security Strategy 2020 the necessary technical and human resources to support critical infrastructure provider in dealing with cyber incidents. The purpose of the support is not to substitute the required resources on the side of the critical infrastructure provider but to provider addition support. Cybersecurity Minimum Standards The provider of critical infrastructure are required to take technical and organisational measures to manage the risks posed to the security of the networks and information systems which they control and use in their operations. Having regard to the state of the art, these measures shall guarantee a level of security appropriate to the risk presented. In particular, measures shall be taken to prevent and minimise the impact of incidents affecting their network and information system on the core services they provide and thus ensure the continuity of the services underpinned by those networks and information systems. To coordinate the activities the provider of critical infrastructure shall appoint a member of senior management as Chief Information Security Officer and ensure that it earmarks a specific budget for implementing Cybersecurity measures. Further more the provider of critical infrastructure is obliged to carry out a risk and exposure self assessment at least once a year and document this process. 13