Appendix 2 NATIONAL CYBERSECURITY STRATEGY – OUTLINE FRAMEWORK STRATEGY COMPONENTS ASPECTS TO CONSIDER 1. Introduction / background • This section provides a succinct background of the country’s circumstances and the status of its Cybersecurity • • 2. Guiding principles • This section identifies the guiding principles for addressing Cybersecurity within which the strategy is designed and delivered. • • Explain the importance of Cybersecurity to economic and social development. Describe the use of Cyberspace and the nature of Cybersecurity challenges to justify the need for the Cybersecurity strategy Explain the relationship to existing national strategies and initiatives. Build from the principles of the Commonwealth Cybergovernance model. Include any relevant national principles. Describe the delivery principles that guide the design of the objectives goals, vision and objectives. EXAMPLE TEXT FROM PUBLISHED STRATEGIES AND BEST PRACTICE Uganda’s introduction covers: • The definition of information security • The justification for a strategy • Country analysis of current state of information security framework. • Strategy guiding principles • Vision, mission, strategic objectives Note that this example covers the first three sections in this framework. In addition to the Commonwealth Cybergovernance principles and national principles the following delivery principles are recommended: • Risk-based. Assess risk by identifying threats, vulnerabilities, and consequences, then manage the risk through mitigations, controls, costs, and similar measures. • Outcome-focused. Focus on the desired end state rather than prescribing the means to achieve it, and measure progress towards that end state. • Prioritised. Adopt a graduated approach and focus on what is critical, recognising that the impact of disruption or failure is not uniform among assets or sectors. • Practicable. Optimise for adoption by the largest possible group of critical assets and realistic implementation across the broadest range of critical sectors. • Globally relevant. Integrate international standards to the maximum extent possible, keeping the goal of harmonization in mind wherever possible. Page 18 of 33 www.cto.int