- Establish and maintain incident-response functions, for example, Computer Emergency Response Teams (CERTs) which are able to coordinate, share good practices, and cooperate in response to ICT incidents. Publish statements to the effect that they will act in accordance with the framework of responsible State behavior in cyberspace, as articulated in the 2015 UN GGE report Participate in regional and bilateral initiatives that aim to develop and implement confidence-building measures. iii. Member States should be encouraged to compile and streamline the information that they present on their implementation of the accepted norms. b. In case of ICT incidents, States should consider all relevant information, including the larger context of the event, the challenges of attribution in the ICT environment and the nature and extent of the consequences (2015 ¶13(b)). i. States could establish the national structures, policies, processes and coordination mechanisms ii. iii. iv. v. vi. c. necessary to facilitate careful consideration of serious ICT incidents and to determine appropriate responses Once those structures and processes are in place, States could develop ICT incident assessment or severity templates to evaluate and assess ICT incidents. Transparency about and harmonization of such templates by regional organizations could ensure commonality in how States consider ICT incidents and improve communication between States. Wherever possible, the templates should be in line with existing practices and avoid duplication. When considering all relevant information in the case of an ICT incident, States should conduct research into possible gendered impacts, and work inclusively with all stakeholders to understand the larger context of an ICT incident, including its impact on the enjoyment of LGBT and women’s rights. States should consider the impact of ICT incidents on human rights, including the rights to freedom of expression, association and peaceful assembly, the right to be free from arbitrary or unlawful interference with privacy, as well as the rights of people with disabilities. States should recognize that responses to security incidents often requires involvement from various stakeholders, not just national CERT/CSIRTs, and improve collaboration through training and capacity building with all stakeholder groups. States should encourage digital security training and other capacity building and assistance by stakeholders, including civil society, aimed at preventing security incidents, particularly to vulnerable communities and other users at risk. States should not knowingly allow their territory to be used for internationally wrongful acts using ICTs (2015 ¶13(c)). i. With respect to the implementation of this norm: If a State identifies malicious cyber activity emanating from another State’s territory or cyber infrastructure, a first step could be notifying that State. Computer Emergency Response Teams (CERTs) are crucial to being able to identify such activity. Given that ICT incidents can emanate from or involve third States, it is understood that notifying a State does not imply responsibility of that State for the incident. - The notified State should acknowledge receipt of the request via the relevant national point of contact. - When a State has knowledge that its territory or cyber infrastructure is being used for an internationally wrongful act conducted using ICTs that is likely to produce serious adverse consequences in a State, the former State should endeavor to take reasonable, available and practicable measures within its territory and capabilities, consistent with its domestic and international law obligations, to cause the internationally wrongful act to cease, or to mitigate its consequences. 11