- private-to-government (including government-to-government and private-toprivate) threat information sharing about cybersecurity threats, vulnerabilities, and incidents, including with affected parties and companies capable of developing means to develop remediation plans against attacks.  Among existing legal instruments to address critical infrastructure protection, we would like to highlight the EU Security of Networks and Information Systems (NIS) Directive,xxxii which has produced sector cybersecurity guidance and developed a framework to support the assessment of cyber-resilience of regulated organizations (i.e., operators of critical infrastructure and digital service providers). In 2018, the UKxxxiii also implemented the NIS Directive after a public consultation to collect proposals from private actors on introducing the cross-sector Critical National Infrastructure (CNI) regulation.  In particular, we highly welcome several aspects of the NIS Directive such as establishing cooperation of CERTs, rules, procedures and thresholds for incident response as well as transparent reporting requirements. Microsoft  To ensure that organizations that provide critical infrastructure and services are prepared to manage cyber threats as they increasingly use digital technologies, we recommend that states foster the adoption of cyber risk management best practices and security baselines. As further described in a white paperxxxiv and by a global, cross-sector industry coalition,xxxv it is critical that such practices and baselines be interoperable across regions and sectors, leveraging best practices like ISO/IEC 27103xxxvi or the NIST Cybersecurity Frameworkxxxvii and promoting continuity and understanding across highly integrated supply chains and operations. Tech Accord  Cybersecurity Tech Accord signatories have been encouraged by the increased focus by states around the world on protecting critical infrastructure and services from online threats. We urge states to continue focusing in this space and to: - Establish comprehensive policies and plans for protecting critical infrastructure, based on risk management best practices; - Foster capabilities for preventing, detecting, responding to, and recovering from risks to promote operational resiliency. - Promote innovation and investments by learning from policy and operations that can guide the allocation of resources for practices, programs, education, and research related to critical infrastructure protection.  Furthermore, we encourage state to leverage established security baseline approaches, such as ISO/IEC 27103xxxviii or the NIST Cybersecurity Framework,xxxix to ensure that frameworks are interoperable across regions and sectors, as well as promote continuity and understanding across highly integrated supply chains and operations.  As mentioned above, sharing information around what entities have been designed as critical infrastructure would act as an effective confidence building measure.  Finally, we encourage states to invest in capacity building efforts domestically in this space, organizing workshops and trainings with key stakeholders responsible for protecting critical infrastructures from online threats. (h) States should respond to appropriate requests for assistance by another State whose critical infrastructure is subject to malicious ICT acts. States should also respond to appropriate requests to mitigate Asia Pacific Network Information Centre  APNIC ran a workshopxl at the IGF in 2019 where this norm was discussed. There were several interventions that raised questions about who exactly would issue and respond to such a request. The technical community pointed out that in many instances these requests would not naturally loop into the national CERT, sectorial CERTs or other governmental actors. Formalizing these requests could potentially introduce a level of latency that could undermine rather than support cyber security practitioners to resolve an incident. Australian Strategic Policy Institute,  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with States’ ability and willingness to respond to requests for assistance, examples of implementation include: @DFAT DFAT.GOV.AU