malicious ICT activity aimed at the critical infrastructure of another State emanating from their territory, taking into account due regard for sovereignty; International Cyber Policy Centre - States’ participation in regional points of contact schemes, like the ASEAN cyber points of contact directory - States facilitate a 24/7 cybersecurity information exchange mechanism - States’ cybersecurity agencies participate in multilateral policy networks, networks of CERTs and networks of international police forces. - States have an ability and willingness to provide and accept (technical) assistance with incident and crisis management, for example through a deployable assistance team or existing support arrangements like the Pacific Cyber Security Operators Network (PacSON). - States’ endorsement of the recommended confidence-building measures from the 2015 UNGGE report, like the set of cyber confidence building measures adopted by the OSCE or the Sydney Recommendations on Practical Futures for Cyber Confidence Building in the ASEAN region. Global Partners Digital  As mentioned above, personal data, including sensitive personal data, is often compromised as a result of incidents which affect CII and or/CI. Information sharing mechanisms across borders should be in compliance with international human rights law, and reflect trust conditions referred to in the “OECD Council’s Recommendation on Digital Security of Critical Activities”xli and the EU’s “Directive on security of network and information systems”.xlii Institute for International Cyber Stability  Clarity on the principle of due diligence under international law would be especially helpful in implementing this norm. It is generally accepted that under the principle of due diligence in international law if a State is requested to help in investigating some harmful activity emanating from that State, the State being requested should assist in that request. A number of States have also supported the position that this principles of international law requires a State to take specific steps to mitigate any malicious ICT activity emanating from its territory. States should seek consensus on the due diligence principle under the law and provide their positions in writing regarding how the principle applies to the use of ICTs. Microsoft  In responding to and dealing with such requests, and where appropriate, we recommend leveraging the resources, experience and expertise from all relevant stakeholders – including from industry and civil society/academia. All of these actors can act as “force-multipliers” for each other, thereby creating a situation where the joint effort is larger than the sum of its parts. Tech Accord  Firstly, to implement the norm, states should ensure that the appropriate points of contact are identified, kept up to date, and have sufficient resources to be able to respond to any incoming requests. Cybersecurity Tech Accord signatories believe that taking a leaf from coordinated vulnerability disclosure, states should also have communication plans in place and ensure that they respond to the request even if it is determined that they are unable to help.  Secondly, in responding to with such requests, and where appropriate, we recommend leveraging the resources, experience and expertise from all relevant stakeholders, including from industry and civil society.  Thirdly, states should participate in information sharing initiatives, either at regional level or bilaterally, which ensure that contacts and trust is established well before a specific incident can occur.  Finally, as highlighted above under norms c, state should have comprehensive frameworks in place that allow them to prosecute actors active on their territory. Cybersecurity Tech Accord signatories believe that the principle of due diligence forms a key aspect of international law and that creates an additional duty to mitigate malicious ICT activity in this context. (i) States should take reasonable steps to ensure the integrity of the supply chain so that end users can Australian Strategic Policy Institute, International  Implementation of norms are demonstrated by states’ actions, capabilities, and strategic policy direction. As this norm deals with States’ efforts to ensure the integrity of the ICT supply chain, examples of implementation include: - States issue guidance on risk management in the ICT supply chain @DFAT DFAT.GOV.AU