and national level. Awareness-raising in relation to online disinformation campaigns and fake news on social media specifically aimed at undermining democratic processes and European values is equally important. While the primary responsibility remains at national level – including for European Parliament elections – the pooling of expertise and sharing of experience at the European level has proven to be of value-added in providing a focus for action.56 There is also a strong role for industry in general, but with particular attention to digital services providers and manufacturers. It needs to support users (individuals, businesses and public administrations) with tools that allow them to take responsibility for their own actions online, making clear that maintaining cyber hygiene is an indispensable part of the offer to consumers57. To detect and remove vulnerabilities, industry should strive to have internal processes in place that deal with investigation, triage and resolution of vulnerabilities, regardless whether the source of potential vulnerability was external or inside the company concerned. Key actions          3. Full implementation of the Directive on the Security of Network and Information Systems; Swift adoption by the European Parliament and the Council of the Regulation setting out a new mandate for ENISA and a European framework for certification58; A joint Commission/industry initiative to define a "duty of care" principle for reducing product/software vulnerabilities and promoting "security by design"; Swift implementation of the blueprint for cross-border major incident response; Launch an impact assessment to study the possibility for a Commission proposal in 2018 to set up a Network of Cybersecurity competence centres and a European Cybersecurity Research and Competence Centre, building on an immediate pilot phase; Support Member States in identifying areas where common cybersecurity projects could be considered for support by the European Defence Fund; An EU-wide one-stop-shop to help victims of cyber-attacks, providing information on latest threats and bringing together practical advice and cybersecurity tools; Action by Member States to mainstream cybersecurity into skills programmes, egovernment and awareness campaigns; Action by industry to step up cybersecurity-related training for their staff and adopt a "security by design" approach for their products, services and processes. CREATING EFFECTIVE EU CYBER DETERRENCE Effective deterrence means putting in place a framework of measures that are both credible and dissuasive for would-be cyber criminals and attackers. As long as the perpetrators of cyber-attacks – both non-state and state – have nothing to fear besides failure, they will have little incentive to stop trying. A more effective law enforcement response focusing on detection, traceability and prosecution of cyber criminals is central to building effective 56 57 58 An example is the East StratCom Task Force set up in 2015 by Member States and the High Representative to address Russia's ongoing disinformation campaigns. The team is engaged in developing communication products and campaigns focused on explaining EU policies in the Eastern Partnership region. Some manufactures are already used with this concept as some European product legislation (such as the Machinery Directive 2006/42/EC) prescribes principles for "safety by design". COM(2017) 477. 12