CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND ensuring citizens security and continuity of operation of the state. Moreover, security of the most important sectors of the economy, specifically the energy sector, depends on ensuring undisturbed operation of industrial operational technologies (OT). This is why the government shall take ensuring of IT and OT cybersecurity as a priority. This has already been reflected in analyses regarding specification of security requirements that must be met by telecommunications operators, specifically when building the 5G network which will become the backbone for the functioning of the state in the area of mobile telecommunications. It is assumed that some legal amendments must be taken in this area in order to enable an appropriate control of ensuring cybersecurity. Furthermore, bearing in mind that the sole responsibility for ensuring security of services relies primarily on providers, the government shall take supporting actions to increase capacity and competences in cybersecurity of operators of essential services, critical infrastructure operators and digital service providers. These actions, for ensuring its adequacy, shall take into account their different specifics and their different cybersecurity maturity. In addition, the government shall support all these entities in responding to significant, critical and substantial incidents, especially in the event of cross-sectoral incidents. Firstly, consistent actions shall be taken to develop criteria of identification of critical infrastructure operators and operators of essential services, taking into account the need for including them into the crisis management system. This process shall be carried out in cooperation with all sectors. Based on mechanisms provided for by a law, minimum cybersecurity requirements shall be recommended with a particular focusing on business continuity management. Digital service providers shall be covered by a similar regime. However, the government is fully aware of the international nature of these entities and of the need to ensure such a regulations that support the development of a digital market in Poland. Therefore, actions in this area shall be conducted at the European level, particularly within the NIS Cooperation Group, and within the framework of transatlantic cooperation with British and American institutions which stir improvement of cybersecurity standards among digital service providers. 5.5 Development and implementation of a risk assessment methodology at the national level A joint static and dynamic risk assessment methodology that take into account the specificity of individual sectors, critical infrastructure operators, operators of essential services and digital service providers, shall be introduced for the purpose of cybersecurity management at the national level. This shall ensure comparability 16 CYBERSECURITY STRATEGY OF THE REPUBLIC OF POLAND of assessment, also regarding risk levels, in particular for the purpose of the national security risk reports, developed in accordance with the crisis management regulations. Risk assessment shall become a continuous process that will enable depicting the risk level in near real time. The methodology and tools enabling static and dynamic risk assessment in ICT systems are being developed as part of the National Cybersecurity Platform project funded by the National Centre for Research and Development – the completion of work is scheduled by the end of 2020. 5.6 Increasing capacity to counteract cybercrime, including cyberespionage and incidents of a terrorist nature With regard to increasing the capacity to counteract cybercrime, including cyberespionage and events of a hybrid nature (including events of a terrorist nature), it is important to provide support to operators of essential services, digital service providers and critical infrastructure operators so that they can detect and combat incidents at any stage. To this end, cooperation and coordination of actions of law enforcement agencies is required irrespective of the motives of the perpetrators, and appropriate preservation of digital evidence is particularly important. Increasing the effectiveness of procedural and operational activities requires establishing and broadening the interaction of law enfo rcement agencies with other entities that may have knowledge which is helpful to determine the substance of an offence or identify the perpetrator. This includes cooperation with national and international private sector entities, in particular in the telecommunications, banking and insurance sectors. It is also necessary to ensure continuous information sharing on threats and vulnerabilities, both at the national and international level. Given the nature of cyberspace, combating cybercrime requires cross-border cooperation of law enforcement agencies and CERT/CSIRT units. The time factor is critical in procedural actions and operational investigation related to offences committed in cyberspace. This means that efficient and reliable information sharing channels between law enforcement agencies of different countries are required. Given the dynamic nature of cyberspace offences and the related need to take procedural and operational actions, it is necessary to introduce regulations that enable processing and transfer of electronic procedural documents. Rapidly changing methods of crime require development of research in the field of combating cybercrime, the results of which will provide support to law enforcement agencies. The results of this research will be used in the work of law enforcement and judicial authorities, and will provide material to develop preventive measures. Awareness campaigns shall be enrolled to inform the public about cybercrime threats and methods to prevent or mitigate them. Operators of essential services, providers of digital and Internet access services as well as NGOs and public entities shall play an important role in this type of activity. The methodology and tools enabling static and dynamic risk assessment in ICT systems are being developed as part of the research project titled „The National Cybersecurity Platform”, carried out by the Research and Academic Computer Network (NASK) and funded by the National Centre for Research and Development as part of the CyberSecIdent Programme – Cybersecurity and e-Identity. 7 17