The protection of NCII in various sectors exceeds the capabilities and mandate of any single Government agency. In Uganda, the National Information Security Advisory Group (NISAG), an inter-sectoral working group provides the platform for collaboration. Considering the changing threat environment, the update of the minimal cybersecurity baseline for NCII operators is inevitable. However, this should be done cognizant of the maturity level of the country to Minimum cybersecurity baselines for NCII avoid the adoption of requirements that are too stringent operators will be established with and not implementable in Uganda’s current setting. The appropriate legislative mechanisms. Ministry of ICT, responsible regulators, NISAG and owners of critical information infrastructures will assess the cybersecurity baseline and provide consistent updates to the baseline consistent with international standards and best practice. NCII Governance model defines clear responsibilities of every stakeholder. The baseline relies on the risk management approach and provides guidelines to NCII operators about the implementation of necessary security measures. It is required that every operator of critical services and infrastructure implements security measures. Guiding principles for NCIIs are the principles NCII operators prepare or update their contingency of personality and minimal adverse plans of critical ICT systems based on the national effects. Ensuring the security of a system is risk environment. Among others, the baseline will arranged by the service provider and in case of address incident response and vulnerability security incident, service provider will apply disclosure among other topics and the mandatory due care and measures to avoid the escalation implementation of the cybersecurity baseline by NCII and spread of the effect of the incident and operators that needs to be regularly audited. will notify the supervisory authority. The Government will continue working together with NCII operators to promote understanding of cybersecurity risks. The cooperation and exchange of information between government agencies and the private sector to identify cyber threats will ensure that the critical ICT systems are protected to a level that is commensurate with the risks faced to ensure the operation Established formats for private-public and recovery of critical services and infrastructures. The partnership are essential for boosting National Information Security Advisory Group - NISAG trust amongst and between the industry provides cyber threat landscape assessment based on and the government. the National Information Risk Register. Furthermore, cyber incident reporting will be made mandatory for all government authorities and NCII operators. The overview of incidents serves as basis for comprehensive cyber threat landscape assessment. NCII operators will be bound to report cyber incidents to their sectoral regulators such is the current practice for communications sector under UCC. As referred in the previous chapter, NISAG’s risk register helps to align cyber risk management with the country’s national crisis/contingency management plan. It can also help harness the necessary capabilities/capacities, people, funding, and strategies to strengthen the overall cybersecurity posture of the Nation. Throughout the years, NISAG has been a platform for collaboration between NCII operators and the government sector. Through NISAG, they have shared the information on an ad hoc basis. NISAG shall develop its procedures, document the NCII assets in the country and will promote a fluent information flow with oversight supervision from the Ministry of ICT and NG. Recognizing the critical and highly interdependent role of NCII operators in managing cybersecurity risks and responding to incidents, the Government will provide the communication channels and cooperation mechanisms between public and private agencies. For every critical sector a National Regulatory Authority will be appointed, that serves as a sectoral national contact point. The role of the contact points is to take lead of NCII protection withing their sectors, to synthesize the information collected from NCII operators and contribute to the cyber threat landscape assessment on national level. ICT service providers and NCII operators shall pay attention to risks that are related to supply chain security. Threat intelligence and respective risk assessments shall be monitored during the IT development 23 (43) [Draft Version for stakeholder consultation]