number of users feel it is a priority for them to employ good cybersecurity practices. However, cultural aspects and the general level of trust, which is ingrained in the Icelandic culture, has inhibited users from thinking about privacy online and considering protection of their information online as their own personal responsibility. Overall, the participating stakeholders accepted that most Internet users in Iceland trust in the security of the Internet, but this often approaches a “blind” trust that can place individuals and society at risk. However, strong trust has enabled the establishment of e-government services in Iceland. The Government continues to increase e-service provision and tax declarations are already being submitted electronically. In addition, e-commerce services are fully established by multiple stakeholders in a relatively secure environment. Users and stakeholders within the public and private sectors have general knowledge about how personal information is handled online but (proactive) cybersecurity practices are often not used, either due to perceived inconvenience, or to the way people weigh up the tradeoffs in service and protection of their personal information. Act No. 77/2000 on Privacy as regards to the Processing of Personal Data has been in force since 2000 and implements the provisions of Directive 95/46/EC. On grounds of Art. 11 and 12 of the Data Protection Act the Icelandic Data Protection Authority (DPA) has set forth Rules No. 299/2001 on the Security of Personal Data. Iceland is also in the process of implementing the EU General Data Protection Regulation (GDPR). In Iceland, the public and private sectors provide some channels for reporting child abuse online, but these channels are not coordinated and are used in an ad-hoc manner. A hotline through Barnaheill - Save the Children Iceland - focuses on child abuse. Also, the Icelandic Red Cross runs the 1717 Helpline. Any incident, also cyber-related, can be reported via the police emergency number 112, while incidents such as child abuse are also referred to Europol and Interpol. Participants noted that communication links have not been established between the police and the private sector and CERT-IS lacks the resources to take up this role. Moreover, there is ad-hoc media coverage of cybersecurity, with limited information provided and limited reporting on specific issues that individuals face online, such as cyber-bullying. Also, discussions on social media about cybersecurity are not prominent. Education, Training and Skills Observations made during the consultations show that cybersecurity education, training and skills capacity in Iceland ranges from a formative to an established stage of maturity. Awareness-raising programmes, courses, seminars and online resources are available for target demographics from public, private, academia, and civil society sources. However, no national programme for cybersecurity awareness-raising, led by a designated organisation is currently established. The National Cybersecurity Strategy recognises the enhancement of general awareness of cybersecurity issues and this is one of the measures towards the implementation of the nation’s Strategy. Executives are aware of general cybersecurity issues, but not necessarily aware of how these issues and threats might affect their particular organisation. Executives of some particular sectors, such as finance, telecommunications, Internet providers and cloud operators are aware of cybersecurity risks, and how their 8 | Cybersecurity Capacity Review Iceland, 2017