organisation deals with cybersecurity issues, but not of the broader strategic implications for government and society. However, apart from those in the financial sector there are no mandatory training courses or programmes. In higher education, some courses exist in cybersecurity-related fields, such as information security, network security and cryptography, but cybersecurity-specific courses are not yet offered in Iceland. Some universities offer programmes in computer science and computer engineering at an undergraduate and postgraduate level with cybersecurity often being a module within these curricula. The CSC has now established an informal agreement with the Department of Information Security and Communication Technology at NTNU, Norwegian University of Science and Technology, which is one of the most advanced in the field of information security in the Nordic countries. A part of this plan is to develop closer ties with UoI and RU, e.g. concerning graduate and undergraduate courses and also concerning events that can help to stimulate interest in cybersecurity and provide interesting challenges for students. Research and development is an important consideration in education. The MoESC and the Ministry of Industries and Innovation (MoII) have the main responsibility for running the research and innovation scheme. However, it was not possible to identify whether specific programmes and research funds on cybersecurity or related fields are running currently. At the national level, the need for training professionals in cybersecurity in Iceland has been documented. ICT professional certification with some security modules or components is available. Review participants mentioned that currently the Estonian Technology Fund, a state-run public institution that invests into young and growth-oriented technology companies, is dedicated to the provision of online courses because overall there is not enough expertise among educators to provide training in cybersecurity. Executive training courses for CEOs or chief financial executives are offered on an ad-hoc basis, including topics such as good governance practices related to cybersecurity and risk management. Legal and regulatory frameworks The legal and regulatory frameworks in Iceland range between formative and established stages of maturity. Iceland has implemented provisions relevant to cybersecurity comprehensively in its ICT legislative and regulatory frameworks. The Regulatory Framework of the European Union – through the country’s EEA membership – applies in Iceland and has shaped many regulations and existing legislation to protect the rights of individuals and organisations in the digital environment. The Electronic Communications Act (ECA) No. 81/2003, the Act on the Post and Telecom Administration (APTA) No. 69/2003, and its Amendment No. 62/2012 stipulate certain provisions regarding cybersecurity and critical information infrastructure. Additionally, the Icelandic Media Law requires providers to ensure that the transmission of service via electronic communications networks is secure (Article 45). Act No. 30/2002 on Electronic Commerce and other Electronic Services stipulates the liability of ISPs and establishes a system of takedown notices in certain cases for IP addresses or other 9 | Cybersecurity Capacity Review Iceland, 2017