prosecutors have the capacity to build cases on electronic evidence, but this capacity is limited as training is largely ad-hoc, not institutionalised and informal. According to participants, Iceland has fully acknowledged the need for formal and informal cooperation and has established mechanisms for international cooperation in order to prevent and combat cybercrime by facilitating its detection, investigation, and prosecution through established communication channels. The country cooperates with Interpol and Europol and other nations (e.g. Norway and the US) regarding cross-border information sharing and has signed Mutual Legal Assistance agreements which are successfully applied. Standards, Organisations and Technologies Iceland’s capacity in cybersecurity standards, organisations and technologies was identified as ranging from start-up to established stages. The government and the private sector have adopted ICT security, procurement and software development standards and good practices, such as ISO. However, compliance to these standards is not mandatory. Iceland achieves leading scores in technological readiness and Internet access and broadband penetration is one of the highest internationally. Internet is used for e-commerce transactions. However, authentication processes are often weak, e.g. many websites only require simple authentication. There are legal requirements for operational security in articles 11-13 of the Data Protection Act and Rules No 299/2001; however, in a very broad sense. According to participants, telecommunication companies and other CNI have their own internal standards. Software quality is a matter of concern. Priority is mostly given to the quality and performance of software. Additionally, monitoring and quality assessment is conducted in an ad-hoc manner only in few private institutions, so there is no evidence of the extent of software quality deficiencies. All sectors in Iceland deploy up-to-date technical security controls, including patching and backups, but to very different levels. Companies have internal policies for updates and automated software updates are becoming more common. Cryptographic controls deployed meet international standards and guidelines exist for each sector accordingly. Although some state-of-the-art tools, such as SSL or TLS, are deployed routinely by web service providers to secure all communications between servers and web browsers, and EU legislation relating to data protection and e-signatures has been implemented (Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures) - or is being implemented respectively (GDPR) - participants pointed out a lack of understanding amongst the general public about the deployment of such controls. The implementation of the GDPR could provide more general understanding to the general public. The domestic market in Iceland is small and only provides some specialised cybersecurity products, which are not demand-driven. Most organisations rely on products from international companies. Local suppliers of software and services such as penetration testing and auditing do consider cybersecurity. Cyber-insurance is offered by a domestic insurer who 11 | Cybersecurity Capacity Review Iceland, 2017