resells international products, but uptake is limited as the terms are often not suitable for local companies. No vulnerability-disclosure framework is in place. Stakeholders mainly share technical details of vulnerabilities informally with other stakeholders, who can distribute the information more broadly; but this is not common. Currently, organisations have established their own processes and mechanisms to receive, disseminate and share information on vulnerabilities, and only some organisations are obliged to report to CERT-IS. Additional Reflections This was the 18th country review supported directly by the Global Cyber Security Capacity Centre at Oxford. It was intended to assist the Government of the Republic of Iceland to gain insights into the breadth and depth of the country’s cybersecurity capacity. Iceland has commenced the process of developing different aspects of cybersecurity capacity across all dimensions, including through revising the National Cybersecurity Strategy and revisiting legal frameworks and regulation. The review suggests a number of specific steps by which Iceland’s cybersecurity capacity might achieve greater levels of maturity. 12 | Cybersecurity Capacity Review Iceland, 2017