exercise took place in 2015 and assessed the quality of the incident response processes, procedures, interactions, and information-sharing mechanisms that exist under the NCC Agreement. The Data Protection Act as it is today does not require reporting of security breaches but the DPA still receives a few informal reports every year. Most knowledge of incidents concerning personal data is gathered through the media and individuals that are affected by such incidents. Under the NCSS, the reporting of cybersecurity incidents is to be made obligatory as it is considered to be crucial for organisations that suffer a cyberattack. Review participants stated that the EU NIS Directive and the GDPR implementation will lead to the formalisation of a mechanism for incident reporting. D1.3 CRITICAL INFRASTRUCTURE (CI) PROTECTION This factor studies the government’s capacity to identify Critical Infrastructure (CI) and Critical Information Infrastructure (CII) assets and the risks associated with them, to engage in response planning and critical assets protection, to facilitate quality interaction with CI asset owners, and to enable comprehensive general risk management practice including response planning. Maturity Stage: Formative The protection of critical infrastructure from cyber-threats is a priority for the Icelandic authorities. The National Cybersecurity Strategy (NCSS) aims to promote the integrated functioning of important elements of the infrastructure of society by increasing the resilience of cyber systems to cope with hazards. The Parliamentary Resolution on a National Security Policy for Iceland (no. 26/145)19 speaks to Iceland’s independence and sovereignty, territorial integrity, the safety of its citizens, and the protection of its governmental system and social infrastructure. A list of general critical infrastructure (CI) assets has been created20. The National Commissioner of the Icelandic Police (NCIP) is responsible for identifying these assets. In the course of the CMM review it was mentioned that NCIP is currently in the process of developing a list of Critical Information Infrastructure (CII) assets as part of preparing the NIS Directive implementation. 19 https://www.government.is/media/utanrikisraduneyti-media/media/Varnarmal/National-Security-PolicyENS.pdf 20 This has e.g. been published in the National Civil Protection Strategy (in Icelandic): https://www.stjornarradid.is/media/forsaetisraduneyti-media/media/frettir2/stefna-i-almannavarna-ogoryggismalum2015-2017.pdf 22 | Cybersecurity Capacity Review Iceland, 2017