R1.17 Establish a mechanism for regular vulnerability disclosure with defined scope for reporting incidents between CI asset owners and the government. R1.18 Promote strategic engagement between government and CI. R1.19 Define formal internal and external CI communication strategies across sectors, with clear points of contact. R1.20 Optimize the legal framework concerning CNI by amending existing legislation or enacting new regulations as needed to encompass incident prevention, detection and response. R1.21 Continue to invest in capability of Board Members and Senior Leaders of CI organisations to understand cyber-risk intelligence, in both private and public sectors, so that relevant individuals can lead in the face of crisis and take their part in risk management more generally. R1.22 Use CI risk management procedures to create a national response plan including the participation of all vital entities. CRISIS MANAGEMENT R1.23 Prioritise crisis management exercises, especially at a local level, and communicate the value of these exercises to all sectors. R1.24 Conduct compromised communications scenarios and exercises to test emergency response asset interoperability and effective functionality and incorporate the results of the exercises to inform strategic investment in future emergency response assets. R1.25 Plan the exercises by engaging relevant participants, outlining their role in the exercise, and articulating the benefits and incentives for participation. 29 | Cybersecurity Capacity Review Iceland, 2017