1 Document overview In order to provide direction and good practice on “what” should be included in a National Cybersecurity Strategy, as well as on “how” to build, implement and review it, this Guide addresses both elements. The Guide also provides an overview of the core components of what it takes for a country to become cyber-prepared, highlighting the critical aspects that governments should consider when developing their national strategies and implementation plans. Finally, this Guide offers policy-makers a holistic, high-level overview of existing approaches and applications, and a reference to additional and complementary resources that can inform specific national cybersecurity efforts. 1.3 Overall structure and usage of the Guide This Guide has primarily been structured as a resource to help government stakeholders in preparing, drafting and managing their National Cybersecurity Strategy. As such, the content is organised to follow the process and order of a Strategy development: • Section 2 – Introduction: provides an overview of the subject of the Guide with related definitions • Section 3 – Strategy development lifecycle: details the steps in the development of a Strategy and its management during its full lifecycle; • Section 4 – Overarching principles for a Strategy: outlines the cross-cutting, fundamental considerations to be considered during the development of a Strategy; • Section 5 – Focus areas and good practices: identifies the key elements and topics that should be considered during the development of a Strategy; and • Section 6 – Supporting reference materials: provides further pointers to relevant literature that stakeholders can review as part of their drafting effort. In particular, Section 3 addresses the process and aspects related to the development of a National Cybersecurity Strategy (such as preparation, drafting, implementation and long-term sustainability), while Sections 4 and 5 are more focused on the content of a National Cybersecurity Strategy, as they highlight concepts and elements that the document should contain. Guide to Developing a National Cybersecurity Strategy 9