3 Lifecycle of a National Cybersecurity Strategy 3.3.1 Drafting the National Cybersecurity Strategy Once the stocktaking and analysis phase is complete, the Lead Project Authority, in collaboration with the Steering Committee, should initiate the drafting of the Strategy. Dedicated working groups could be created either to focus on specific topics, or to draft different sections of the Strategy. The working groups should follow the processes established in the Initiation Phase, adjusting these as necessary. The Strategy should provide the overall cybersecurity direction for the country; express a clear vision and scope; set objectives to be accomplished within a specific time frame; and prioritise these in terms of impact on society, the economy and infrastructure. Moreover, it should identify possible courses of actions; incentivise implementation efforts; and drive the allocation of required resources to support all these activities. The Strategy may also include some of the findings developed in the Stocktaking and Analysis Phase. Similarly to the step dealing with planning the development of the Strategy, the actual document needs to put forward a clear governance framework (Section 5.1) that defines the roles and responsibilities of key stakeholders. This includes the identification of the entity responsible for the management and evaluation of the Strategy, as well as an entity responsible for its overall management and implementation, such as a central authority or a national cybersecurity council. The Strategy also needs to define or confirm the mandate of the different entities responsible for initiating and developing cybersecurity policies and regulations within the country. In addition, it should define the responsibilities and tasks of the entities responsible for collecting threat and vulnerability information, responding to cyber-incidents (e.g., national CERTs), strengthening preparedness and performing crisis management. It should also ensure that it is clear how all of these entities interact with each other and with the central authority. 3.3.2 Consulting with a broad range of stakeholders As mentioned above, engaging stakeholders is crucial for the success of a Strategy. In order to ensure that the final Strategy is based on a shared vision, the draft document should be disseminated across a wide stakeholder group not limited to those who participated in the Strategy development process. This can happen through a variety of engagements, including online consultation, validation workshops, and additional working groups. It is expected that feedback and comments resulting from this process will be used to finalise the Strategy. 3.3.3 Seeking formal approval In the final step of the Strategy development, the Lead Project Authority should ensure that the Strategy is formally adopted by the Executive. This official adoption process will vary by country and be based on how the Strategy is defined in the legislative framework. For example, it could be adopted through a parliamentary procedure or a government decree. Guide to Developing a National Cybersecurity Strategy 23