4 Overarching principles disruption of operations, undermining of innovation, etc. As with other types of risk, cybersecurity risk cannot be entirely eliminated but they can be managed and minimised. To address that challenge, the Strategy should encourage entities to prioritise their cybersecurity investments and to proactively manage risk. Depending on an entity’s risk appetite, a balance has to be maintained between security measures and potential benefits, considering the dynamic nature of the digital environment. The Strategy should also recognise the need for continuous risk management and facilitate a coherent approach across interdependent entities. The focus on risk management will also prepare stakeholders for potential security incidents, ensuring the resilience of economic and societal activity in the country. With that in mind, the Strategy should encourage the adoption of businesscontinuity measures, which include incident and crisis management, as well as recovery plans. Further references available on page 58. 4.7 Appropriate set of policy instruments The Strategy should utilise the most appropriate policy instruments available to realise each of its objectives, considering the country’s specific circumstances. The government’s cybersecurity goals will only be achieved if a change in behaviour occurs across all stakeholders involved. In most cases, governments have different levers and policy instruments at their disposal to achieve that outcome. These include legislation, regulation, standardisation, incentive and information-sharing programmes and mechanisms, education programmes, sharing best-practice, setting expected norms of behaviour, and building communities of trust among others. Each of these has its own strengths and weaknesses, comes at differing cost, and brings different results. The best results can be achieved by selecting the most appropriate policy instrument for each individual objective and balancing the use of different tools. Further references available on page 59. Guide to Developing a National Cybersecurity Strategy 33