5 National Cybersecurity Strategy Good Practice 5 National Cybersecurity Strategy Good Practice Cybersecurity affects many areas of socioeconomic development and is influenced by several factors within the national context. Therefore, this Section introduces a set of good-practice elements that can make the Strategy comprehensive and effective, while allowing for tailoring to the national context. These good-practice elements are grouped into distinct focus areas – effectively overarching themes for a National Cybersecurity Strategy. While both the focus areas and the elements have been put forward here as examples of good practice, it is particularly important that the latter are viewed in the national context, as some may not be relevant to a country’s specific situation. Countries should identify and follow the good-practice elements that support their own objectives and priorities in line with the vision defined in their Strategy (Section 4). The order of the individual elements or focus areas below should not be seen as indicating a level of importance or priority. 5.1 Focus area 1 - Governance This focus area introduces good-practice elements to be considered for inclusion in the text of the Strategy when addressing the governance structure for national cybersecurity. The Strategy should clearly state the objectives and ambitions the government has in mind for cybersecurity, as well as outline the roles and accountabilities required to ensure its implementation. 5.1.1 To that end, the Strategy should identify and empower the competent authority accountable for the execution of the Strategy; establish a mechanism to identify and include the government entities affected by, or responsible for, the implementation of the Strategy; commit to include specific, measurable, attainable, result-based and time-based objectives in the implementation plan for the Strategy; and recognise the need to commit resources (e.g., political will, funding, time and people) to achieve the desired outcomes. Ensure the highest level of support The Strategy should have the formal endorsement of the highest level of government. This endorsement serves two important purposes. Firstly, it improves the likelihood that sufficient resources will be allocated and that coordination efforts will be successful. Secondly, it signals to the broader national ecosystem how significant the country finds cybersecurity. Guide to Developing a National Cybersecurity Strategy 36