the identification of critical processes and the introduction of different security levels. Furthermore, the CERT shall be responsible for the implementation and control of the developed standards. GOAL 3 Objective 4 Through the CERT or other government services provide basic services to citizens and businesses that have needs in relation to Cybersecurity concerns. This shall include pointing out free of charge tools, providing information material in Bislama, as well as training courses. To carry out the activities public private partnerships (for example with local access provider and computer provider) should be evaluated. Objective 5 Each commercial provider of Internet access in Vanuatu shall be obliged to provide — upon request of the user — a restricted Internet access that includes available technical measures aiming to block content that is not appropriate for children. Furthermore, the provider shall be obliged to provide — upon request of the user — a special reporting for parents or guardians that highlights the services used and other parameters defined by the Child Online Protection Working Group (“COPWG”). Objective 6 Each commercial provider of GSM mobile communication services in Vanuatu shall be obliged to provide — upon request — a SIM card with restricted access to services that may not be appropriate for children. The provider may not charge any additional fees for such service. Objective 7 CERT will develop routines to detect recent trends in relation to Cybersecurity incidents such as, create an emergency level system, summarizing incidents in a reporting format and providing background information, developing a network to communicate such reports through the relevant communication channels (e.g. press releases, information submitted to cooperation partners in rural areas) and submitting this information. CERT shall ensure that the information submitted to the different stakeholders reflect their needs with regard to details (e.g. executive summary for the minister, detailed information for system administrators on technical aspects of an attack) and that information are not distributed to recipients that are not affected. Strengthening the legal framework Policy Statement: In order to protect openness and a safe environment Vanuatu shall have a reliable legal framework that reflects the uniqueness of the country as well as international best practices. National Cybersecurity Policy — English version 9

Select target paragraph3