{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Main Page","Instructions","Assessment","Report","lookup_table","setting"],"not_rendered":{"charts":6,"images":3,"macros":1,"external_links":2,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Main Page","index":0,"n_rows":19,"n_cols":23,"rows_kept":19,"cut":false,"hidden":false,"merged":[[14,16,15,20],[15,4,16,9],[14,21,14,22],[16,1,16,2],[16,16,16,20],[15,1,15,2],[4,3,4,10],[10,2,10,11],[11,2,11,11],[18,1,18,5],[15,10,15,11],[16,10,16,11]]}
[" "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Choose the TPL Lable From The Drop-Down Menu According To The TLP Protocol",null,null,null,null,"TLP"]
[null,"Version :",null,1,"Cybersecurity Capacity Maturity Measurement Tool",null,null,null,null,null,"Release Year:",null,2023,null,null,null,null,null,null,null,null,"Red","NOT For Disclosure "]
[null,"Classification :",null,"Clear",null,null,null,null,null,null,"TLP:",null,"Clear",null,null,null,null,null,null,null,null,"Orange","Limited Disclosure "]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Green","Community-Wide Disclosure "]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Clear","Unlimited Disclosure "]

{"sheet":"Instructions","index":1,"n_rows":33,"n_cols":14,"rows_kept":33,"cut":false,"hidden":false,"merged":[[26,3,26,8],[28,3,28,8],[30,2,30,8],[32,2,32,8],[17,1,28,1],[17,2,17,8],[18,3,18,8],[19,2,19,8],[20,3,20,8],[21,2,21,8],[22,3,22,8],[23,2,23,8],[24,3,24,8],[25,2,25,8],[7,1,7,8],[9,13,9,14],[10,12,15,16],[11,1,11,8],[13,1,13,8],[15,2,15,8]]}
[]
[]
[]
[]
[]
[]
[]
[null,"The utilities shown at the top of the page can be used to move from one section to another within this tool"]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,"Disclaimer"]
[null,null,null,null,null,null,null,null,null,null,null,null,"Any information provided in this document is the responsibility of the provider of such information. While we strive to keep the information up to date, correct, confidential and authentic, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the information. or templates, or related drawings contained herein. Any reliance you place on such information is therefore strictly at your own risk."]
[null,"The reference numbers for all components and controls are read from left to right."]
[]
[null,"The steps below show some instructions for how to use the measurement tool:"]
[]
[null,1,"Navigate to the section (Assessment) related to measuring National Cybersecurity Capacity of the nation and its compliance against Cybersecurity Capacity Maturity\nModel for Nations (CMM)."]
[]
[null,2,"The level of commitment of each aspect to the cybersecurity standards is evaluated and measured, so that the following steps are followed:"]
[null,null,"a","In the (Maturity Level) field, the state of commitment for each aspect is determined by choosing one of the following cases:\n"]
[]
[null,null,"b","the stage (                                 ) is chosen when either no cybersecurity maturity exists, or it is very embryonic in nature. There might be initial discussions about cybersecurity capacity building, but no concrete actions have been taken. There may be an absence of observable evidence at\nthis Stage.\n"]
[]
[null,null,"c","the stage (                                     ) is chosen when some features of the Aspect have begun to grow and be formulated, but may be ad hoc, disorganised, poorly defined or simply new. However, evidence of this activity can be clearly demonstrated;\n"]
[]
[null,null,"d","the stage (                                   ) is chosen when the Indicators of the Aspect are in place, and evidence shows that they are working. There is not, however, well thought-out consideration of the relative allocation of resources. \nLittle trade-off decision-making has been made concerning the relative investment in the various elements of the Aspect. But the Aspect is functional and defined;"]
[]
[null,null,"e","the stage (                             ) is chosen when choices have been made about which parts of the Aspect are important, and which are less important for the particular organisation or nation. The strategic Stage reflects the fact that these choices have been made, conditional upon the nation or organisation’s particular circumstances."]
[]
[null,null,"f","the stage (                             ) is chosen when , there are clear mechanisms in place to alter national strategy depending on the prevailing circumstances, such as the technology of the threat environment, global conflict, or a significant change in one area of concern (e.g. cybercrime or privacy). There is also evidence of global leadership on cybersecurity issues. Key sectors, at least, have devised methods for changing strategies at any stage during their development. Rapid decision-making, reallocation of resources, and constant attention to the changing environment are feature of this Stage"]
[]
[null,3,"after completing the evaluation and measurement of compliance with controls, a summary of the results can be viewed in the section (CMM Compliance Summary) within this tool.\n\n"]
[]
[null,4,"  the tool will save the file by following the given form.\n\n"]

{"sheet":"Assessment","index":2,"n_rows":72,"n_cols":6,"rows_kept":72,"cut":false,"hidden":false,"merged":[[10,2,13,2],[14,2,16,2],[10,1,22,1],[17,2,19,2],[20,2,22,2],[28,2,30,2],[23,2,27,2],[23,1,33,1],[34,2,37,2],[38,2,39,2],[34,1,42,1],[40,2,41,2],[43,2,46,2],[47,2,50,2],[51,2,54,2],[55,2,57,2],[43,1,57,1],[61,2,62,2],[58,1,71,1],[58,2,60,2],[64,2,65,2],[66,2,69,2],[70,2,71,2]]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"Dimension","Factor"," Aspect ","Maturity Level  ","Description "]
[null,"D1: Cybersecurity\nPolicy and Strategy","1.National Cybersecurity Strategy","Strategy Development",null,{"$f":"IFERROR(INDEX(lookup_table!A2:G2, 1,MATCH(E11, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Content",null,{"$f":"IFERROR(INDEX(lookup_table!A3:G3, 1,MATCH(E12, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Implementation and Review ",null,{"$f":"IFERROR(INDEX(lookup_table!A4:G4, 1,MATCH(E13, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"International Engagement",null,{"$f":"IFERROR(INDEX(lookup_table!A5:G5, 1,MATCH(E14, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"2.Incident Response and Crisis Management","Identification and Categorisation of Incidents",null,{"$f":"IFERROR(INDEX(lookup_table!A6:G6, 1,MATCH(E15, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Organisation",null,{"$f":"IFERROR(INDEX(lookup_table!A7:G7, 1,MATCH(E16, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Integration of Cybersecurity into National Crisis Management",null,{"$f":"IFERROR(INDEX(lookup_table!A8:G8, 1,MATCH(E17, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"3.Critical Infrastructure (CI) Protection","Identification",null,{"$f":"IFERROR(INDEX(lookup_table!A9:G9, 1,MATCH(E18, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Regulatory Requirements",null,{"$f":"IFERROR(INDEX(lookup_table!A10:G10, 1,MATCH(E19, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Operational Practice",null,{"$f":"IFERROR(INDEX(lookup_table!A11:G11, 1,MATCH(E20, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"4.Cybersecurity in Defence and National Security","Defence Force Cybersecurity Strategy",null,{"$f":"IFERROR(INDEX(lookup_table!A12:G12, 1,MATCH(E21, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Defence Force Cybersecurity Capability",null,{"$f":"IFERROR(INDEX(lookup_table!A13:G13, 1,MATCH(E22, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Civil Defence Co-ordination ",null,{"$f":"IFERROR(INDEX(lookup_table!A14:G14, 1,MATCH(E23, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,"D2: Cybersecurity\nCulture and Society","1.Cybersecurity Mindset","Awareness of Risks",null,{"$f":"IFERROR(INDEX(lookup_table!A15:G15, 1,MATCH(E24, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Priority of Security",null,{"$f":"IFERROR(INDEX(lookup_table!A16:G16, 1,MATCH(E25, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Practices",null,{"$f":"IFERROR(INDEX(lookup_table!A17:G17, 1,MATCH(E26, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Digital Literacy and Skills",null,{"$f":"IFERROR(INDEX(lookup_table!A18:G18, 1,MATCH(E27, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"User Trust and Confidence in Online Search and Information",null,{"$f":"IFERROR(INDEX(lookup_table!A19:G19, 1,MATCH(E28, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"2.Trust and Confidence in Online Services","Disinformation",null,{"$f":"IFERROR(INDEX(lookup_table!A20:G20, 1,MATCH(E29, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"User Trust in E-government Services",null,{"$f":"IFERROR(INDEX(lookup_table!A21:G21, 1,MATCH(E30, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"User Trust in E-commerce Services",null,{"$f":"IFERROR(INDEX(lookup_table!A22:G22, 1,MATCH(E31, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"3.User Understanding of Personal\nInformation Protection Online","Personal Information Protection Online",null,{"$f":"IFERROR(INDEX(lookup_table!A23:G23, 1,MATCH(E32, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"4.Reporting Mechanisms","Reporting Mechanisms",null,{"$f":"IFERROR(INDEX(lookup_table!A24:G24, 1,MATCH(E33, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"5.Media and Online Platforms","Media and Social Media",null,{"$f":"IFERROR(INDEX(lookup_table!A25:G25, 1,MATCH(E34, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,"D3: Building Cybersecurity\nKnowledge and Capabilities","1.Building Cybersecurity Awareness","Initiatives by Government",null,{"$f":"IFERROR(INDEX(lookup_table!A26:G26, 1,MATCH(E35, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Initiatives by Private Sector",null,{"$f":"IFERROR(INDEX(lookup_table!A27:G27, 1,MATCH(E36, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Initiatives by Civil Society",null,{"$f":"IFERROR(INDEX(lookup_table!A28:G28, 1,MATCH(E37, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Executive Awareness Raising",null,{"$f":"IFERROR(INDEX(lookup_table!A29:G29, 1,MATCH(E38, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"2.Cybersecurity Education","Provision",null,{"$f":"IFERROR(INDEX(lookup_table!A30:G30, 1,MATCH(E39, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Administration",null,{"$f":"IFERROR(INDEX(lookup_table!A31:G31, 1,MATCH(E40, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"3.Cybersecurity Professional Training","Provision",null,{"$f":"IFERROR(INDEX(lookup_table!A32:G32, 1,MATCH(E41, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Uptake",null,{"$f":"IFERROR(INDEX(lookup_table!A33:G33, 1,MATCH(E42, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"4.Cybersecurity Research and Innovation","Research and Development",null,{"$f":"IFERROR(INDEX(lookup_table!A34:G34, 1,MATCH(E43, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,"D4: Legal and\nRegulatory Frameworks","1.Legal and Regulatory Provisions","Substantive Cybercrime Legislation",null,{"$f":"IFERROR(INDEX(lookup_table!A35:G35, 1,MATCH(E44, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Legal and Regulatory Requirements for Cybersecurity",null,{"$f":"IFERROR(INDEX(lookup_table!A36:G36, 1,MATCH(E45, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Procedural Cybercrime Legislation",null,{"$f":"IFERROR(INDEX(lookup_table!A37:G37, 1,MATCH(E46, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Human Rights Impact Assessment ",null,{"$f":"IFERROR(INDEX(lookup_table!A38:G38, 1,MATCH(E47, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"2.Related Legislative Frameworks","Data Protection Legislation",null,{"$f":"IFERROR(INDEX(lookup_table!A39:G39, 1,MATCH(E48, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Child Protection Online",null,{"$f":"IFERROR(INDEX(lookup_table!A40:G40, 1,MATCH(E49, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Consumer Protection Legislation",null,{"$f":"IFERROR(INDEX(lookup_table!A41:G41, 1,MATCH(E50, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Intellectual Property Legislation",null,{"$f":"IFERROR(INDEX(lookup_table!A42:G42, 1,MATCH(E51, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"3.Legal and Regulatory Capability and Capacity","Law Enforcement",null,{"$f":"IFERROR(INDEX(lookup_table!A43:G43, 1,MATCH(E52, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Prosecution",null,{"$f":"IFERROR(INDEX(lookup_table!A44:G44, 1,MATCH(E53, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Courts",null,{"$f":"IFERROR(INDEX(lookup_table!A45:G45, 1,MATCH(E54, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Regulatory Bodies",null,{"$f":"IFERROR(INDEX(lookup_table!A46:G46, 1,MATCH(E55, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"4.Formal and Informal Co-operation Frameworks to Combat Cybercrime","Law Enforcement Co-operation with Private Sector",null,{"$f":"IFERROR(INDEX(lookup_table!A47:G47, 1,MATCH(E56, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Co-operation with Foreign Law Enforcement Counterparts",null,{"$f":"IFERROR(INDEX(lookup_table!A48:G48, 1,MATCH(E57, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Government-Criminal Justice Sector Collaboration",null,{"$f":"IFERROR(INDEX(lookup_table!A49:G49, 1,MATCH(E58, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,"D5: Standards\nand Technologies","1.Adherence to Standards","ICT Security Standards ",null,{"$f":"IFERROR(INDEX(lookup_table!A50:G50, 1,MATCH(E59, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Standards in Procurement",null,{"$f":"IFERROR(INDEX(lookup_table!A51:G51, 1,MATCH(E60, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Standards for Provision of Products and Services",null,{"$f":"IFERROR(INDEX(lookup_table!A52:G52, 1,MATCH(E61, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"2.Security Controls","Technological Security Controls",null,{"$f":"IFERROR(INDEX(lookup_table!A53:G53, 1,MATCH(E62, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Cryptographic Controls ",null,{"$f":"IFERROR(INDEX(lookup_table!A54:G54, 1,MATCH(E63, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"3.Software Quality","Software Quality and Assurance",null,{"$f":"IFERROR(INDEX(lookup_table!A55:G55, 1,MATCH(E64, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"4.Communications and Internet Infrastructure Resilience","Internet Infrastructure Reliability",null,{"$f":"IFERROR(INDEX(lookup_table!A56:G56, 1,MATCH(E65, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Monitoring and Response",null,{"$f":"IFERROR(INDEX(lookup_table!A57:G57, 1,MATCH(E66, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"5.Cybersecurity Marketplace","Cybersecurity Technologies",null,{"$f":"IFERROR(INDEX(lookup_table!A58:G58, 1,MATCH(E67, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Cybersecurity Services and Expertise",null,{"$f":"IFERROR(INDEX(lookup_table!A59:G59, 1,MATCH(E68, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Security Implications of Outsourcing",null,{"$f":"IFERROR(INDEX(lookup_table!A60:G60, 1,MATCH(E69, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Cyber Insurance",null,{"$f":"IFERROR(INDEX(lookup_table!A61:G61, 1,MATCH(E70, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,"6.Responsible Disclosure","Sharing Vulnerability Information",null,{"$f":"IFERROR(INDEX(lookup_table!A62:G62, 1,MATCH(E71, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]
[null,null,null,"Policies, Processes and Legislationfor Responsible Disclosure of Security Flaws",null,{"$f":"IFERROR(INDEX(lookup_table!A63:G63, 1,MATCH(E72, lookup_table!A$1:G$1, 0)), \" \")","v":" "}]

{"sheet":"Report","index":3,"n_rows":47,"n_cols":13,"rows_kept":47,"cut":false,"hidden":true,"merged":[[44,10,44,11],[45,10,45,11],[46,10,46,11],[31,10,31,11],[32,10,32,11],[33,10,33,11],[41,10,41,11],[42,10,42,11],[43,10,43,11],[46,0,46,1],[15,10,15,11],[16,10,16,11],[17,10,17,11],[18,10,18,11],[19,10,19,11],[20,10,20,11],[28,10,28,11],[29,10,29,11],[30,10,30,11],[42,0,42,1],[43,0,43,1],[44,0,44,1],[45,0,45,1],[29,0,29,1],[30,0,30,1],[15,0,15,1],[28,0,28,1],[17,0,17,1],[16,0,16,1],[31,0,31,1],[32,0,32,1],[33,0,33,1],[18,0,18,1],[19,0,19,1],[20,0,20,1]]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["status",null,null,null,null,null,null,null,null,null,"status"]
["Start-Up",null,{"$f":"COUNTIF(Assessment!E$11:E$72,Report!A17)/62","v":0},null,null,null,null,null,null,null,"Start-Up",null,{"$f":"COUNTIF(Assessment!E$35:E$43,Report!K17)/COUNTA(Assessment!E$35:E$43)","v":{"$error":"#DIV/0!"}}]
["Formative",null,{"$f":"COUNTIF(Assessment!E$11:E$72,Report!A18)/62","v":0},null,null,null,null,null,null,null,"Formative",null,{"$f":"COUNTIF(Assessment!E$35:E$43,Report!K18)/COUNTA(Assessment!E$35:E$43)","v":{"$error":"#DIV/0!"}}]
["Established",null,{"$f":"COUNTIF(Assessment!E$11:E$72,Report!A19)/62","v":0},null,null,null,null,null,null,null,"Established",null,{"$f":"COUNTIF(Assessment!E$35:E$43,Report!K19)/COUNTA(Assessment!E$35:E$43)","v":{"$error":"#DIV/0!"}}]
["Strategic",null,{"$f":"COUNTIF(Assessment!E$11:E$72,Report!A20)/62","v":0},null,null,null,null,null,null,null,"Strategic",null,{"$f":"COUNTIF(Assessment!E$35:E$43,Report!K20)/COUNTA(Assessment!E$35:E$43)","v":{"$error":"#DIV/0!"}}]
["Dynamic",null,{"$f":"COUNTIF(Assessment!E$11:E$72,Report!A21)/62","v":0},null,null,null,null,null,null,null,"Dynamic",null,{"$f":"COUNTIF(Assessment!E$35:E$43,Report!K21)/COUNTA(Assessment!E$35:E$43)","v":{"$error":"#DIV/0!"}}]
[]
[]
[]
[]
[]
[]
[]
["status",null,null,null,null,null,null,null,null,null,"status"]
["Start-Up",null,{"$f":"COUNTIF(Assessment!E$11:E$23,Report!A30)/COUNTA(Assessment!E$11:E$23)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Start-Up",null,{"$f":"COUNTIF(Assessment!E$44:E$58,Report!K30)/COUNTA(Assessment!E$44:E$58)","v":{"$error":"#DIV/0!"}}]
["Formative",null,{"$f":"COUNTIF(Assessment!E$11:E$23,Report!A31)/COUNTA(Assessment!E$11:E$23)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Formative",null,{"$f":"COUNTIF(Assessment!E$44:E$58,Report!K31)/COUNTA(Assessment!E$44:E$58)","v":{"$error":"#DIV/0!"}}]
["Established",null,{"$f":"COUNTIF(Assessment!E$11:E$23,Report!A32)/COUNTA(Assessment!E$11:E$23)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Established",null,{"$f":"COUNTIF(Assessment!E$44:E$58,Report!K32)/COUNTA(Assessment!E$44:E$58)","v":{"$error":"#DIV/0!"}}]
["Strategic",null,{"$f":"COUNTIF(Assessment!E$11:E$23,Report!A33)/COUNTA(Assessment!E$11:E$23)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Strategic",null,{"$f":"COUNTIF(Assessment!E$44:E$58,Report!K33)/COUNTA(Assessment!E$44:E$58)","v":{"$error":"#DIV/0!"}}]
["Dynamic",null,{"$f":"COUNTIF(Assessment!E$11:E$23,Report!A34)/COUNTA(Assessment!E$11:E$23)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Dynamic",null,{"$f":"COUNTIF(Assessment!E$44:E$58,Report!K34)/COUNTA(Assessment!E$44:E$58)","v":{"$error":"#DIV/0!"}}]
[]
[]
[]
[]
[]
[]
[]
["status",null,null,null,null,null,null,null,null,null,"status"]
["Start-Up",null,{"$f":"COUNTIF(Assessment!E$24:E$34,Report!A43)/COUNTA(Assessment!E$24:E$34)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Start-Up",null,{"$f":"COUNTIF(Assessment!E$59:E$72,Report!K43)/COUNTA(Assessment!E$59:E$72)","v":{"$error":"#DIV/0!"}}]
["Formative",null,{"$f":"COUNTIF(Assessment!E$24:E$34,Report!A44)/COUNTA(Assessment!E$24:E$34)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Formative",null,{"$f":"COUNTIF(Assessment!E$59:E$72,Report!K44)/COUNTA(Assessment!E$59:E$72)","v":{"$error":"#DIV/0!"}}]
["Established",null,{"$f":"COUNTIF(Assessment!E$24:E$34,Report!A45)/COUNTA(Assessment!E$24:E$34)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Established",null,{"$f":"COUNTIF(Assessment!E$59:E$72,Report!K45)/COUNTA(Assessment!E$59:E$72)","v":{"$error":"#DIV/0!"}}]
["Strategic",null,{"$f":"COUNTIF(Assessment!E$24:E$34,Report!A46)/COUNTA(Assessment!E$24:E$34)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Strategic",null,{"$f":"COUNTIF(Assessment!E$59:E$72,Report!K46)/COUNTA(Assessment!E$59:E$72)","v":{"$error":"#DIV/0!"}}]
["Dynamic",null,{"$f":"COUNTIF(Assessment!E$24:E$34,Report!A47)/COUNTA(Assessment!E$24:E$34)","v":{"$error":"#DIV/0!"}},null,null,null,null,null,null,null,"Dynamic",null,{"$f":"COUNTIF(Assessment!E$59:E$72,Report!K47)/COUNTA(Assessment!E$59:E$72)","v":{"$error":"#DIV/0!"}}]

{"sheet":"lookup_table","index":4,"n_rows":63,"n_cols":7,"rows_kept":63,"cut":false,"hidden":true,"merged":[[2,0,2,1],[3,0,3,1],[0,0,0,1],[1,0,1,1],[12,0,12,1],[4,0,4,1],[5,0,5,1],[6,0,6,1],[7,0,7,1],[10,0,10,1],[16,0,16,1],[17,0,17,1],[18,0,18,1],[19,0,19,1],[8,0,8,1],[9,0,9,1],[11,0,11,1],[13,0,13,1],[14,0,14,1],[15,0,15,1],[20,0,20,1],[21,0,21,1],[22,0,22,1],[23,0,23,1],[24,0,24,1],[30,0,30,1],[31,0,31,1],[32,0,32,1],[33,0,33,1],[25,0,25,1],[26,0,26,1],[27,0,27,1],[28,0,28,1],[29,0,29,1],[34,0,34,1],[35,0,35,1],[36,0,36,1],[37,0,37,1],[38,0,38,1],[39,0,39,1],[40,0,40,1],[41,0,41,1],[42,0,42,1],[43,0,43,1],[44,0,44,1],[45,0,45,1],[46,0,46,1],[47,0,47,1],[48,0,48,1],[49,0,49,1],[50,0,50,1],[51,0,51,1],[52,0,52,1],[53,0,53,1],[59,0,59,1],[60,0,60,1],[61,0,61,1],[62,0,62,1],[54,0,54,1],[55,0,55,1],[56,0,56,1],[57,0,57,1],[58,0,58,1]]}
["Aspect",null,"Start-Up","Formative","Established","Strategic","Dynamic"]
["Strategy Development",null,"No national cybersecurity strategy exists, although planning processes for strategy development may have begun.\nAdvice may have been sought from international partners.","Processes for strategy development have been initiated.\nAn outline/draft national cybersecurity strategy has been articulated.\nConsultation processes have been agreed for key stakeholder groups, including private sector, civil society and international partners.","A national cybersecurity strategy has been published.\nAn assessment of country-specific national cybersecurity risk has been conducted.\nThe strategy reflects the needs and roles of relevant stakeholders across government (national and sub-national), business and civil society.\nAn implementation programme is in place which covers the scope of the strategy.\nMechanisms are in place to enable strategy ‘owners’ to monitor achievement of outcomes, address implementation issues and maintain strategy alignment.","Strategy review and renewal processes are in place.\nEmerging cybersecurity risks are regularly assessed and used to update the strategy and implementation plan.\nThe impact of the strategy  on risk and harm reduction is\nunderstood and is used to inform funding and priority decisions.","The national cybersecurity strategy and implementation plan are both proactively reviewed to take account of broader strategic developments within the country (political, economic, social, technical, legal and environmental).\nThe country is an acknowledged authority within the international community and is supporting\nthe development of national and global cybersecurity strategies.\nCybersecurity considerations are embedded within other relevant national-level strategies and implementation programmes."]
["Content",null,"Various national policies and strategies may exist that refer to cybersecurity, but these are not comprehensive and there is little evidence that these reflect specific national priorities and circumstances.","Content exists that reflects country-specific priorities and circumstances.\nLinks exist between the strategy (or draft strategy) and priorities such as national security,\ndigital strategy and economic development, but these are generally ad hoc and lack detail.\nThe strategy (or draft strategy) defines the key outcomes against which success can be evaluated.","The content of the national cybersecurity strategy is based on a comprehensive risk assessment that includes explicit links to  wider national level economic and political policies and strategies.\nThe content includes actions to raise public and business\nawareness, mitigate cybercrime, establish incident response capability, promote public-private partnership and protect critical infrastructure and the wider economy.\nConsideration has been given to how the national cybersecurity strategy might incorporate or support wider online policy objectives such as: child protection; the promotion of Human Rights; the promotion of Equality, Diversity and Inclusion; and managing disinformation.","The content takes account of the impact on cybersecurity risk of emerging technologies and their use within critical infrastructure, the wider economy and society.\nThe outcomes defined in the strategy are specific and measurable. Metrics have been defined which enable stakeholders to evaluate the\neffectiveness of the strategy in reducing harm.\nConsideration has been given  to how the beneficial outcomes of the strategy can be sustained beyond the strategy’s lifetime, including how the maintenance of new capabilities will be financed.","The content takes account of the impact of broader developments on cybersecurity risk (political, economic, social, technical, legal and environmental).\nThe content of the national cybersecurity strategy promotes and encourages bilateral and multilateral co-operation between countries to ensure\na secure, resilient and trusted cyberspace."]
["Implementation and Review",null,"No overarching national cybersecurity\nimplementation programme has been developed.","A co-ordinated cybersecurity implementation programme is being developed with relevant stakeholders involved, including the private sector and civil society.\nActions within the programme have been assigned to specific ‘owners’ but the availability of adequate resources has not yet been confirmed.\nMechanisms to review processes are limited or ad hoc.","A detailed implementation plan has been published including actions, responsible entities and resource budgets. The implementation plan involves relevant stakeholders across government and other sectors.\nA co-ordinating body has been assigned. The body has sufficient authority to ensure that action ‘owners’ are held to account.\nThe resources required to deliver the actions of the programme have been identified and are in place. Budget shortfalls are identified and escalated to the relevant authority.\nProgramme review processes and metrics are in place that allow progress to be measured and risks, issues and dependencies to be escalated to the relevant authority. These processes are adequately funded.","Outcome-oriented metrics are being used to monitor the impact that the programme is having on risk reduction (and other relevant strategy goals).\nThere is evidence of these metrics being used to refine action plans.\nMetrics (both progress and outcome-oriented metrics) are drawn from a wide variety of governmental, non-governmental and international sources.\nThere is independent oversight and/or assurance of the programme.","Mechanisms are in place to make more far-reaching\nchanges to the programme in the event of significant changes in circumstance (political, economic, social, technical, legal and environmental).\nThe programme contributes  to the global development of outcome-oriented metrics and their application."]
["International Engagement",null,"There is limited awareness of the principal international debates relating to cybersecurity policy (such\nas cybersecurity norms, mutual legal assistance, Internet Governance, data sovereignty, data protection).\nThe country may benefit from regional/ international operational collaboration networks but does not actively engage.","The country is aware of the existence of international discussions on cybersecurity policy and related issues.\nThe country may, on occasion, participate in regional or international discussions on matters related to cybersecurity issues, but does not generally play an active role.\nThe country may participate in relevant operational\ncollaboration and policy bodies (such as FIRST*, regional CERT** bodies, the IGF***, or the UN GGE****), but takes mainly a passive role.","An assessment has been made of how the international debates on cybersecurity policy and related issues affect the country’s interests and international standing. Specific engagement objectives have been defined accordingly. Multiple stakeholders have been involved in this process.\nThe country is actively participating in relevant international bodies and forums, either directly or through relevant representative bodies.\nTheir voices are being heard and are having an impact.\nThe country actively contributes to regional/ international operational collaboration and policy bodies.","The country is actively building international communities\nof interest around specific cybersecurity policy goals and promoting their adoption.\nThe country makes a major contribution to regional/ international operational bodies and is actively involved in building capacity in third-party countries.","The country is a leading actor in building consensus, fostering inclusivity and shaping the international debates on key cybersecurity policy issues.\nThe country is focused on the future, seeing emerging issues (around new technology or new types of threat), and is initiating new international debates around the key issues.\nThe country is actively involved in creating new regional/ international collaboration mechanisms."]
["Identification and Categorisation of Incidents",null,"No process for identifying and categorising national-level incidents exists.","Some organisations and sectors have internal mechanisms for identifying and categorising incidents within their purview.\nA process for identifying national-level incidents is under development.\nThere is no central registry in place but ad-hoc arrangements exist for dealing with the most significant events.","Most major organisations have internal mechanisms for identifying and categorising incidents.\nA central registry of national- level cybersecurity incidents exists and a process for timely escalation of incidents, from the organisational to the national level, is in place.\nIndividual national incidents are categorised according to severity and resources are allocated accordingly.","Insights arising from national level incidents are routinely analysed in order to establish lessons and inform broader cybersecurity policy and strategy.","The criteria for categorising incidents are sufficiently flexible to cater for rapidly emerging changes in the underlying technological or threat environment.\nThe country is contributing to international best practice in incident identification and categorisation."]
["Organisation",null,"No organisation for national-level cyber incident response exists.\nA few organisations may have internal cybersecurity response mechanisms in place but co- ordination is minimal.","A national CERT* might exist but lacks sufficient resources and skills.\nProcesses for managing incidents are still in development.\nSome organisations from  public and private sectors have internal cybersecurity response mechanisms in place but co- ordination with the national CERT is ad hoc.\nThe role of sub-national bodies is unclear.\nBilateral co-operation with international partners is limited or ad hoc.","A national body for incident response has been established. It has the resources, skills, documented processes and legal authorities required to address the range of cyber incident\nscenarios that the country is likely to face (including out-of-hours capability, if appropriate).\nRelationships and protocols are in place to enable incident management co-ordination\nbetween the national body and other elements of the public and private sectors.\nThe role of sub-national bodies in incident response is clear and mechanisms are in place to\nenable co-ordination between the national and sub-national levels.\nThere is regular sharing of threat and vulnerability information, and operational good practices between the national body and a wide range of public and private sector organisations, as well as international partners.","The national body undertakes a wide range of engagement activities such as convening\ncommunities of interest, running cross-sector exercises and promoting best cybersecurity practices.\nThe national body innovates to provide a range of additional services that improve the country’s ability to prevent, detect, respond and recover from threats.\nThe national body is widely recognised as an authoritative voice on cybersecurity within the country.\nThe effectiveness of the national body in reducing cyber risk and harm is regularly evaluated\nand benchmarked against international good practice.","The government’s overall operational response is adaptive to changes in the underlying technical and threat environment.\nThe country is contributing to international best practice on how to organise operational responses to cybersecurity threats."]
["Integration of Cybersecurity into National Crisis Management",null,"No framework exists for national- level crisis management.\nCybersecurity has not been considered as a potential national-level crisis scenario.\nEmergency communication capabilities are limited.","A national crisis management framework is in development and a specific organisation has been allocated responsibility for leading national-level crisis response.\nCybersecurity has been recognised as relevant to national crisis management, both as a factor in its own right and as an element of other crisis scenarios.\nAn exercise programme is in development and includes cybersecurity-based scenarios.\nEmergency communication capabilities are in place but may not be well integrated or lack resilience to cyber disruption.","Cybersecurity is fully integrated into the national crisis management framework and the organisation responsible for crisis management is equipped to deal with a range of cybersecurity- related scenarios.\nThe role of a cyber incident management authority within the crisis management process is well defined and established, and escalation thresholds are fully understood.\nNational crisis management scenarios with cybersecurity components are regularly exercised.\nEmergency communication systems are regularly tested for cyber resilience against a range of cybersecurity-related scenarios.","Lessons learnt from cyber crisis exercises are used to inform both national crisis management policy and the national cybersecurity strategy and implementation plan.\nInternational crisis planning and exercising with partners exists and routinely includes cybersecurity as an element.\nThe resilience of emergency communications has been stress- tested against a wide range of potential scenarios.","The country is contributing to the debate on the integration of cyber into national and\ninternational crisis management.\nEmergency communications capabilities are capable of operating beyond the country’s border in order to support third- party countries and global crisis responses."]
["Identification",null,"There may be some appreciation of what constitutes a CI asset, but no formal categorisation of CI assets has been produced.","A list of general CI assets, sectors and operators has been created.","The list of CI assets has been formalised and incorporates a range of appropriate public and private sector organisations.\nSpecific operators have been identified and are aware of their status.\nThe list is kept up to date to reflect changes in the country’s circumstances.\nCross-border dependencies have been identified.","The list of CI assets is adaptive to strategic shifts in the underlying technical, social and economic environment.\nInterdependencies between sectors are managed.\nCross-border dependencies are managed.","There is flexibility in the process for identifying CI assets to cater for rapidly emerging changes in the underlying technological or threat environment.\nThe country is actively involved in the identification and prioritisation of global CI assets.\nCross-sector and cross-border dependencies are mitigated."]
["Regulatory Requirements",null,"There are no existing regulatory requirements specific to the cybersecurity of CI.","The need for baseline standards to govern CI assets is\nacknowledged but these are not explicitly mandated in regulation.\nSector regulators do not routinely assess CI operators for compliance.","CI operators are mandated by regulation to meet appropriate cybersecurity standards (either in the form of specific cyber regulation or as part of broader regulatory requirements).\nMandatory breach reporting and vulnerability disclosure requirements are in place.\n\nFormal processes are in place to evaluate CI operator compliance with regulatory standards and incident and vulnerability disclosure.","Novel approaches to regulatory supervision are being developed to improve CI cybersecurity while also facilitating effective and efficient CI service delivery.\nThe country is promoting best practice regulatory approaches at an international level.","Regulatory frameworks are sufficiently flexible to cater for rapidly emerging changes in the underlying technological or threat environment.\nThe country is actively involved in establishing regulatory approaches to assuring global CI."]
["Operational Practice",null,"A few CI operators may be implementing good\ncybersecurity practices, but this is inconsistent.","Many CI operators are implementing good cybersecurity practice.\nThere is some self-assessment against recognised industry standards.\nSome informal arrangements exist for collaboration across and within sectors.","CI operators are consistently implementing recognised industry standards and the effectiveness\nof their cybersecurity controls are regularly assessed.\nMechanisms are in place for operators to share threat and vulnerability information, best practices and lessons learned from incidents and near misses.\nCI operators participate fully in national incident response and crisis management planning and exercising.\nMechanisms are in place for public authorities to provide information and other practical support to CI operators, both pre- and post- incident.","There is extensive collaboration among CI operators and with public authorities to develop strategies that enhance collective cybersecurity.\nThe resilience of the critical infrastructure ecosystem as a whole has been assessed\nagainst a range of scenarios, and measures are in place to address systemic risks to the economy and society.","The country and its CI operators are contributing to the international debate on global critical infrastructure resilience.\nExperts from the regulators  and CI operators are recognised internationally for their contribution to addressing global infrastructure protection challenges."]
["Defence Force Cybersecurity Strategy",null,"The potential impact of cybersecurity on national security and defence may have been considered but has not been formally articulated.","The potential impact of cybersecurity on national security and defence has been assessed and a strategy for addressing these risks is under development.\nThis analysis includes risks to the ability of the country’s military and other national security assets to operate in a contested cyber environment.","A strategy for cybersecurity for national security and defence  has been formally adopted (stand-alone or as part of a wider document).\nThe strategy is supported by appropriate legal authorities and relevant operational doctrine and rules of engagement. These are consistent with international humanitarian law.\nThe dependence of national security and military entities on the cybersecurity of other parts of the critical national infrastructure is understood and is addressed\nin the defence cybersecurity strategy.\nCybersecurity considerations inform other elements of national security and defence strategy, where relevant.","Defence strategy includes appropriate considerations of deterrence.\nThe country’s defence and national security establishment (alongside other stakeholders) is actively engaged in the global debate on international humanitarian law and norms  of behaviour as they relate\nto conflict in cyberspace. Declaratory strategy and published doctrine may be part of this.","Strategy and doctrine are not static but are adaptive to\nchanging capabilities and to the geo-political and technical threat environment.\nThe strategy is designed to promote stability in cyberspace. This includes measures to predict and influence the strategies and actions and reactions of potential allies and adversaries."]
["Defence Force Cybersecurity Capability",null,"Specialist cybersecurity capability within the national security establishment is limited.","Specialist cybersecurity capability requirements are understood, and relevant organisational structures have been defined.\nInitial steps have been taken to establish these.","Capabilities and organisational structures are in place and have been tested. Resourcing is provided through the national military estimate or equivalent process.\nOperational doctrine and rules of engagement are fully embedded in training.\nSpecialist intelligence resources are being applied to provide support and are appropriately resourced.\nMechanisms to facilitate collaboration with allies are in place and have been tested.","Relevant deterrence and defence/resilience capabilities are in place, forming part of the country’s defence cybersecurity strategy.\nCybersecurity is embedded in wider operational and command training within the country’s military forces.","Defence cybersecurity capabilities are able to support multilateral responses to shared national security challenges."]
["Civil Defence Co-ordination",null,"Collaboration on cybersecurity between civil and defence entities is limited.","Informal collaboration on cybersecurity between civil and defence entities may exist but has not been formalised.\nDefence entities have not been formally resourced to undertake this work.","Collaboration on cybersecurity between civil and defence entities exists and has been formalised.\nRespective roles have been defined within the country’s crisis management procedures.\nThe resources required within  the defence and national security community, to support civil and CI authorities, have been formally assessed and assigned.\nFormal mechanisms are in  place to determine military/ national security cybersecurity dependencies on civil and CI infrastructure. The ability of civil\nand CI infrastructure operators to provide these services has been assured.","Civil defence collaboration on cybersecurity is built into the strategic planning of both sectors and designed to address a range of future crisis scenarios.\nMechanisms are in place that enable defence and the national security community to draw on the skills and capabilities of the broader economy and society. (For example, via a formal cyber reserve force)","The country is leading the international debate on best practice in cross-governmental, civil-defence cybersecurity collaboration."]
["Awareness of Risks",null,"The government has minimal or no level of awareness of cybersecurity risks.\nThe private sector has minimal or no level of awareness of cybersecurity risks.\nUsers have minimal or no level of awareness of cybersecurity risks.","Leading government agencies have a minimal level of awareness of cybersecurity risks.\nLeading private firms have a minimal level of awareness of cybersecurity risks.\nA limited proportion of Internet users have awareness of cybersecurity risks.","There is widespread awareness of cybersecurity risks within most government agencies.\nThere is widespread awareness of cybersecurity risks within most private firms.\nA growing number of Internet users within society have awareness of cybersecurity risks.","Government agencies across all levels are aware of cybersecurity risks and proactively anticipating new risks.\nPrivate sector actors at all levels are fully aware of cybersecurity risks and are anticipating new risks.\nUsers are fully aware of cybersecurity risks and try to anticipate new risks.","Government agencies at all levels are fully aware of cybersecurity risks and use them to update cybersecurity policies and operational practices.\nMost private sector actors across all levels mitigate cybersecurity risks and use them to update cybersecurity policies and operational practices.\nMost users identify and anticipate cybersecurity risks and try to adapt their behaviour."]
["Priority of Security",null,"The government has minimal or no recognition of the need to prioritise cybersecurity.\nPrivate sector actors have minimal or no recognition of the need to prioritise cybersecurity.\nUsers have minimal or no recognition of the need to prioritise cybersecurity.\nNo surveys or metrics exist to document cybersecurity in\ngovernment, private sector, or across users.","Leading government agencies and private firms recognise the need to prioritise cybersecurity.\nPrivate firms recognise the need to prioritise cybersecurity.\nA limited proportion of Internet users recognise the need to prioritise cybersecurity.\nSurveys and metrics to assess knowledge of cybersecurity within the nation are limited or ad hoc.","Most government agencies at all levels are making cybersecurity a priority.\nMost private firms at all levels are making cybersecurity a priority.\nA growing number of Internet users within society make cybersecurity a priority.\nSurveys and metrics to evaluate knowledge of cybersecurity within the nation are available.","Government agencies across all levels routinely prioritise and reassess cybersecurity priorities in response to changing threats to the population.\nMost private sector actors across  all levels routinely prioritise and reassess cybersecurity priorities in response to changing threats to the population.\nMost users routinely prioritise cybersecurity and seek to take proactive steps to improve cybersecurity.\nSurveys and metrics are routinely conducted and publicised in fields of government, business and industry, and among users.","Government agencies at all levels habitually, as a matter of course, prioritise cybersecurity.\nPrivate sector actors at all levels habitually prioritise cybersecurity, as a matter of course.\nUsers habitually prioritise cybersecurity and take steps to improve their security online.\nSurvey results and metrics are used to refine cybersecurity policies, inform operational practices and IT-related initiatives within the nation."]
["Practices",null,"The government agencies do not follow safe cybersecurity practices.\nPrivate sector companies do not follow safe cybersecurity practices.\nIn this country, very few Internet users follow safe cybersecurity practices or take protective measures to ensure their security.","Leading government agencies follow safe cybersecurity practices.\nLeading private firms follow safe cybersecurity practices.\nA limited but growing proportion of Internet users know or follow safe cybersecurity practices.","Most government agencies at all levels follow safe cybersecurity practices.\nMost private firms at all levels follow safe cybersecurity practices.\nMost Internet users within this country know and follow safe cybersecurity practices","Government agencies across all levels routinely follow safe cybersecurity practices.\nMost private sector actors, (including SMEs) across all levels routinely follow safe cybersecurity practices.\nMost users know and routinely follow safe cybersecurity practices.","Government agencies at all levels habitually follow and also develop safe cybersecurity practices.\nPrivate sector actors at all levels habitually follow and develop safe cybersecurity practices.\nNearly all users know  and habitually follow safe\ncybersecurity practices as a matter of course."]
["Digital Literacy and Skills",null,"Very few Internet users in this country critically assess what they see or receive online.\nInternet users generally do not believe or even consider that they have the ability to use the Internet and protect themselves online.\nNo programmes are available to support digital and media literacy skills.","A limited but growing proportion of Internet users critically assess what they see or receive online.\nA limited proportion believe that they have the ability to use the Internet and protect themselves online.\nOne or more programmes are being developed to support digital and media literacy skills.","Most Internet users critically assess what they see or receive online, based on identifying possible risks.\nMost Internet users understand how and act to protect themselves from misinformation online, such as performing a search.\nProgrammes have been developed to support digital and media literacy skills.","Most Internet users critically assess what they see or receive online, based on identifying possible risks.\nMost Internet users recognise questionable information online and take steps to ignore it or check its validity.\nEfforts are under way to co- ordinate programmes that support Internet, digital, and media literacy skills between Internet platform providers, regulators and civil society.","Nearly all Internet users habitually assess the risk in using online services, including changes in the technical and cybersecurity environment.\nInternet users continuously adjust their behaviour based on their assessments of the quality of information they receive.\nInternet platform providers, regulators and civil society are collaboratively developing\nprogrammes to support Internet, digital, and media literacy skills."]
["User Trust and Confidence\nin Online Search and Information",null,"Most Internet users have no trust or have a blind trust in websites and what they see or receive online.\nVery few Internet users feel confident in using the Internet.\nSurveys or other metrics to assess users’ trust and confidence online are not available.","Only a limited proportion of  users have sufficient trust in their use of the Internet.\nA limited proportion of Internet users feel confident using it.\nSurveys and metrics to assess users’ trust and confidence online are limited or ad hoc.","A growing proportion of users have sufficient trust in using the Internet safely and recognise indicators of legitimate sites and information sources.\nA growing number of users feel confident using the Internet.\nSurveys and metrics to assess users’ trust and confidence online are in place and adequately funded.","Most users have a learned level of trust in using the Internet safely and recognise indicators of legitimate sites and information sources.\nMost Internet users feel confident using the Internet, believe they can recognise problematic or non-legitimate websites (including mimicry attempts), and check information using tools such as search options.\n\nSurveys and metrics to assess users’ trust and confidence online are routinely conducted.","Nearly all users trust that they can safely use of the Internet for a variety of purposes and can help others to use it safely.\nNearly all Internet users feel confident using the Internet and sourcing valid content.\nSurveys and metrics have a strong reputation in the region or globally and are shaping the development of metrics in other nations."]
["Disinformation",null,"Internet platform providers are not addressing issues of disinformation such as\nmisinformation, in this nation.\nCivil society and other non- government actors lack the tools and resources to address online disinformation, such\nas exposing misinformation campaigns.\nGovernment agencies and actors have not addressed online disinformation online.","Internet platform providers are developing approaches to\naddress issues of disinformation in this nation.\nThe development of tools and resources to address disinformation have been\ninitiated by leading civil society and non-governmental actors.\nGovernment programmes and initiatives to address disinformation are being\ndeveloped but entail filtering and limited efforts to inform Internet users.","Internet platform providers have a number of approaches in place to address disinformation; these\nrespect freedom of expression and other human rights online.\nCivil society stakeholders have developed tools and resources to address online disinformation.\nGovernment programmes and initiatives to strengthen the public’s preparedness against online disinformation are restricted to awareness raising, but avoid censorship or filtering of information.","Internet platform providers have instituted policies and practices to address disinformation; these respect freedom of expression and other human rights online.\nThe joint efforts of civil society stakeholders are in place and are regularly used to address online disinformation in ways that respect freedom of expression and other human rights online.\nOutcome-oriented surveys are used to refine programmes and initiatives aimed at empowering users and building the public’s understanding of possible online disinformation.","Internet platform providers have instituted policies and practices to address disinformation in some innovative ways that respect freedom of expression and other human rights online.\nThe joint efforts of civil society stakeholders are proactively reviewed to take account of broader strategic developments related to disinformation and awareness raising.\nThe country is supporting the development of national/ regional/ international action plans and guidelines to address disinformation in ways that protect an open Internet and empower users."]
["User Trust in\nE-government Services",null,"Government offers a very limited number of e-services, if any, and has not publicly promoted their security.\nGenerally, the public does not use any significant\ne-government services.\nNo surveys or metrics exist to show how Internet users trust e-government services.\nThere is a lack of information about e-government security and security breaches.","Government has begun to build  a core set of e-services, for which they recognise the need to apply security measures in order to establish trust in their use.\nA limited number of early adopters trust in the secure use of e-government services.\nMetrics to assess users’ trust in e-government services is limited or ad hoc.\nPublic authorities are developing information on privacy and security initiatives and breaches in an ad-hoc manner.","Key e-government services have been developed and have generated a large number of users.\nA sizeable and growing number of Internet users trust in the use of e-government services.\nSurveys and metrics to assess users’ trust in e-government services are in place and adequately funded.\nPublic authorities are publishing information and updates of their privacy and security breaches and initiatives such as privacy by default.","E-government services have become the dominant (default) mode of government information service delivery.\nThe majority of Internet users in this country trust in the secure use of e-government services and make use of them.\nSurveys and metrics to assess users’ trust in e-government services are routinely conducted.\nPublic authorities are co- ordinating, publishing and informing users about privacy and security initiatives and breaches.","E-government services in this country are recognised regionally or internationally.\nInternet users trust that\ne-government services are proactively reviewed, improved and expanded to enhance their security.\nOutcome-oriented surveys are used to review e-government services and evaluate the management of online content.\nThe country is a leader in informing users about current and developing privacy and security breaches, initiatives and other issues."]
["User Trust in E-commerce Services",null,"E-commerce services are not offered.\nInternet users lack the trust to use any available e-commerce services.\nNo surveys or metrics exist to show how Internet users trust e-commerce services.\nThere is little or no recognition of the need for security initiatives for e-commerce services.","E-commerce services are being provided to a limited extent.\nA limited number of early adopters trust in the secure use of e-commerce services.\nMetrics to assess users’ trust in e-commerce services is limited or ad hoc.\nThe private sector recognises the need for the application of security measures to establish trust in e-commerce services.","E-commerce services are fully established by multiple stakeholders in a secure environment.\nA sizeable and growing number of Internet users trust in the secure use of e-commerce services.\nSurveys and metrics to assess users’ trust in e-commerce services are in place and adequately funded.\nReliable security solutions are up to date and available, such as for payment systems. Certification schemes and trust marks for\ne-commerce services are in place.","E-commerce services have become widely accepted as a safe practice for consumers.\nThe majority of users trust in the secure use of e-commerce services and make use of them.\nSurveys and metrics to assess users’ trust in e-commerce services are routinely conducted.\nStakeholders are investing in enhanced service functionality of e-commerce services, protection of personal information and\nthe provision of user feedback mechanisms.","E-commerce services in this country are recognised regionally or internationally.\nInternet users trust that e-commerce services are\nproactively reviewed, improved and expanded to enhance their security.\nOutcome-oriented surveys are used to review and improve\ne-commerce services in order to promote transparent,\ntrustworthy and secure systems.\nTerms and conditions provided by e-commerce services are clear and easily comprehensible to all users."]
["Personal Information Protection Online",null,"Users and stakeholders within the public and private sectors have no or minimal knowledge about how personal information is handled online, nor do they believe that adequate measures are in place to protect their personal information online.\nThere is no or limited discussion regarding the protection of personal information online.\nPrivacy standards are not in place to shape Internet and social media practices.","Users and stakeholders within the public and private sectors may have general knowledge about how personal information is handled online; and may employ good (proactive) cybersecurity practices to protect their personal information  online.\nDiscussions have begun regarding the protection of personal information and about the balance between security and privacy.\nConcrete actions or privacy policies are being developed.","A growing proportion of users have the skills to manage their privacy online, and protect themselves from intrusion, interference, or unwanted access of information by others.\nThere is considerable public debate regarding the protection of personal information and about the balance between security and privacy.\nPrivacy policies have been developed within the public and private sectors.","All stakeholders have the information, confidence and the ability to take steps to protect their personal information online and to maintain control of the distribution of this information.\nUsers and stakeholders within the public and private sectors widely recognise the importance of protection of personal information online and are aware of their privacy rights.\nMechanisms are in place in private and public sectors to shape Internet and social media practices and ensure that privacy and security do not compete.","Users have the knowledge and skills necessary to protect their personal information online, adapting their abilities to the changing risk environment.\nPolicies in private and public sectors are proactively reviewed to ensure privacy and security do not compete in a changing environment and are informed by user feedback and public debate.\nNew mechanisms are in place, such as privacy by default, as tools for transparency and are promoted."]
["Reporting Mechanisms",null,"There are no official reporting mechanisms available, but discussions might have begun.\nUsers do not use social media channels to raise concerns over any cyber harms and problems.\nNo metrics of reported incidents exist.","The public and/or private sectors are providing some channels\nfor reporting cyber harms (such as online fraud, cyber-bullying, child abuse online, identity theft, privacy and security breaches, and other incidents), but these channels are not co-ordinated and are used in an ad-hoc manner.\nInternet users use social media channels to inform other users in an ad-hoc manner.\nMetrics of reported incidents is being developed.","Reporting mechanisms have been established, promoted and are regularly used.\nInternet users widely use social media channels to inform other users.\nThere are good metrics of reported incidents.","Co-ordinated reporting mechanisms are widely used and promoted within public and private sectors.\nInternet users routinely use social media channels to inform other users.\nCyber harm metrics have been used to inform the revision and promotion of new policies and practices.","Mechanisms have been developed to co-ordinate response to reported incidents between law enforcement and the national incident response capability.\nInternet users habitually use social media channels to inform other users and share good practice.\nMetrics are routinely used to inform policy and decision- makers."]
["Media and Social Media",null,"Mass media rarely, if ever, cover information about cybersecurity or report on issues such as security breaches or cybercrime.\nThere is no, or rarely any discussion on social media about cybersecurity.\nAny portrayal of whistleblowers is negative, and based on criminal or other negative stereotypes.","It is perceived that there is ad-hoc mass media coverage of cybersecurity, with limited information provided and\nreporting on specific issues that individuals face online, such as protection for children online, or cyber-bullying.\nIt is perceived that there is limited discussion on social media about cybersecurity.\nThere have been positive examples of cases where whistleblowers have had a constructive impact.","It is perceived that cybersecurity  is a common subject across mainstream media, and information and reports on a wide range of issues, including security breaches and cybercrime, are widely disseminated.\nThere is broad discussion on social media about cybersecurity.\nThere is acceptance that whistleblowers can play a positive role.","It is perceived that mass media coverage extends beyond threat reporting and can inform the public about proactive\nand actionable cybersecurity measures, as well economic and social impacts.\nThere is frequent discussion on social media about cybersecurity and individuals regularly use social media to share online experiences.\nTransparency is encouraged as are whistleblowers.","It is perceived that the broad discussion of personal experiences and personal\nattitudes of individuals across mainstream and social media inform policy making and facilitate societal change.\nSocial media has become a  major component in tracking and addressing cyber harms.\nWhistleblowing has been encouraged and protected as a means of social accountability."]
["Initiatives by Government",null,"No overarching national cybersecurity awareness-raising programme has been developed by the government.\nThe need for awareness of cybersecurity threats and vulnerabilities in the government is not recognised or is only at initial stages of discussion.","A co-ordinated cybersecurity awareness raising programme with the involvement of\nthe government is under development, with relevant stakeholders involved, including the private sector and civil society.\nAwareness-raising programmes, courses, seminars and online resources initiated by the government are available but not sufficiently reflected in the\nnational cybersecurity strategy or is in development.\nThe actions within the programmes are led by different ‘owners’ but they are not yet co- ordinated.\nThe availability of adequate resources has not yet been confirmed.\nInitial system of mechanisms and metrics to review processes are limited or ad hoc.","A co-ordinated national cybersecurity awareness- raising programme with detailed implementation plan is published. The content\nincludes explicit links to national cybersecurity strategy.\nA co-ordinating body has been assigned with sufficient authority and resources required to deliver the actions of the national programme.\nA national cybersecurity awareness portal exists to improve the skills and knowledge of the society\nand is disseminated via that programme.\nProgramme review processes and outcome-oriented metrics are in place, are adequately funded and allow effectiveness to be measured.","The national awareness-raising programme is fully integrated with sector-specific, tailored awareness-raising programmes, such as those focusing on industry, academia, civil society, and/or women and children.\nEmerging cybersecurity risks are regularly assessed and used to update the national\ncybersecurity awareness-raising programme.\nThere is evidence of these metrics being used to refine actions within the national awareness-raising programme and national cybersecurity strategy.","The national cybersecurity awareness-raising programme with private and civil society stakeholders is proactively reviewed to take account of broader strategic developments within the country (political, economic, social, technical, legal and environmental).\nThe country is actively involved in creating new regional/ international cybersecurity awareness-raising programmes that contribute toward expanding and enhancing international awareness-raising good practices.\nThe national cybersecurity awareness-raising programme has a measurable impact on the reduction of the overall threat landscape."]
["Initiatives by Private Sector",null,"The need for awareness of cybersecurity threats and vulnerabilities in the private sector is not recognised or is only at initial stages of discussion.","Awareness-raising programmes, courses, seminars and online resources initiated by the private sector are available but no co- ordination or scaling efforts have been conducted.\nInitial system of mechanisms and metrics to review processes are limited or ad hoc.","Collaborative awareness-raising efforts (e.g.: joint policy and/or advocacy work) with government and civil society stakeholders\nare made in order to pool resources, information and identify solutions for cyber safety practices.\nThe role of specific ‘owners’ assigned to actions within private sector initiatives are clear and mechanisms are in place to enable co-ordination between the levels of government, private sector and civil society.\nProgramme review processes and outcome-oriented metrics are in place, well-funded and shared with government and civil society stakeholders.","The effectiveness of joint awareness-raising efforts with government and civil society stakeholders is regularly assessed and used to enhance collaborative processes.\nPrivate sector initiatives are  fully integrated into the national awareness-raising programme.\nEvidence from the lessons learnt is fed into the development of future programmes.","The joint awareness-raising efforts with government and civil society stakeholders are proactively reviewed to take account of broader strategic developments within the country (political, economic, social, technical, legal and environmental).\nThe joint awareness-raising efforts with government and civil society stakeholders have a measurable impact on reduction of the overall threat landscape."]
["Initiatives by Civil Society",null,"The need for awareness of cybersecurity threats and vulnerabilities in civil society is not recognised or is only at initial stages of discussion.","There are indications that civil society realises that it can play a role in awareness-raising programmes, courses, seminars\nand online resources, but no real deliverables are yet evident.\nInitial system of metrics may exist.","Collaborative awareness-raising efforts (e.g.: joint policy and/or advocacy work) with government and private sector stakeholders are taking place in order to pool resources and information and identify solutions for cyber safety practices.\nThe role of specific ‘owners’ assigned to actions within civil society initiatives are clear and mechanisms are in place to enable co-ordination between the levels of government, private sector and civil society.\nProgramme review processes and outcome-oriented metrics are in place, well-funded and shared with government and private sector stakeholders.","The effectiveness of joint awareness-raising efforts with government and private\nsector stakeholders is regularly assessed and used to enhance collaborative processes.\nCivil society initiatives are fully integrated into the national awareness-raising programme.\nEvidence from the lessons learnt is fed into the development of future programmes.","The joint awareness-raising efforts with government and private sector stakeholders are proactively reviewed to take account of broader strategic developments within the country (political, economic, social, technical, legal and environmental).\nThe joint awareness-raising efforts with government and private sector have a measurable impact on reduction of the overall threat landscape."]
["Executive Awareness Raising",null,"Awareness raising on cybersecurity issues for executives is limited or non- existent.\nExecutives are not yet aware of their responsibilities to\nshareholders, clients, customers, and employees in relation to cybersecurity.","Executives are made aware of general cybersecurity issues, but not how these issues and threats might affect their organisations.\nExecutives of particular sectors, such as finance and\ntelecommunications, have been made aware of cybersecurity risks in general, and how\nthe organisation deals with cybersecurity issues, but not of strategic implications.","Awareness raising of executives in the public, private, academic and civil society sectors address cybersecurity risks in general, some of the primary methods of attack, and how the organisation deals with cyber issues (usually abdicated to the CIO*).\nSelect executive members are made aware of how cybersecurity risks affect the strategic decision making of the organisation, particularly those in the financial and telecommunications sectors.\nAwareness-raising efforts of cybersecurity crisis management at the executive level is still reactive in focus.","Executive awareness-raising efforts in nearly all sectors include the identification\nof strategic assets, specific measures in place to protect them, and the mechanism by which they are protected.\nExecutives are able to alter strategic decision making and allocate specific funding and people to the various elements of cyber risk, contingent on their company’s prevailing situation.\nExecutives are made aware of what contingency plans are\nin place to address various cyber-based attacks and their aftermath.\nExecutive awareness courses in cybersecurity are mandatory for nearly all sectors.","Cybersecurity risks are considered as an agenda item at every executive meeting, and funding and attention is reallocated to address those risks.\nExecutives at regional and international level are regarded as a source of good practice in responsible and accountable corporate cybersecurity governance."]
["Provision",null,"Few or no cybersecurity educators are available, and there are no qualification programmes for educators.\nComputer science courses are offered that may have a security component, but no\ncybersecurity-related courses are offered.\nNo accreditation in cybersecurity education exists.","Qualification programmes for cybersecurity educators are being explored, with a small cadre of existing qualified educators.\nSome educational courses exist in cybersecurity-related fields, such as information security, network security and cryptography, but cybersecurity-specific courses are not yet offered.\nA demand for cybersecurity education is evidenced through course enrolment and feedback.","Qualifications for and supply of educators are readily available in cybersecurity.\nSpecialised courses in cybersecurity are offered and accredited at university level.\nCybersecurity risk-awareness modules are offered as part of many university courses.\nDegrees in cybersecurity-related fields are offered by universities or equivalent educational institutions.\nUniversities and other bodies hold seminars/lectures on cybersecurity issues, aimed at non-specialists.\nResearch and development are leading considerations in cybersecurity education.\nCybersecurity education is not limited to universities or equivalent educational\ninstitutions, but ranges from primary, secondary and tertiary to post-graduate levels, including vocational education.\nSteps might have been taken to incorporate STEM* or\nequivalent education framework with a focus on cybersecurity throughout primary and secondary curricula.","Cybersecurity educators are not only drawn from the academic environment, but incentives are in place so that industry and/or government experts take these positions as well.\nAccredited cybersecurity courses are embedded in all computer science degrees.\nDegrees are specifically offered in cybersecurity, and encompass courses and models in various other cybersecurity-related fields, including technical and non-technical elements such as policy implications, and multi- disciplinary education.\nCybersecurity educational offerings are weighted and focused on an understanding of current risks and skills requirements. The content of cybersecurity courses covers topics on emerging threats in cybersecurity.\nNational or international cybersecurity frameworks and/ or curricular guidelines are taken into consideration by academic institutions when designing cybersecurity courses.\nApprenticeship programmes in different industry sectors are offered to combine knowledge and practical skills.","National courses, degrees, and research are at the forefront of cybersecurity education.\nCybersecurity education programmes maintain a balance between preserving core components of the curriculum and promoting adaptive processes that respond to rapid changes in the cybersecurity environment.\nPrevailing cybersecurity requirements are considered in the redevelopment of all general curricula."]
["Administration",null,"The need to enhance national cybersecurity education is not yet considered.\nA network of national contact points for governmental, regulatory bodies, critical industries and education institutions is not yet established.\nDiscussion of how co-ordinated management of cybersecurity education and research enhances national knowledge development has not or has only just begun.","The need to enhance cybersecurity education  in schools and universities or equivalent educational\ninstitutions has been identified by leading government, industry, and academic stakeholders.\nSchools, government and industry collaborate in an\nad-hoc manner to supply the resources necessary for providing cybersecurity education.\nA national budget focused on cybersecurity education is not yet established.\nInitial system of mechanisms and metrics to review the supply and demand for cybersecurity courses are limited or ad hoc.","Broad consultation across government, private sector, academia and civil society stakeholders informs cybersecurity education priorities and is reflected in national cybersecurity strategy.\nNational budget is dedicated to national cybersecurity research and laboratories at universities or equivalent educational institutions.\nCompetitions, initiatives and funding schemes for students and employees are promoted by government and/or industry in order to increase the attractiveness of cybersecurity careers.\nProgramme review processes and outcome-oriented metrics to review the supply and demand for cybersecurity courses are in place and well-funded.","Metrics are being used to refine actions within educational investment to create a cadre\nof cybersecurity experts in the country across, all sectors.\nManagement of the government budget and spending on cybersecurity education is based on national demand.\nLeading national cybersecurity academic institutions share lessons learnt with other national and international counterparts.\nGovernment has established academic centres of excellence in cybersecurity.","International cybersecurity centres of excellence are established through twinning programmes led by world-class institutions.\nCo-operation between all stakeholders in cybersecurity education is routine and can be proven.\nContent in cybersecurity education programmes is aligned with practical cybersecurity problems and business challenges and provides a mechanism for enhancing curricula based on the evolving landscape."]
["Provision",null,"Few or no training programmes in cybersecurity exist.","The need for training professionals in cybersecurity has been documented at the national level.\nTraining for general IT staff is provided on cybersecurity issues so that they can react to incidents as they occur, but no training for dedicated security professionals exists.\nICT* professional certification is offered, with some security modules or components.\nBest practice training and certifications might be accessible via international online sources (e.g.: CISSP**).\nAd-hoc training courses, seminars and online resources are available for cybersecurity professionals through public or private sources, with limited evidence of take-up.","Structured cybersecurity training programmes exist to develop skills towards building a cadre of cybersecurity- specific professionals.\nNational or international cybersecurity vocational-based frameworks and international best practices are taken into consideration when designing professional training courses.\nSecurity professional certification is offered across sectors within the country.\nThe needs of society are well understood, and a list of training requirements is documented.\nTraining programmes for non- cybersecurity professionals are recognised and offered.\nGovernment initiatives to stay in the country after the successful completion of cybersecurity training programmes might be in place.","A range of cybersecurity training courses is tailored towards meeting national strategic demand and aligns with international good practice.\nThe training programmes outline the priorities in the national cybersecurity strategy.\nTraining programmes are offered to cybersecurity professionals and focus on the skills necessary to communicate technically complex challenges to non- technical audiences, such as management and general employees.\nOutcome-oriented metrics drawn from comprehensive supply-and- demand data for cybersecurity professionals are being used to inform the modes, sustainability and procedures of future training programmes.","The public and private sector collaborate to offer training, and constantly adapt and seek to build skillsets drawn from both sectors.\nTraining offerings and education programmes are co-ordinated so that the foundation established in schools can enable training programmes to build a highly skilled workforce.\nProgrammes and incentive structures are in place to ensure the retention of the trained workforce within the country."]
["Uptake",null,"Training uptake by IT personnel designated to respond to cybersecurity incidents is limited or non- existent.\nThere is no transfer of knowledge from employees trained in cybersecurity to untrained employees.","Metrics that evaluate the take- up of ad-hoc training courses, seminars, online resources, and certification offerings are limited in scope or ad hoc.\nThe transfer of knowledge from employees trained in cybersecurity to untrained\nemployees in both the public and private sectors is ad hoc.","There is an established cadre of certified employees trained in cybersecurity issues, processes, planning and analytics.\nA national register of successful and certified students and professionals might exist.\nThe transfer of knowledge from employees trained in cybersecurity to untrained employees in both public and private sectors is established.\nJob creation initiatives for cybersecurity within organisations are established and encourage employers to train staff to become cybersecurity professionals.\nProgramme review processes and metrics are in place to allow progress to be measured and assess the supply and demand for cybersecurity-skilled workers in both public and private environments. These processes are adequately funded.","The uptake of cybersecurity training is used to inform future training programmes.\nCo-ordination of training across all sectors ensures the national demand for professionals is met.","Cybersecurity professionals not only fulfil national requirements, but domestic professionals overseas are consulted to share lessons learnt and best practice."]
["Research and Development",null,"There are limited or no cybersecurity research and development (R&D) activities occurring in the country.\nThere is no access to R&D activities in cybersecurity from other countries.","Some integration of cybersecurity R&D activities occurs within the country, or with a partner country that understands how cyberactivity R&D applies to the local context of the country.\nThe country may participate in relevant regional/ international cybersecurity-related research collaboration networks.\nCybersecurity R&D performance\nmetrics are limited in scope, or\nad hoc.","Cybersecurity R&D activities have been established and are indicated in the national cybersecurity strategy. R&D strategy may be in development.\nThe resources and processes required to deliver the actions of cybersecurity R&D activities have been identified and are in place. Funding is adequate to deliver these actions.\n\nThere is active regional/\ninternational collaboration with leading practice and developments.\nThe country is actively participating and contributing to regional/ international cybersecurity-related research collaboration networks.\nMetrics for measuring R&D performance are in place and  allow progress to be measured and to improve the cybersecurity R&D capability of the country.","The country is actively building communities of interest around R&D priorities in cybersecurity.\nR&D strategy is in place and fully implemented.\nThe country makes a major contribution to cybersecurity R&D and is actively involved  in building innovation capacity through international R&D consortia and investment.\n\nEmerging cybersecurity risks are regularly assessed and used to update the national cybersecurity strategy and the development of future programmes of the R&D strategy.\nSynergy between academic institutions and industry supports R&D activities and is used to design cyber curricula that cover industry needs.","The country is a leading actor in cybersecurity research and innovation and is shaping international debates on the development of R&D strategic plans.\nThe country is forward looking, seeing emerging issues (around new technology or new types of threat), and uses R&D to prepare a future threat environment.\n\nThe country is contributing to international best practices in cybersecurity R&D."]
["Substantive Cybercrime Legislation",null,"Specific substantive criminal law on cybercrime does not exist. General criminal law may exist, but its application to cybercrime is unclear.","Partial legislation exists that addresses some aspects of cybercrime, or cybercrime legal provisions are in development.","Substantive cybercrime legal provisions are contained in specific legislation or a general criminal law.\nThe country may have ratified regional or international instruments on cybercrime. The country consistently seeks to implement these measures into domestic law.","Measures are in place to exceed minimal baselines specified in international treaties, where appropriate.\nThe country seeks to adapt its substantive cybercrime legislation to take account of\nemerging technologies and their use.","Substantive cybercrime law is constructed so that it can cater for dynamic changes in\nthe underlying technology and threat environment, without the need for substantial and lengthy revision.\nThe country is actively contributing to the international promotion of effective cybercrime legislation."]
["Legal and Regulatory Requirements for Cybersecurity",null,"There are limited cybersecurity requirements set out in regulation or law.\nThe need to create legal and regulatory frameworks on cybersecurity may have been recognised and may have resulted in a gap analysis.","Stakeholders from relevant sectors have been consulted to support the establishment of legal and regulatory frameworks.\nDraft legislation and regulation may be in place, but this has yet to be adopted and may not cover all relevant sectors.","Comprehensive cybersecurity requirements are set out in relevant regulation and law (including sector-specific requirements, where relevant).\nThese requirements may include mandatory standards, or breach notification requirements\nand vulnerability disclosure requirements.\nRelevant civil and criminal liabilities are clearly articulated and understood by regulated entities.\nRelevant legal and regulatory bodies have the powers needed to enforce these requirements.","The effectiveness of law and regulation in improving\ncybersecurity practice is regularly assessed and used to inform their future development.\nRegulations are updated to take account of emerging technologies.","Regulatory frameworks are sufficiently flexible to cater for rapidly emerging changes in the underlying technological or threat environment.\nThe country is promoting best practice legal and regulatory approaches internationally.\nThe country is actively involved in the development of international agreements to promote harmonisation and mutual recognition of cybersecurity laws and regulations."]
["Procedural Cybercrime Legislation",null,"Specific procedural criminal  law for cybercrime does not exist. It is not clear how general criminal procedural law applies to cybercrime investigations, prosecutions, and electronic evidence.","Development of specific procedural cybercrime legislation, or amendment of general procedural criminal law to adapt to cybercrime cases, has begun.","Comprehensive criminal procedural law containing provisions on the investigation of cybercrime and evidentiary requirements has been adopted and is applied.\nThe country may have ratified regional or international instruments on cybercrime. The country consistently seeks to implement these measures into domestic law.\nProcedural laws relating to cybercrime permit the exchange of information (and other actions required) to support successful cross-border investigation of cybercrime.","Measures are in place to exceed minimal baselines specified in international treaties, where appropriate.\nThe country seeks to adapt procedural cybercrime legislations to take account of emerging technologies and their use.","Procedural cybercrime law is constructed in a way that it can cater for dynamic changes in the underlying technology and\nthreat environment, without the need for substantial and lengthy revision.\nThe country is actively contributing to the promotion of effective procedural cybercrime legislation and instruments to improve international cybercrime investigations."]
["Human Rights Impact Assessment",null,"Substantive and procedural cybercrime legislation and cybersecurity regulations may be in development, but no human rights impact assessments have been carried out.","Human rights impact assessments of substantive and procedural cybercrime legislation and cybersecurity regulations may have been conducted, including consideration of privacy and freedom of expression implications. Some issues, however, have yet to be resolved.\nRelevant human rights experts have been consulted in the development of the legislation and regulation.","Full human rights impact assessments of substantive and procedural cybercrime legislation and cybersecurity regulations have been completed and international standards are met.\nImplementation of this legislation is monitored on a regular basis for human rights compliance, and this is independently verified.","Human rights impact assessments are regularly reviewed to ensure that practice remains compatible with human rights requirements, and that the effect of emerging technologies is considered.\nConsideration has also been given to how cybersecurity can enhance human rights protection within the country and internationally.","The country is actively contributing to the development and promotion of human rights impact assessments as they relate to cybersecurity."]
["Data Protection Legislation",null,"Data protection legislation does not exist.","Data protection legislation is in development.\nStakeholders from relevant sectors have been consulted to support the development of this legislation.","Comprehensive data protection legislation in line with international standards and best practice has been adopted and is enforced.\nA lead agency responsible for data protection has been designated.","The effectiveness of data protection legislation is regularly assessed and used to inform its development.\nThe country seeks to adapt data protection laws to take account of emerging technologies and their use.","Data protection legislation is constructed so that it can\ncater for dynamic changes in the underlying technology and\nthreat environment, without the need for substantial and lengthy revision.\nThe country is developing and promoting international standards for data protection legislation.\nThe country is actively involved in the development of legal instruments to enable improved international collaboration in this area."]
["Child Protection Online",null,"Legislation relating to child protection is limited and its application in the online environment is yet to be considered.","Legislation related to child protection is in place and is being adapted to reflect its application in the online environment.\nStakeholders from relevant sectors have been consulted to support the development and adaptation of this legislation.","The application of child protection in the online environment is understood and reflected in relevant legislation. Legislation is implemented in line with international standards and best practice.","The effectiveness of online child protection law is regularly assessed and used to inform its development.\nThe country seeks to adapt child protection law to take account of emerging technologies and their use.","Online child protection law is constructed so that it can cater for dynamic changes in\nthe underlying technology and threat environment, without the need for substantial and lengthy revision.\nThe country is developing and promoting international standards for online child protection law.\nThe country is actively involved in the development of legal instruments to enable improved international collaboration in this area."]
["Consumer Protection Legislation",null,"Legislation related to consumer protection is limited and\nits application in the online environment is yet to be considered.","Legislation related to consumer protection is in place and is being adapted to reflect its application in the online environment.\nStakeholders from relevant sectors have been consulted to support the development of this legislation.","The application of consumer protection in the online environment is understood and reflected in relevant legislation. Legislation is implemented in line with international standards and best practice.","The effectiveness of online consumer protection law is regularly assessed and used to inform its development.\nThe country seeks to adapt consumer protection legislation to take account of emerging technologies and their use.","Consumer protection legislation is constructed so that it can cater for dynamic changes in the underlying technology and\nthreat environment, without the need for substantial and lengthy revision.\nThe country is developing and promoting international\nstandards for online consumer protection law.\nThe country is actively involved in the development of legal instruments to enable improved international collaboration in this area."]
["Intellectual Property Legislation",null,"Legislation related to intellectual property protection is limited and its application in the\nonline environment is yet to be considered.","Legislation related to intellectual property protection is in place and is being adapted to reflect its application in the online environment.\nStakeholders from relevant sectors have been consulted to support the development of this legislation.","The application of intellectual property protection in the online environment is understood and reflected in relevant legislation. Legislation is implemented in line with international standards and best practice.","The effectiveness of online intellectual property protection law is regularly assessed and used to inform its development.\nThe country seeks to adapt intellectual property protection legislation to take account of emerging technologies and their use.","Intellectual property legislation is constructed so that it can cater for dynamic changes in the underlying technology and\nthreat environment, without the need for substantial and lengthy revision.\nThe country is developing and promoting international\nstandards for online intellectual protection law.\nThe country is actively involved in the development of legal instruments to enable improved international collaboration in this area."]
["Law Enforcement",null,"Law enforcement officers/ agencies do not have sufficient capacity to prevent and combat cybercrime and do not receive specialised training on cybercrime investigations.","Traditional investigative measures are applied to cybercrime investigations, but digital investigation capacity is limited.\nLaw enforcement officers may receive training on cybercrime and digital evidence, but it is ad hoc.","A comprehensive institutional capacity with sufficient human, procedural and technological resources to investigate cybercrime cases has been established.\nDigital chain of custody and evidence integrity is established, including formal processes, roles and responsibilities.\nStandards for the training of law enforcement officers on cybercrime and digital evidence exist and are implemented.\nThe respective roles of national and state/local law enforcement agencies are understood and state-/local-level forces are equipped to undertake their role.","Quantified risk assessments are used to allocate resources to operational cybercrime units (at national and state/local levels).\nTrends and statistics on cybercrime, law enforcement interventions and their impact on harm reduction are collected, analysed and used to inform strategy and long-term resource allocation decision.\nLaw enforcement strategies include crime prevention measures alongside enforcement measures. Intelligence is used to support proactive investigation.\nLaw enforcement agencies have the capabilities to maintain\nthe integrity of data to meet international evidential standards in cross-border investigation.","The country is actively involved in the development of collaborative platforms between national law enforcement authorities.\nThe law enforcement agencies within the country are at the forefront of developing new capabilities and approaches for the prevention and disruption of cybercrime and promoting their use internationally."]
["Prosecution",null,"Prosecutors do not receive adequate training and resources to review electronic evidence or prosecute cybercrime.\nConsultation may have begun to consider this capacity in the prosecutor community.","A limited number of prosecutors have the capacity to conduct cybercrime cases and to handle electronic evidence, but this capacity is largely ad hoc and is not institutionalised.\nIf prosecutors receive training on cybercrime and digital evidence, it is ad hoc.","A comprehensive institutional capacity, including sufficient human and technological resources, to prosecute cybercrime cases and cases involving electronic evidence is established.\nA specialist cadre of cybercrime prosecutors may have been established.","Institutional structures are in place, with a clear distribution of tasks and obligations within the prosecution services at all levels of the state.\nA mechanism exists that enables the exchange of information\nand good practices between prosecutors and judges to ensure efficient and effective prosecution of cybercrime cases.","There is national capacity to prosecute complex domestic and cross-border cybercrime cases."]
["Courts",null,"There is no process to equip judges so they can preside over cybercrime cases or cases involving electronic evidence.\nConsultation may have begun to consider this capacity in the judicial community.","A limited number of judges have the capacity to preside over a cybercrime case, but this capacity is largely ad hoc.\nIf judges receive training on cybercrime and digital evidence, it is ad hoc.","Sufficient human and technological resources are available to ensure effective and efficient legal proceedings regarding cybercrime cases and cases involving electronic evidence.\nJudges receive specialised training about cybercrime and electronic evidence.\nStates/local courts are equipped to deal with cybercrime cases, appropriate to their level.\nRelevant courts are equipped to process civil litigation relating to cybersecurity liability.","The institutional capacity of  the court system to conduct cybercrime cases is frequently reviewed and revised based on an assessment of effectiveness.","The country is actively involved in developing and promoting best practices in the conduct of cybercrime cases."]
["Regulatory Bodies",null,"Sector-specific regulators have limited understanding of the potential impact of cyber on their regulated entities.\nThere is no cross-sector regulatory body to supervise specific cybersecurity requirements.","Sector-specific regulators have started to establish their cybersecurity roles.\nA requirement for the establishment of cross-sector regulatory bodies to oversee compliance with specific cybersecurity regulations may have been considered.\nRelevant stakeholders have been consulted in this process.","Sector-specific regulators (e.g.: finance, energy, transport) are equipped with the capability and resources required to oversee compliance with cybersecurity requirements within their sector.\nWhere cross-sector regulatory bodies have been established to oversee cybersecurity, they have the necessary capability and resources to undertake their role.","The impact of regulatory actions on organisations’ cybersecurity practices are regularly assessed and used to inform supervisory activity and regulation development.\nRegulatory bodies regularly assess emerging technologies and their potential impact on the cybersecurity of regulated entities.\nRegulatory interventions and investigations are informed by, and prioritised on the basis of, national assessments of cyber risk.","Regulatory bodies are actively involved in the development and promotion of regulatory best practice internationally."]
["Law Enforcement Co-operation with Private Sector",null,"Co-operation between domestic public and private sectors on cybercrime is limited.\nSpecifically, co-operation between Internet service and other technology providers and law enforcement has not been established.","Exchange of information on cybercrime between domestic public and private sectors is ad hoc and unregulated.\nSpecifically, ad-hoc co-operation between Internet service and other technology providers and law enforcement exists but is not always effective.","Information is regularly exchanged between domestic public and private sectors and is supported by appropriate legislation.\nEffective co-operation mechanisms between Internet service and other technology providers and law enforcement have been established as\npart of these broader public– private sector collaboration arrangements.","The effectiveness of public and private co-operation is regularly assessed and used to enhance collaborative processes.\nCollaboration frameworks are regularly adapted to take\naccount of new technologies and emerging forms of cybercrime.","The country is actively contributing to the promotion of public–private partnership and the development of international public–private partnership platforms."]
["Co-operation with\nForeign Law Enforcement Counterparts",null,"There are minimal or no forms of international co-operation to prevent and combat cybercrime.","Formal mechanisms of international law enforcement co-operation may exist, but their application to cybercrime is ad hoc or only possible in some cases.\nLaw enforcement is not formally integrated into regional and international cybercrime networks.","Formal mechanisms of international law enforcement co-operation have been established to facilitate the detection, investigation, and prosecution of cybercrime.\nMutual legal assistance, extradition agreements and mechanisms have been established and are applied to cybercrime cases.\nDomestic law enforcement agencies are integrated with regional and international networks, such as Interpol or 24/7 networks.","Law enforcement agencies work jointly with foreign counterparts, potentially through joint task forces, resulting in successful cross-border cybercrime investigations and prosecutions.","The country actively contributes to the promotion and development of international co-operation mechanisms."]
["Government- Criminal Justice Sector Collaboration",null,"There is minimal interaction between government and criminal justice actors.","Exchange of information between government and criminal justice actors is limited and ad hoc.","Formal relationships between government and criminal justice actors have been established, resulting in the regular exchange of information on cybercrime issues.","The relationship between government actors, prosecutors, judges and law enforcement agencies is regularly assessed and used to enhance their effectiveness.","The country actively contributes to the international promotion of efficient and timely exchange of information between government and criminal justice actors."]
["ICT Security Standards",null,"Either no standards or good practices have been identified for use in securing data, technology or infrastructure, by the public and private sectors.\nOr initial identification of some appropriate standards and good practices has been made by the public and private sectors, and possibly some ad-hoc implementation, but no concerted endeavour to implement or change existing practice in a measurable way.","Information risk management standards have been identified for use and there have been some initial signs of promotion and take-up within public and private sectors.\nThere is some evidence of measurable implementation and use of international standards and good practices.","A nationally-agreed baseline of cybersecurity-related standards and good practices have been identified and implemented widely across public and private sectors.\nAn entity within government exists to assess the use of standards across public and private sectors.\nGovernment schemes exist to promote continued enhancements, and metrics are being applied to monitor compliance.\nConsideration is being given as to how standards and best practices can be used to address risk within supply chains within the CI, by both government and CI.","Government and organisations promote use of standards and best practices according to assessment of national risks and budgetary choices.\nThe choice of standards and best practices and their implementation is continuously revised.\nEmerging cybersecurity risks are regularly assessed and used to re- evaluate the need for additional ICT security standards.\nThere is evidence of debate between government and other stakeholders as to how national and organisational resource decisions should align and drive implementation of standards.\nEvidence of contribution to international standards’ bodies exists and contributes to thought leadership and sharing of experience by organisations.","The country is actively involved in the development and promotion of defined standards internationally.\nImplementation of standards and non-compliance decisions are made in response to changing threat environments and resource drivers across sectors and CI, through collaborative risk management.\nEvidence exists of debate within all sectors on compliance to standards and best practices, based on continuous needs assessments."]
["Standards in Procurement",null,"No standards or best practices have been identified for\nuse in guiding procurement processes by the public and private sectors. If they are recognised, implementation\nis ad hoc and un-co-ordinated.","Cybersecurity standards and best practices guiding procurement processes\n(including risk management, lifecycle management, software and hardware assurance, outsourcing, and use of cloud services) have been identified for use.\nEvidence of promotion and implementation of\ncybersecurity standards and best practices in defining procurement practices exists within public and private sectors.","Cybersecurity standards and best practices in guiding\nprocurement processes (including risk management, lifecycle management, software and hardware assurance, outsourcing, and use of cloud services) are being adhered to widely within public and private sectors.\nImplementation and compliance of standards in procurement practices within the public and private sectors is evidenced through measurement and assessments of process effectiveness.","Organisations have the ability to monitor and change use of standards and best practices in procurement processes, support deviations and non-compliance decisions as the need arises through risk-based decision- making.\nEmerging cybersecurity risks are regularly assessed and used to\nre-evaluate the need for additional standards in procurement.\nCritical aspects of procurement and supply, such as total lifecycle cost, quality, inter-operability,\nmaintenance, support and other value- adding activities, are continuously improved, and procurement process improvements are made in the context of wider resource planning.\nOrganisations are able to benchmark the skills of their procurement professionals against the competencies outlined in procurement standards and identify any skills and capability gaps.","The country is actively involved in the development and promotion of these standards internationally.\nImplementation of standards in procurement processes and non- compliance decisions are made in response to changing threat environments."]
["Standards for Provision of Products and Services",null,"Either no standards or best practices have been\nidentified for use in securing the products and services  (in particular, software, hardware, managed services\nand cloud services) developed or offered by providers in the country.\nOr there is some identification, but only limited evidence of take-up.","Core activities and methodologies for secure development and lifecycle management for software, hardware and provision of managed services and cloud services are being identified and discussed within professional communities.\nGovernment promotes relevant standards in software development, hardware quality assurance, provision  of managed services and cloud security but there is\nno evidence of widespread adoption of these standards yet.","There is evidence of widespread implementation of standards\nin the software development processes, hardware quality assurance, provision of managed services and cloud services\nby public and private sector organisations.\nGovernment has an established programme for promoting and monitoring standard adoption in software development, hardware quality assurance and cloud security, for public and commercial systems.\nEvidence that high integrity systems and software development techniques are present within the educational and training offerings in the country.","Security considerations are incorporated in all stages of the development of software, hardware and provision of managed services and cloud services.\nCore development activities, including configuration and documentation management, security development and lifecycle planning have been adopted into the practices of product and service providers\nProjects on software development, hardware quality assurance, managed service and cloud security continuously assess the value of standards and reduce or enhance levels of compliance according to risk-based decisions.","The country is actively involved in the development and promotion of these standards internationally.\nImplementation of these standards and non-compliance decisions are made in response to changing threat environments."]
["Technological Security Controls",null,"There is minimal or no understanding or deployment of the technological security controls available in the\nmarketplace, by users and public and private sectors.\nInternet service and other technology providers may not offer any upstream controls to their customers.","Technological security controls are deployed by users and public and private sectors, but possibly not consistently across all sectors.\nThe deployment of up-to-date technological security controls is promoted in an ad-hoc\nmanner and all sectors are being incentivised to make use of them.\nInternet service and other technology providers may be offering security services as part of their services but possibly in an ad-hoc manner.\nInternet service and other technology providers recognise a need to establish internal policies for the deployment of technical security controls, to manage identified risks in the products and services they are offering.","Up-to-date technological security controls, including patching and backups, are deployed in all sectors.\nPhysical security controls are used to prevent unauthorised personnel from entering computing facilities in all sectors.\nInternet service and other technology providers establish internal policies for the deployment of technical security controls, to manage identified risks in the products and services they are offering.\nThe technological cybersecurity control set reflects internationally-established cybersecurity frameworks, standards and good practice.","Widespread adoption of technological security controls leads to effective upstream protection of users and public and private sectors.\nAll sectors have the capacity to continuously assess the security controls deployed, for their effectiveness and suitability according to their changing needs.\nThe understanding of the technological security controls being deployed extends to their impact on organisational\noperations and budget allocation.\nThe public and private sectors have the capacity to critically assess and upgrade cybersecurity controls according to their appropriateness and suitability for use, and considering emerging risks.\nThere is widespread adoption of multi-factor authentication for online services and privileged accounts. Certificate Authorities are available and digital certificates are widely used.\nInternet service and other technology providers have the ability to prevent access to non-trusted sites or web\naddresses in accordance with the requirements of the appropriate regulator.","The application of advanced technological controls within the country is a leading influence internationally.\nImplementation of advanced technological security controls are made in response to changing threat environments."]
["Cryptographic Controls",null,"Cryptographic techniques (e.g.: encryption and digital signatures) for protection of data at rest and data in transit may be a concern but are not yet deployed within the government or private sector, or by the general public.","Cryptographic controls for protecting data at rest and in transit are recognised and deployed ad hoc by multiple\nstakeholders and within various sectors.\nTools, such as TLS*, are deployed\nad hoc by service providers to secure all communications between servers and users.","Cryptographic techniques are available for all sectors and users for the protection of data at rest or in transit.\nThere is a broad understanding of secure communication services, such as encrypted or signed email.\nThe cryptographic controls deployed meet international standards and guidelines for each sector and are kept up to date.\nTools, such as TLS are routinely deployed by service providers to secure all communications between servers and users.","The public and private sectors critically assess the deployment of cryptographic controls, according to their objectives and priorities.\nThe public and private sectors adapt encryption and cryptographic control policies based on the evolution of\ntechnological advancement and changing threat environment.\nThe public and private sectors have developed encryption and cryptographic control policies based on the previous\nassessment, and regularly review the policies for effectiveness.\nThe country has considered implementing digital-identity management.\nThe country has considered whether it requires a national PKI**.","The country is contributing to the international debate around best practice on cryptographic controls.\nImplementation of cryptographic controls are made in response to changing threat environments."]
["Software Quality and Assurance",null,"Quality and performance of software used in the country is a concern, but functional requirements are not yet fully monitored.\nA catalogue of assured software platforms and applications within the public and private sectors does not exist.\nPolicies and processes regarding updates and maintenance (including patch management) of software applications have not yet been formulated.","Software quality and functional requirements in public and private sectors are recognised and identified, but not necessarily in a strategic manner.\nA catalogue for assured software platforms and applications within the public and private sectors is in development.\nPolicies and processes on software updates and\nmaintenance (including patch management) are now in development.\nEvidence of software quality deficiencies is being gathered  and assessed regarding its impact on usability and performance.","Software quality and functional requirements in public and  private sectors are recognised and established.\nReliable software applications that adhere to international standards and good practices are being used widely in the public and private sectors.\nPolicies on and processes for software updates and\nmaintenance (including patch management) are established in all sectors.\nSoftware applications are characterised as to their reliability, usability and performance in adherence to international standards and good practices.","Quality of software used in public and private sectors is monitored and assessed.\nPolicies and processes on software updates and\nmaintenance (including patch management) are being improved, based on risk assessments and the critical nature of services in all sectors.\nBenefits to businesses from additional investment in ensuring software quality and maintenance are measured and assessed.\nSoftware defects are manageable in a timely manner and service continuity is ensured.","Software applications of high- level performance, reliability  and usability are available, with service continuity processes fully automated.\nRequirements of software quality are being systematically reviewed, updated, and adapted to the changing cybersecurity environment."]
["Internet Infrastructure Reliability",null,"Affordable and reliable Internet services and infrastructure in the country may not have been established; if they have been, adoption rates of those services are a concern.\nThere is little or no national oversight of network infrastructure.\nIf networks and systems are outsourced, the reliability of third-party providers may not have been considered.\nNetwork redundancy measures may be considered, but not in  a systematic, comprehensive fashion.","Limited Internet services and infrastructure are available, but with low levels of adoption and issues of unreliability.\nThe ability of Internet infrastructure in public and private sectors to withstand incidents with minimum disruption has been discussed by multiple stakeholders but may not have been fully addressed.\nSupport for securing Internet infrastructure may rely on regional assistance.","Reliable Internet services are widely available and used.\nInternet services are trusted widely for conducting\ne-commerce and electronic business transactions; appropriate authentication processes are established.\nTechnology deployed and processes used for managing Internet infrastructure meet international standards and follow good practices.\nNational infrastructure is formally managed, with documented processes, roles and responsibilities, and limited redundancy.","Regular assessments are made of technology, of processes for compliance with international standards, and of guidelines that address the national need in\nthe face of emerging risks, and changes are made as required.\nThere is effective and  controlled acquisition of critical technologies, and there are managed strategic planning and service continuity processes in place.","Acquisition of infrastructure technologies is effectively controlled, with flexibility incorporated according to changing market dynamics.\nCosts for infrastructure technologies are continually assessed and optimised.\nScientific, technical, industrial and human capabilities are being systematically maintained, enhanced, and perpetuated in order to maintain the country’s independent resilience.\nOptimised efficiency is in place to mediate extended outages of systems."]
["Monitoring and Response",null,"No risk assessments are conducted by Internet infrastructure owners to identify vulnerable assets and prioritise protective actions.\nThere is no monitoring in place to detect that incidents have occurred.\nNo incident response plans are in place.","Processes on developing risk assessments for Internet infrastructure owners have been initiated.\nThere is ad-hoc monitoring of parts of the Internet\ninfrastructure, but it may not be comprehensive.\nIncident response plans are in development in some sectors.","Mechanisms are in place in both public and private sectors to conduct risk assessments, monitor and test network resilience, and to respond to incidents.\nIncident response plans are in place in both public and private sectors and are regularly tested and kept under review.\nAppropriate resources are allocated to hardware\nintegration, technology stress testing, personnel training, monitoring, response, and drills to test response plans.","Risks related to emerging and converging technologies are regularly assessed by Internet Infrastructure owners.\nRisks related to emerging and converging technologies are regularly assessed by regulatory agencies responsible for electronic communications networks and this is used to inform funding and priority decisions.","National-level assets can act to work with the international community in the event of a trans-jurisdictional crisis or incident.\nLessons learnt from international collaborations are used to\nevolve monitoring and response capabilities.\nEvidence exists that sovereign novel monitoring and response capabilities are being developed in anticipation of emerging threats."]
["Cybersecurity Technologies",null,"If domestic production of cybersecurity technologies exists, it does not follow secure processes.\nThe country has not considered the security implications of using foreign cybersecurity technologies.","If there is domestic production, the need for secure processes is recognised.\nIf there is reliance on foreign technologies, the security implications are considered.","If there is domestic production, secure processes are in place.\nIf there is reliance on foreign technologies, the security implications are identified and mitigated in the context of an international supply chain.","If there is local development of cybersecurity technology, it abides by secure coding\nguidelines, good practices and adheres to internationally- accepted standards.\nRisk assessments and market incentives inform the prioritisation of product\ndevelopment and mitigation of identified risks.\nThe security implications of using foreign technologies are routinely analysed and revised based on the assessment of emerging cybersecurity risks.","Security functions in software and computer system configurations are automated in the development and deployment of technologies.\nDomestic cybersecurity products are exported to other nations and are considered superior products.\nThe country has established a body to assure the security of foreign technologies (devices and software) and supply chains, or to certify entities which can do this."]
["Cybersecurity Services and Expertise",null,"Cybersecurity consultancy services are not widely on offer in the country.\nFew if any service providers have professional certification.","There are a growing number of cybersecurity consultancy\nservices available for private and public organisations.\nA growing number of service providers provide detail of the professional certifications they possess.\nThere may be limited or no guidance to assist organisations with the selection of service providers.","There are widespread cybersecurity consultancy services available for private and public organisations.\nAll service providers provide details of the professional certifications they possess.\nA national body accredits service providers, to assist organisations in selecting service providers.","Private and public organisations routinely seek advice from cybersecurity consultancy services, including advice about emerging risks.\nThere is an adequate supply of cybersecurity professionals in the country.","The cybersecurity service sector in the country helps shape the international market."]
["Security Implications of Outsourcing",null,"No risk assessments are conducted to determine how to mitigate the risks of outsourcing IT to a third party or cloud services.\nThere is a lack of understanding of the security measures that the outsourced IT service provider applies.","Some organisations and sectors conduct risk assessments to determine how to mitigate the risks of outsourcing IT to a third party or cloud services.\nAt least some organisations and sectors understand the security measures that the outsourced IT service provider applies.\nAt least some organisations have developed business continuity and disaster recovery processes.","Most major organisations from the public and private sectors conduct risk assessments to determine how to mitigate the risks of outsourcing IT to a third party or cloud services.\nThere is widespread understanding of the security guarantees provided by the outsourced IT service providers.\nMost organisations have developed and tested processes to support business continuity and disaster recovery.","Insights arising from risk assessments are routinely analysed in order to establish and promote cybersecurity best practices to mitigate the risk of outsourcing IT.\nDifferent risk scenarios with the IT service provider are explored and tested, including emerging risks.","The country is contributing  to international best practice on how to mitigate the risk of outsourcing IT."]
["Cyber Insurance",null,"The need for a cyber-insurance market may have been identified, but no products and services\nare widely available, either domestically or from external providers.","The need for a market in cyber- insurance has been identified through the assessment of financial risks for the public and private sectors, and the appropriateness of available\nofferings is now being discussed.","A market for cyber-insurance is established and encourages the sharing of threat- information among participants of the market.\nProducts suitable for small and medium-sized enterprises (SMEs) are also on offer.","Cyber-insurance market offers a variety of covers to mitigate consequential losses.\nCover is selected by organisations based on strategic planning needs and identified risk.\nThe cyber-insurance market  is innovative and adapts to emerging risks, standards and\npractices, while addressing the full scope of cyber harm.\nInsurance premium reductions are offered for consistent cyber- secure behaviour.","Cyber-insurance practices in the country help to shape the international market."]
["Sharing Vulnerability Information",null,"There is no informal way of sharing information among the stakeholders about the technical details of vulnerabilities.\nSoftware and service providers generally lack the ability to address bug and vulnerability reports.","Technical details of vulnerabilities are shared informally with other stakeholders which can distribute the information more broadly.\nSoftware and service providers are able to address bug and vulnerability reports but there may not be formal protocols for doing so.","There are formal information- sharing mechanisms or channels in place to share the technical details of vulnerabilities with other stakeholders, which can distribute the information more broadly.\nA substantial proportion of vulnerabilities in products and services are remedied within defined deadlines after their discovery.","Vulnerability information-sharing mechanisms are continuously reviewed and updated based\non the needs of all affected stakeholders, and in the light of emerging risks.\nAll affected products and services are routinely updated within defined deadline.\nProcesses are in place to review and reduce deadlines where possible.","The country is contributing to the debate and international best practice on the sharing of vulnerability information."]
["Policies, Processes and Legislation for Responsible Disclosure of Security Flaws",null,"The need for a responsible- disclosure policy in public and private sector organisations, and the right to legal protections for those disclosing security flaws are not yet acknowledged.","The need for a responsible- disclosure policy in public and private sector organisations\nis recognised but policies or processes may not be in place, or may only be in development.\nThe right to legal protections for those disclosing security flaws is recognised but legislation may not be in place; or may only be in development.\nSoftware and service providers commit to refraining from taking legal action against a party disclosing information responsibly.","A responsible-disclosure policy or framework is in place in public and private sector organisations, and includes a disclosure deadline, scheduled resolution, and the need for acknowledgement.\nOrganisations have established processes to receive and disseminate vulnerability information responsibly.\nThe right to legal protections for those disclosing security flaws responsibly is in place.","Responsible-disclosure policies and processes are continuously reviewed and updated based on the needs of all affected stakeholders and in the light of emerging risks.\nAn analysis of the technical details of vulnerabilities\nis published and advisory information is disseminated according to individual roles and responsibilities.","The country is contributing to the debate on responsible-disclosure frameworks and legal protections for those disclosing security flaws responsibly."]

{"sheet":"setting","index":5,"n_rows":7,"n_cols":3,"rows_kept":7,"cut":false,"hidden":true,"merged":[]}
[]
[]
[null,"Start-Up",1]
[null,"Formative",2]
[null,"Established",3]
[null,"Strategic",4]
[null,"Dynamic",5]