National Capabilities Assessment Framework 2.0

Fotnoter

1. Acronym Definition ACP Active Cyber Protection AI Artificial Intelligence BGP Border Gateway Protocol BRP Business Recovery Plan C2M2 Cybersecurity Capability Maturity Model CCDCoE Cooperative Cyber Defence Centre of Excellence CDEP Committee on Digital Economy Policy CDI Cyber Defence Index CEF Connecting Europe Facility CER Directive Critical Entities Resilience Directive CI Critical infrastructure CIIP Critical Information Infrastructure Protection CIRAS Cybersecurity Incident Response and Analysis System CMM Cybersecurity Capacity Maturity Model for Nations CMMC Cybersecurity Maturity Model Certification COBIT Control Objectives for Information and related Technology CRA Cyber Resilience Act CSoA Cyber Solidarity Act CSIRT Computer Security Incident Response Teams CVD Coordinated Vulnerability Disclosure DEP Digital Europe Programme DNS Domain Name System DORA Digital Operational Resilience Act DPIA Data Protection Impact Assessment ECCC European Cybersecurity Competence Centre ECCG European Cybersecurity Certification Group ECSF European Cybersecurity Skills Framework ECSM European Cybersecurity Month EDIH European Digital Innovation Hubs
2. Acronym Definition EDR Endpoint Detection and Response EEAS European External Action Service EU-CSI EU Cybersecurity Index EU-Cyclone European Cyber Crisis Liaison Organisation Network Eurojust European Union Agency for Criminal Justice Cooperation Europol European Union Agency for Law Enforcement Cooperation EC3 European Cybercrime Centre FIRST Forum of Incident Response and Security Teams GCI Global Cybersecurity Index GDPR General Data Protection Regulation GFCE Global Forum on Cyber Expertise HR Human Resources IA-CM Internal Audit Capability Model ICS2 International Information System Security Certification Consortium ICT Information and Communication Technologies IEC International Electrotechnical Commission IPR Incident Preparedness and Response ISACs Information Sharing and Analysis Centres ITU International Telecommunication Union LEA Law Enforcement Agency LED Law Enforcement Directive LLMs Large Language Models MFA Multifactor authentication MS Member State NATO North Atlantic Treaty Organisation NCAF National Capabilities Assessment Framework NCC National Coordination Centre NCCA National Cybersecurity Certification Authority NCSS National Cybersecurity Strategy NIS2 Network and Information Security Directive 2 NIST National Institute of Standards and Technology OECD Organisation for Economic Co-operation and Development
3. Acronym Definition OSCE Organisation for Security and Co-operation in Europe PET Privacy Enhancing Technologies PoC Point of Contact PPP Public-private partnership R&D Research & Development SMEs Small and medium-sized enterprises SOC Security Operation Centre SOP Standard Operating Procedures SPOC Single Point of Contact TF-CSIRT Task Force – Computer Incident Response Teams
4. (1) https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng. (2) https://eur-lex.europa.eu/eli/reg/2019/881/oj/eng. (3) https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32024R2847. (4) https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng. (5) https://www.enisa.europa.eu/publications/national-capabilities-assessment-framework.
5. (6) https://enisa.europa.eu/sites/default/files/2024- 11/2024%20Report%20on%20the%20State%20of%20the%20Cybersecurity%20in%20the%20Union.pdf. (7) https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng. (8) https://eur-lex.europa.eu/eli/reg/2019/881/oj. (9) https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32024R2847. (10) https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng. (11) https://www.enisa.europa.eu/publications/cybersecurity-roles-and-skills-for-nis2-essential-and-important-entities. (12) https://digital-strategy.ec.europa.eu/en/library/cybersecurity-5g-networks-eu-toolbox-risk-mitigating-measures. (13) https://www.enisa.europa.eu/publications/undersea-cables.
6. provides useful information to help in the development of a long-term strategy (e.g. good practices and guidelines);
7. helps to identify missing elements within NCSSs;
8. helps in further building cybersecurity capabilities;
9. supports Member States in preparing for the NIS2 peerreview process (e.g. in establishing the scope of the review);
10. helps anticipate the issues lying ahead;
11. gives credibility to NCSS from the perspective of the general public and international partners;
12. supports outreach and increases transparency, thus enhancing the public image of participating organisations;
13. Table 1: The ENISA National Capabilities Assessment Framework five-level maturity scale
14. Level 1 – Level 2 – Level 3 – Level 4 – Level 5 – Foundation Developing Established Mature Advanced
15. The Member State A national Capacity-building Cybersecurity The Member State (MS) has adopted approach to measures and planning and demonstrates a an NCSS. capacity building initiatives are implementation are dynamic and However, a aligned with NCSS systematically strategically aligned adaptive strategy, comprehensive and objectives has developed and across sectors and attentive to structured been decided on. implemented levels of evolving approach to Action plans and across the NCSS governance. The technological, capacity-building activities are in objectives. national action plan geopolitical and across all NCSS place, although Governance is prioritised, threat landscapes. objectives is still many are in the structures for optimised and A culture of lacking. Initial steps early stages of implementation and supported by long- innovation is may include broad implementation. oversight are fully term, fostered through goals and limited Some measures operational, with institutionalised ongoing research measures or are being planned clearly assigned mechanisms (e.g., and international initiatives, which and initiated in responsibilities. legislation, funding, cooperation. are often generic priority areas. Key Activities are national agencies). Strategic decisions and not stakeholders have executed with Capacity-building are driven by systematically been identified and allocated activities are continuous implemented. are beginning to resources, regularly evaluated monitoring of specified timelines and refined based emerging and consistent on performance challenges and
16. engage in the documentation at data. Formal, forward planning, process. the national level. cross-sectoral enabling timely and Relevant collaboration effective responses stakeholders are mechanisms and regularly engaged structured throughout the cooperation with policy cycle. The other Member Member State States are in place. contributes to Monitoring, selected EU-level performance initiatives based on assessment and its priorities. continuous improvement mechanisms are embedded to identify gaps and success factors, and guide evidence-based decision-making.
17. https://www.enisa.europa.eu/topics/national-cyber-security-strategies/ncss-map/national-cyber-security-strategiesinteractive-map/objectives?objective=1.
18. Table 2: Common strategic objectives covered by Member States in their NCSSs
19. OBJECTIVE NCSS STRATEGIC OBJECTIVE GOALS NUMBER
20. 1 Strengthen the cyber resilience and  Enforce mandatory cybersecurity standards by law to ensure cyber hygiene of the private sector, that businesses implement appropriate security measures. including SMEs  Promote and develop cybersecurity education, training, awareness and R & D initiatives to foster a strong security culture across the private sector.  Provide practical guidance and promote good cyber-hygiene practices tailored to the operational needs of businesses, particularly SMEs.  Provide guidance and assistance in strengthening the resilience of SMEs (e.g., vouchers, support programmes).  Strengthen the cyber-hygiene baseline of SMEs. 2 Promote cybersecurity awareness  Develop and implement ongoing awareness-raising initiatives and cyber hygiene on cybersecurity to educate civil society and academia about cybersecurity threats.  Offer guidance on good cyber-hygiene practices and controls to users and entities.  Include the need for cybersecurity awareness and cyber hygiene in the NCSS. 3 Address the cybersecurity skills gap  Integrate the promotion and development of education and training on cybersecurity and cybersecurity skills development into the NCSS.  Enhance the development of cybersecurity skills in technical, operational and strategic areas.  Adopt specific measures within the NCSS to mitigate the cybersecurity skills shortage and close skills gaps.
21.  Undertake EU-wide collaborative initiatives to promote the single market for cybersecurity skills. 4 Foster R & D and innovation  Support R & D initiatives to create and enhance innovative cybersecurity tools and secure network infrastructure.  Encourage the integration of innovative technologies (e.g. AI and post-quantum cryptography) in cybersecurity solutions to enhance detection and prevention capabilities.  Promote R & D activities within the NCSS that facilitate the use of automated or semi-automated tools in cybersecurity and support the sharing of data necessary for technology advancement.  Ensure that the use of cutting-edge technologies complies with EU data protection law.  Exploit the requirements of data protection by design and by default.  Encourage participation in EU and global innovation networks. 5 Enhance IPR  Develop and implement comprehensive frameworks and protocols for IPR and acknowledge their existence in the NCSS.  Enhance the role of national/governmental computer security incident response teams (CSIRTs) as central coordinating bodies, ensuring effective collaboration among public and private sector stakeholders.  Integrate IPR activities such as incident handling, reporting, analysis and response coordination at the national and international levels.  Develop measures to ensure preparedness, responsiveness and recovery from incidents, focusing on cooperation between private and public sectors. 6 Address cybercrime  Establish and coordinate efforts of relevant stakeholders to fight cybercrime collaboratively.  Encourage awareness raising about identification of cybercriminal activities among essential and important entities.  Participate in coordination efforts among competent authorities and law enforcement facilitated by the European Cybercrime Centre (EC3) and ENISA.  Strengthen the detection, investigation and prosecution capabilities of law enforcement and judicial authorities.
22. 7 Engage in international cooperation  Establish and maintain international cybersecurity partnerships to support joint actions and strategic alignment on cybersecurity.  Promote cross-border incident response coordination through trusted international channels and protocols.  Participate in information-sharing mechanisms internationally to better comprehend the latest developments of the threat landscape.  Support CSIRTs’ participation in international cooperation networks and their coordination protocols.  Promote responsible state behaviour in cyberspace and support coordinated EU responses to malicious cyber activities (the EU cyber diplomacy toolbox and the strategic compass).  Defend a global, open, secure and interoperable internet and strengthen international cooperation through multilateral and multistakeholder engagement (e.g., the cyberdefence policy, the cybersecurity strategy for the Digital Decade, the European External Action Service (EEAS) cyber dialogue and engagement in international cyber dialogues and forums such as those of the UN, the Organization for Security and Cooperation in Europe (OSCE), NATO and the Global Forum on Cyber Expertise (GFCE)). 8 Establish trusted information-sharing  Integrate robust, trusted information-sharing cooperation mechanisms between public and private stakeholders within the NCSS.  Foster strategic partnerships between critical-infrastructure owners and public authorities on information exchange about threats, vulnerabilities and national security status to enhance situational awareness.  Support information-sharing and analysis centres (ISACs) and public–private partnerships (PPPs) as strategic tools for pooling expertise and resources.  Implement procedures and tools that facilitate voluntary cybersecurity information sharing.  Address legal, organisational and cultural barriers to information sharing. 9 Establish mutual assistance  Establish mutual assistance processes among Member States processes to ensure effective cooperation and support in supervisory and enforcement actions across borders.  Develop frameworks for information sharing, inspections and audits among Member States’ authorities.  Promote coordination and consultation among Member States’ authorities to address potential refusal of assistance.  Encourage joint supervisory action through mutual agreement. 10 Develop crisis-management  Develop a comprehensive cyber crisis-management frameworks framework whose concept and measures are anchored within the NCSS, ensuring coherence with general national crisismanagement structures.  Establish dedicated cyber crisis-management authorities and empower them with adequate resources to manage largescale cybersecurity crises.
23.  Enhance cross-border cooperation and coordination in cyber crisis response by implementing transboundary collaboration mechanisms within the cyber crisis-management framework.  Embed regular testing of the crisis-management framework in the NCSS. 11 Secure digital identity and build trust  Promote the digital transformation of public administrations in digital public services with a focus on ensuring cybersecurity, efficiency and accessibility of digital public services.  Build trust in government in relation to digital identity and public services. 12 Establish national-level risk  Establish a mechanism to consolidate risk assessments assessment across sectors, ensuring a national-level view of critical assets and threats, in line with existing requirements under NIS2 and the Critical Entities Resilience Directive (CER Directive).  Align cybersecurity strategy objectives with national security needs through comprehensive national risk assessment.  Facilitate sector-specific risk assessments to address the risks to critical sectors. 13 Strengthen national cybersecurity  Create a governance framework to achieve the objectives and governance priorities set out in the NCSS and related policies, including on critical sectors.  Establish the roles, responsibilities and accountability of relevant stakeholders and create a list of the stakeholders and authorities.  Establish and maintain cooperation and the coordination of activities related to the implementation of the NCSS at the national level, especially between the competent authorities, CSIRTs and single points of contact designated under NIS2, including cross-sectoral and cross-border collaboration.  Enhance coordination among competent authorities under NIS2 for the purpose of information sharing and carrying out an assessment at the level of capabilities (including financial, technical and human resources) and the effectiveness of the performance of their operational and supervisory tasks. 14 Establish cybersecurity risk-  Establish a framework that promotes and facilitates the management measures implementation of suitable risk-management measures by essential and important entities to protect the security of their systems.  Establish mechanisms to promote and facilitate the adoption of relevant technologies and their incorporation into state-of-theart risk-management measures demonstrating commitment to innovation and technological capacity building. 15 Establish incident-reporting  Establish incident-reporting mechanisms for essential and mechanisms important entities to ensure the timely reporting of significant incidents to the CSIRTs or competent authorities in accordance with NIS2.  Encourage essential and important entities to notify their service users about incidents that are likely to affect service delivery.  Require essential and important entities to provide adequate information to CSIRTs or competent authorities to assess the potential cross-border impact of incidents.
24.  Ensure seamless communication and rapid notification processes between competent authorities and CSIRTs.  Develop protocols for timely information sharing with single points of contact in cases of cross-border or cross-sector incidents. 16 Balance security with privacy  Embed the principles of security and privacy in the NCSS, seeking balance between them both.  Contribute to enhancing the protection of the right of privacy within cybersecurity.  Foster cooperation between data protection authorities, national competent authorities and other stakeholders. 17 Improve the cybersecurity of the  Implement state-of-the-art measures to address the supply chain cybersecurity of the supply chain for ICT products and ICT services used by essential and important entities for the provision of their services.  Introduce measures (including awareness raising and sharing best practices) aimed at strengthening the cyber resilience of SMEs, in particular in relation to their supply chain.  Conduct coordinated security risk assessments of critical supply chains as specified in NIS2.  Set baseline security requirements.  Establish policies and provide guidelines to ensure that public administration procurement procedures include clear cybersecurity requirements and prioritise the selection of trustworthy and reliable suppliers. 18 Protect critical sectors  Ensure strategic alignment between the protection of critical sectors (as per Annexes I and II to NIS2) and related physical resilience obligations under the CER Directive.  Adopt specific policies to ensure the availability, integrity and confidentiality of critical sectors, including the public core of the internet and underseas communications cables, if applicable. 19 Establish a CVD policy  Establish a CVD process outlining a structured approach for reporting vulnerabilities to manufacturers and service providers.  Develop and implement a national policy to facilitate CVD and provide a framework for managing vulnerability reports.  Promote the adoption of protective guidelines and legal clarity to foster good-faith vulnerability research, including, where appropriate, exemptions or safeguards from civil or criminal liability, in line with national legal frameworks. 20 Promote ACP  Integrate ACP into the NCSS.  Promote policies on proactive ACP measures as part of a wider defence strategy.  Promote the implementation of internal (and, in the best case scenario, external) ACP capabilities to prevent, detect, monitor and mitigate network security breaches.  Promote the use of ACP tools and services to enhance the ability to share threat intelligence.
25. For the definition of ACP, please refer to recital 57 of NIS2.
26. Figure 1: Scoring mechanism per objective
27. Cluster #1: Capacity-Building and Awareness
28. 1 Strengthen the Cyber-Resilience and Hygiene of Private 2. Promote Cybersecurity Awareness and Cyber-Hygiene on Sector, Including SMEs Cybersecurity 3. Address the Cybersecurity Skills Gap
29. Covered by NCSS? Covered by NCSS? Covered by NCSS?
30. Complete all Complete all Complete all
31. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
32. show score show score show score
33. 4 Foster Research and Development (R&D) and Innovation 5. Enhance Incident Preparedness and Response
34. Covered by NCSS? Covered by NCSS?
35. Complete all Complete all
36. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
37. show score show score
38. Cluster #2: Cooperation and Collaboration
39. 6 Address Cyber Crime 7. Engage in International Cooperation 8. Establish Trusted Information-Sharing and Mechanisms
40. Covered by NCSS? Covered by NCSS? Covered by NCSS?
41. Complete all Complete all Complete all
42. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
43. show score show score show score
44. 9 Establish Mutual Assistance Processes
45. Covered by NCSS?
46. Complete all
47. Maturity level: 0 Coverage ratio: questions to
48. show score
49. Cluster #3: Cybersecurity Governance
50. 11 Secure Digital Identity and Build Trust in Digital Public 10. Develop Crisis Management Frameworks Services 12. Establish National Level Risk-Assessment
51. Covered by NCSS? Covered by NCSS? Covered by NCSS?
52. Complete all Complete all Complete all
53. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
54. show score show score show score
55. 13 Strengthen National Cybersecurity Governance 14. Establish Cybersecurity Risk-Management Measures 15. Establish Incident Reporting Mechanisms
56. Covered by NCSS? Covered by NCSS? Covered by NCSS?
57. Complete all Complete all Complete all
58. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
59. show score show score show score
60. Cluster #4: Regulatory and Policy Frameworks
61. 16 Balance Security with Privacy 17. Improve the Cybersecurity of the Supply Chain 18. Protect Critical Sectors
62. Covered by NCSS? Covered by NCSS? Covered by NCSS?
63. Complete all Complete all Complete all
64. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
65. show score show score show score
66. 19 Establish a CVD Policy 20. Promote Active Cyber Protection
67. Covered by NCSS? Covered by NCSS?
68. Complete all Complete all
69. Maturity level: 0 Coverage ratio: questions to Maturity level: 0 Coverage ratio: questions to
70. show score show score
71. Figure 2: Overall scoring mechanism
72. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
73. 1 – Strengthen the a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cyber-resilience and objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to hygiene of private or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action sector, including it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and Small and Medium activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to Enterprises (SMEs) plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Do you promote the 1 Have you considered 1 Is there a mandatory 1 Are mandatory standards 1 Is there a process in 1 use of European and mandating the national cybersecurity reviewed regularly, place to maintain and international standards implementation of standard applicable to coordinated across update national and technical European, national and essential and important sectors and aligned with cybersecurity standards specifications for international entities, aligned with EU-level frameworks in line with EU securing network and cybersecurity standards NIS2 requirements and (e.g. the CRA, the EU regulatory information systems? and frameworks (e.g. incorporating European cloud services scheme) developments, emerging International and international best to ensure interoperability threats and international Organization for practices? and continuous revisions (e.g. the Standardization (ISO) improvement, while transition to the latest and International avoiding discrimination version of ISO/IEC Electrotechnical against specific 27001)? Commission (IEC) technologies? standard ISO/IEC 27001, the National Institute of Standards and Technology (NIST) framework, the CyberFundamentals framework), especially for ICT products,
74. services and processes through EU certification schemes, for essential and important entities? 2 Have key priorities for 1 Have you developed or 1 Are national 1 Do you involve the 1 Do you continuously 1 cybersecurity supported national cybersecurity training private sector, in any monitor developments in awareness-raising and cybersecurity programmes form, in cybersecurity technological trends and cyber-hygiene awareness-raising and operational, with awareness-raising and evolving threats, and initiatives for private training programmes dedicated funding, training initiatives (e.g. integrate them into sector entities, aimed at private sector stakeholder involvement course design and cybersecurity including SMEs, been entities, aligned with and measurable delivery, internships, awareness-raising and identified? NIS2 and the European outcomes (aligned with work placements or training programmes for cybersecurity skills the digital Europe facilitation of free training private sector entities, framework (ECSF)? programme priorities)? offered by the incorporating lessons Cybersecurity Skills learned from incidents Academy’s pledgers, and research outputs? such as ISC2 (the International Information System Security Certification Consortium), the SANS (SysAdmin, Audit, Network and Security) Institute and the ISACA (Information Systems Audit and Control Association))? 3 Does your NCSS 1 Do you have a 1 Is cyber-hygiene 1 Do you have a 1 Do you have 1 identify the need to designated budget to guidance included in mechanism to identify mechanisms to ensure provide guidance and launch best practice private sector policies and assess the most that awareness-raising awareness-raising awareness-raising and reinforced by effective approaches for campaigns and cyberactivities, including ad campaigns and national awareness digital outreach to private hygiene practices for hoc initiatives (e.g. structured guidance on campaigns or sector entities, including essential and important capture-the-flag cyber hygiene and cyber recognition schemes in coordinated cross-sector entities remain relevant exercises, webinars or resilience for private partnership with industry campaigns and incentive to technological workshops), to sector entities? associations? programmes linked to advancements, evolving enhance cyber EU-wide events? threats and regulatory resilience and promote changes, and lead to cyber-hygiene best observable behavioural practices in the private changes? sector? 4 Have you identified the 1 Are cybersecurity 1 When developing 1 Do you gather feedback 1 Do you adapt 1 specific cybersecurity guidance materials or cybersecurity materials from SMEs that are cybersecurity guidance
75. needs for SMEs toolkits also available for and toolkits and/or excluded from NIS2, to and toolkits based on excluded from the SMEs that are excluded guidelines for SMEs that improve the usability and SME characteristics, the scope of NIS2, to from the scope of NIS2, are excluded from the relevance of evolving threat industry enhance their to support basic cyber scope of NIS2, do you cybersecurity toolkits and context, ICT resilience as well? hygiene and cyber emphasise simplicity guidance materials? dependency and the resilience? and actionable guidance criticality of processed in line with EU information? frameworks, ENISA recommendations and/or SME-specific needs? 5 Have you nominated a 1 Does the NCC engage 1 Does the NCC facilitate 1 Is there a structured 1 Have the NCC, the 1 national coordination with SMEs and sector access for SMEs to NCC programme that ECCC and national centre (NCC) and associations to raise ECCC resources, EU uses ECCC-supported stakeholders cooperated established basic awareness of available funding opportunities initiatives (e.g. targeted on designing a communication EU-level resources (e.g. and research outputs, training, threat mechanism to assess channels to inform ECCC funding calls such supporting their adoption intelligence sharing) to and refine SME-focused SMEs about their role as the digital Europe of advanced improve SMEs’ cyber cybersecurity and the potential programme and Horizon cybersecurity solutions? resilience and cyber programmes, taking into benefits of participating Europe, training hygiene, including the account feedback, in initiatives supported materials and research adoption of privacy-by- emerging threats and by the European outputs)? design security innovations? Cybersecurity technologies? Competence Centre (ECCC)? 6 Do you invite industry 1 Is there a national 1 Do you encourage 1 Do you assess the 1 Do you actively 1 associations and SMEs programme or initiative industry associations effectiveness of encourage industry to participate jointly in dedicated to supporting and SMEs to be part of cooperation between associations and SMEs any formal or informal cooperation between a national or sectoral industry associations and to participate in cybersecurity industry associations and information systems SMEs (e.g. using international- and EUawareness-raising SMEs, such as through audit and control associations as trusted level support networks events or platforms? scale training or shared association, to multipliers for (e.g. the ECCC, Global resources? strengthen cyber-threat cybersecurity outreach) Cyber Alliance) to awareness and incident and, more broadly, the discuss forward-looking response capabilities? impact of joint initiatives information on threats on SMEs’ preparedness and cyber resilience? (e.g. national- or EUlevel exercises), based on measurable outcomes and feedback?
76. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
77. 2 – Promote a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cybersecurity objective in your NCSS or (formally or informally) defined and documented mechanism to regularly mechanisms in place to awareness and do you plan to cover it in intended results, guiding action plan that includes review and assess your ensure that the action cyber hygiene on the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and cybersecurity activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Is the need to raise 1 Has a single point of 1 Have you developed a 1 Are providers of services 1 Is there a process in 1 awareness of contact been designated national cybersecurity (e.g. place to regularly update cybersecurity and privacy to coordinate and assist awareness framework to telecommunications, your national issues among citizens in cybersecurity guide the building of banking, digital cybersecurity awareness and entities explicitly awareness-raising awareness at the platforms) incentivised to framework to ensure addressed in your NCSS? activities at the national national level? invest in cybersecurity that it remains relevant or regional levels? awareness and cyber to the evolving national hygiene? cybersecurity threat landscape? 2 Have key priorities for 1 Have you identified 1 Have you developed a 1 Do you evaluate your 1 Are changes in the 1 national cybersecurity specific target audiences communication cybersecurity national cybersecurity awareness-raising and for users’ cybersecurity plan/strategy for awareness-raising and threat landscape cyber-hygiene initiatives awareness-raising and cybersecurity cyber hygiene activities reflected in your been identified? cyber-hygiene activities awareness-raising after execution? cybersecurity (e.g. citizens, young campaigns and cyber- awareness-raising and people, older people, hygiene activities and cyber-hygiene initiatives public sector employees, initiatives for the to ensure that they personnel of SMEs, targeted audiences? continue providing timely employees of essential and effective and important entities)? information? 3 Have you assessed the 1 Do you use different 1 Are different delivery 1 Do you have any 1 Are new delivery 1 effectiveness of different delivery methods for methods systematically mechanisms in place to methods regularly delivery methods for cybersecurity employed during identify the most relevant explored or developed to cybersecurity awareness- awareness-raising cybersecurity media or communication enhance the
78. raising campaigns (e.g. campaigns, at least on awareness-raising and channel depending on effectiveness of social media, public an ad hoc basis? cyber-hygiene activities the target audience to cybersecurity service announcements, to maximise maximise outreach and awareness-raising and community events)? effectiveness? engagement? cyber-hygiene campaigns? 4 Are there any formal or 1 Have mechanisms been 1 Do you have any 1 Are your cybersecurity 1 Are mechanisms in 1 informal coordination proposed or initiated to mechanisms in place to awareness-raising and place to ensure that actions between identify relevant external identify target areas for cyber-hygiene activities cybersecurity cybersecurity and and internal factors (e.g. cybersecurity updated (frequently or on awareness-raising legal/policy teams to threat intelligence, policy awareness-raising an ad hoc basis) to measures remain share information used to updates, legal changes) measures based on reflect internal and continuously relevant, drive awareness-raising that could be used to cybersecurity external factors (e.g., reflecting technological and cyber-hygiene enhance cybersecurity intelligence sources recent security incidents developments, changes activities? awareness-raising and (e.g. the ENISA Threat or updated policies or in the national and cyber-hygiene efforts? Landscape report, legislation)? international threat information on the landscape, applicable national and legal and regulatory international threat requirements, and landscapes, feedback national cybersecurity from national cybercrime directives? centres)? 5 Does your NCSS or other 1 Are tailored materials 1 Do you bring together 1 Do you consult with 1 Are the materials 1 strategic document and recommendations stakeholders with behavioural experts to provided regularly acknowledge the need to developed for specific experts (e.g. relevant tailor your cybersecurity reviewed and updated to tailor cybersecurity user groups (e.g. associations and awareness-raising and reflect the evolving awareness-raising and individuals, SMEs, community groups) and cyber-hygiene national cybersecurity cyber-hygiene material to healthcare providers, communication teams to campaigns to the target threat landscape and different user groups (e.g. educators) on basic tailor the content of audience? threats specific to target individuals, SMEs, cyber-hygiene practices? cybersecurity sectors or communities? healthcare providers, awareness-raising and educators)? cyber-hygiene campaigns? 6 Is there a plan to 1 Have minimum expected 1 Are the minimum 1 Do you regularly review 1 Are minimum expected 1 establish a set of cybersecurity practices expected cybersecurity and update the minimum cybersecurity practices minimum expected been established, practices and tools expected cybersecurity and tools updated based cybersecurity practices supported by tools actively promoted practices and tools to on foresight research (e.g. multifactor developed to help among citizens and ensure that they provide and predictive authentication, secure citizens and SMEs adopt SMEs to increase their appropriate protection techniques to prepare passwords) and tools that secure behaviours adoption in a structured against current and citizens and SMEs for can be adopted by online? and coordinated emerging threats? emerging and future citizens and SMEs? manner? cybersecurity threats?
79. 7 Does your leadership 1 Are resources available 1 Is training provided to 1 Is there a mechanism in 1 Are relevant educators, 1 publicly support the need for educators, educators, place to evaluate communicators, HR to train educators, communicators, HR communicators, HR whether the dedicated professionals and local communicators, human professionals and local professionals and local resources and training authorities encouraged resources (HR) authorities to support authorities to enable provided to educators, to continuously enhance professionals and local them in effectively them to effectively communicators, HR their delivery skills by authorities to effectively delivering cybersecurity deliver cybersecurity professionals and local integrating innovative convey cyber awareness- awareness-raising and awareness-raising and authorities on delivering methods and emerging raising and cyber-hygiene cyber-hygiene activities? cyber-hygiene cybersecurity best practices into messages? messages? awareness-raising and cybersecurity cyber-hygiene messages awareness-raising are allocated efficiently training? and provide adequate support? 8 Do you have policies in 1 Have you developed any 1 Is there structured 1 Are statistics on 1 Are innovative 1 place recognising the cybersecurity collaboration with civil cybersecurity literacy communication channels need to focus on awareness-raising or society, digital among hard-to-reach or actively explored to cybersecurity awareness cyber-hygiene initiatives influencers, consumer digitally excluded distribute key raising and cyber hygiene targeting hard-to-reach organisations or local communities regularly awareness-raising and for hard-to-reach or or digitally excluded governments in collected and evaluated cyber-hygiene digitally excluded communities? developing and to optimise awareness- messages to hard-tocommunities? distributing cybersecurity raising and cyber- reach or digitally awareness-raising or hygiene programmes excluded communities? cyber-hygiene content and to identify new for hard-to-reach or channels for outreach? digitally excluded communities? 9 Is the need to establish 1 Has any national survey 1 Have national metrics 1 Do you perform periodic 1 Are real-time data 1 national metrics (e.g. been conducted to such as surveys, evaluations to measure leveraged to evaluate surveys, incident trends, measure cybersecurity incident trends or attitude shifts or trends in the national phishing test results) to awareness levels and phishing test results behaviour changes cybersecurity landscape track awareness levels, cyber-hygiene been established to regarding cybersecurity and identify topics for ad cyber-hygiene behaviours behaviours among monitor cybersecurity and privacy matters hoc awareness-raising and programme citizens and entities? awareness levels and among citizens and measures addressing effectiveness identified in cyber-hygiene entities? emerging threats? your cybersecurity behaviours among policies or strategy citizens and entities? documents? 10 Do national strategies or 1 Do you encourage 1 Are primary, secondary 1 Are statistics on 1 Are topics related to 1 policies consider the primary, secondary and and tertiary education cybersecurity literacy disruptive technologies integration of tertiary education institutions provided with among children and incorporated into cybersecurity into digital institutions to integrate supporting materials to students regularly cybersecurity curricula
80. literacy and civics cybersecurity into digital include cybersecurity in collected and evaluated to prepare younger curricula from primary to literacy and civics their digital literacy and to optimise awareness- generations for tertiary education as part curricula? civics curricula? raising and cyber- emerging and future of awareness-raising and hygiene materials and threats? cyber-hygiene initiatives? recommendations for each level of education? 11 Is there a plan to 1 Do you have resources 1 Do you have a national 1 Do you regularly collect 1 Does your national 1 establish a national that are easily available cybersecurity portal that and utilise user feedback cybersecurity portal cybersecurity portal that and identifiable (e.g. actively provides cyber- to update materials and include interactive, provides information, through a single online hygiene-related resources on cyber dynamic content and materials and toolkits to portal or in an awareness information, materials hygiene that are continuously updated support personal and kit) for users and entities and toolkits for available through your information (e.g. a organisational cyber seeking to educate stakeholders of varying national cybersecurity chatbot, gamification, hygiene as part of themselves on cyber- types and maturity levels portal to reflect the latest live broadcasts, awareness-raising hygiene topics? (e.g. citizens, SMEs, cybersecurity trends and daily/weekly measures? public administration needs? cybersecurity-related entities)? news) to enhance user engagement and broaden reach?
81. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
82. 3 – Address the a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cybersecurity skills objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to gap or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Have you considered 1 Have you identified the 1 Have you adopted a 1 Are mechanisms in place 1 Do you monitor 1 implementing a key national national roadmap with to regularly assess and emerging technical, coordinated national stakeholders who can concrete steps and update the national legal, and sociostrategy with clear contribute to developing designated stakeholders cybersecurity roadmap in economic risks and objectives and cybersecurity specialists' to build cybersecurity line with the evolving trends among measurable outcomes competencies? specialists' professional needs of cybersecurity cybersecurity to address shortages in capabilities? specialists? specialists, and adapt cybersecurity your national roadmap specialists? accordingly? 2 Is the cybersecurity 1 Have you established a 1 Have you conducted a 1 Do you regularly conduct 1 Have you conducted or 1 skills gap explicitly methodology to assess national assessment of national assessments of planned structured included in your NCSS cybersecurity skills at the cybersecurity skills cybersecurity skills to foresight exercises to or related policy national level? across technical, legal, update and adapt your identify emerging trends documents? and policy domains, national roadmap to and future needs in the including the public and address the national cybersecurity private sectors, and cybersecurity skills gap? workforce? academia? 3 Have you conducted a 1 Do you provide training 1 Does the national 1 Do you promote 1 Do you regularly monitor 1 study on the integration for educators, regardless education policy information security cybersecurity trends and of cybersecurity of their field, on promote cybersecurity courses in secondary provide tailored fundamentals into information security and awareness and internet and tertiary education for guidance on national educational privacy issues such as safety courses at early students beyond cybersecurity education curricula? online safety, personal stages of education, computer science, across all levels of the including primary, including courses tailored
83. data protection and middle, and high to other professional national education cyberbullying? school? fields? system?
84. 4 Does your current or 1 Have strategic objectives 1 Do you promote or 1 Do you engage relevant 1 Are there mechanisms 1 upcoming NCSS and key policy measures develop tailored stakeholders (e.g. the (including through your include measures to been established to cybersecurity training private sector, civil NCSS) that ensure that promote and develop promote cybersecurity and activities for society, academia) in cybersecurity education cybersecurity education, training and different audiences, and developing cybersecurity and training activities education, training and skills development do you have timelines training and education are regularly updated to skills for citizens and nationally, supported by and, PPPs, with a activities, that are stay relevant amid relevant stakeholders activities for citizens for defined specific set of periodically assessed emerging technologies, through dedicated that purpose? resources to support and updated based on evolving threats, and programmes? this? performance indicators new legal regulations and evolving needs? and national security directives? 5 Have you conducted a 1 Do you promote 1 Have you developed or 1 Do you use EU support 1 Do you have 1 study or gap analysis to dedicated training funded any national mechanisms or funding mechanisms to quickly identify upskilling and activities for reskilling or activities to reskill (e.g. the digital Europe adapt upskilling and reskilling needs to upskilling of the interested individuals, programme, the reskilling programmes in strengthen cybersecurity workforce? such as career changers European Social Fund response to evolving cybersecurity skills and unemployed Plus, Horizon Europe) to cybersecurity workforce across all relevant individuals, in upskill or reskill the needs and labour audiences? cybersecurity? workforce generally or in market trends? sector-specific cybersecurity roles (e.g. in healthcare, energy or SMEs)? 6 Do you actively 1 Does your country 1 Has your country 1 Do you provide financial 1 Does your country 1 promote the provide structured established a broader and career incentives ensure the long-term importance of obtaining pathways for advanced cybersecurity capacity- across the public and relevance of cybersecurity cybersecurity education building ecosystem, private sectors (e.g. cybersecurity education certifications in (e.g. specialised including research labs, scholarships, and certifications by technical, operational Master’s and PhD specialised educational apprenticeships, supporting activities and strategic areas and programmes, recognised institutions, regular internships, guaranteed such as academic support public certifications and security events (e.g. jobs) to encourage the centres of excellence administration entities microcredentials)? hackathons) and uptake of cybersecurity and maintaining the in encouraging their partnerships with degrees, accreditation or alignment of learning personnel to pursue academic and certification? programmes with these certifications? professional bodies to technological align training with advancements, evolving recognised career threats and regulatory changes?
85. frameworks such as the ECSF? 7 Do public 1 Have you identified 1 Have you implemented 1 Do you systematically 1 Do you continuously 1 administration entities concrete measures to concrete measures to assess the effectiveness monitor, benchmark and recognise the risks of address the address and reduce the of the measures evaluate international the cybersecurity cybersecurity skills gap? cybersecurity skills gap? implemented to close the best practices to workforce skills gap at cybersecurity skills gap? address the the national and EU cybersecurity workforce levels? skills gap and systematically adapt and integrate those proven measures into the national context through structured stakeholder engagement and policy feedback loops? 8 Have you conducted Have priority actions 1 Have stakeholders from 1 Do you assess the 1 Have you conducted or 1 any formal or informal 1 been set out to address the public and private impact of cybersecurity planned foresight study – including ad the cybersecurity skills sectors been involved in skills development exercises to anticipate hoc efforts – to identify gap across different the identification and policy/activities across future challenges and measures for closing sectors and stakeholder prioritisation of the public and private opportunities in the cybersecurity skills groups? policy/activities to sectors using cybersecurity workforce gap? address the performance indicators? development? cybersecurity skills gap? 9 Has an initial Have you established 1 Have you implemented 1 Do you have funding 1 Do you continuously 1 assessment been 1 cybersecurity role cybersecurity role instruments targeting update cybersecurity conducted to establish profiles / job families in profiles / job families different cybersecurity role profiles to reflect cybersecurity roles and your national within your national role profiles or job technological competencies in line occupational workforce development families based on the advancements and align with national workforce classification? plan? current state of the skills with international and planning and gap? EU frameworks (e.g. the frameworks, such as National Initiative for the ECSF and the Cybersecurity Education National Initiative for workforce framework for Cybersecurity cybersecurity, the Education workforce ECSF)? framework for cybersecurity? 10 Have you formally Have you conducted a 1 Have you supported or 1 Have you implemented 1 Do you continuously 1 acknowledged the 1 study or assessment of developed any or funded any monitor socioeconomic importance of attracting under-represented policies/activities or scholarships, outreach or trends and adapt under-represented programmes to inclusive hiring cybersecurity
86. groups (e.g. women, groups in the national encourage under- campaigns to support programmes targeting minorities, people with cybersecurity market? represented groups to under-represented under-represented disabilities) to pursue a join the cybersecurity groups in cybersecurity groups to ensure their cybersecurity career? field? careers? ongoing relevance and effectiveness? 11 Has any formal or 1 Have you designated a 1 Have you set indicators 1 Do you regularly 1 Do you actively 1 informal assessment – competent authority (e.g. on the number of evaluate the participate in including ad hoc efforts responsible for trained professionals, effectiveness of your international activities – been conducted to coordinating and gender balance or skills development efforts and forums to promote explore suitable assessing cybersecurity employment outcomes) based on the set cybersecurity skills indicators for skills development to evaluate the indicators? development and share evaluating the impact efforts? effectiveness of your best practices? of cybersecurity skills development education and training efforts? activities? 12 Have you engaged in 1 Do you promote EU-level 1 Have you adopted 1 Do you systematically 1 Do you lead or actively 1 preliminary discussions activities aimed at measures to support the monitor and evaluate participate in the EUwith other Member closing the cybersecurity development of a single joint cybersecurity skills wide discussions and States and EU skills gap (e.g. the Cyber market for cybersecurity activities developed in forums, sharing national agencies on how to Skills Academy, national skills, including activities cooperation with other best practices and address the chapters of that enhance workforce Member States through contributing to joint cybersecurity skills gap Women4Cyber, the mobility and recognition EU frameworks (e.g. the efforts to close the across the EU? digital skills and jobs of qualifications across ECCC) to ensure cybersecurity skills gap? platform) within your Member States? effectiveness and country? continuous improvement?
87. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
88. 4 – Foster Research a Do you cover the 1 Have you defined Do you have a formally 1 Do you have a formal 1 Do you have 1 and Development objective in your NCSS (formally or informally) defined and mechanism to regularly mechanisms in place to (R&D) and or do you plan to cover intended results, guiding documented action plan review and assess your ensure that the action Innovation it in the next edition? principles, or key that includes specific action plan to ensure plan is monitored and activities in your action activities with clear that it is correctly dynamically adapted to plan that contribute to goals, timelines, and prioritized and optimized, evolving technological, achieving the objective allocated resources? including progress geopolitical and threat in an uncoordinated tracking, performance landscapes? way? evaluation, and identification of areas for improvement? 1 Do you recognise the 1 Do you have a process 1 Do you have 1 Are there mechanisms to 1 Are there mechanisms 1 need to support R & D to establish national R & mechanisms to regularly assess that to ensure the alignment activities dedicated to D priorities (e.g. incorporate national instruments over time of the national cybersecurity? emerging topics relating cybersecurity R & D (e.g. NCCs) have the cybersecurity R & D to deterring, protecting findings into policy and resources required? priorities with EU against, detecting and explore opportunities in strategic policies, adapting to evolving EU-wide initiatives and objectives and initiatives cyber threats)? funding (e.g. Horizon (e.g. the digital single Europe, the digital market, Horizon Europe, Europe programme)? the EU cybersecurity strategy, the digital Europe programme, European Digital Innovation Hub calls) and the evolving regulatory frameworks? 2 Do you organise 1 Are stakeholders from 1 Do you actively promote 1 Do you have any 1 Have you established 1 conferences/ the private sector, the partnerships that cooperation agreements cybersecurity centres of workshops to identify public sector and enhance cybersecurity in place or incentives excellence or effective ways to academic and research R & D among the with academic and competence, equipped promote partnerships institutions involved in private sector, the public research institutions, with advanced with academic and establishing national sector and academic potentially involving the predictive analytics and research institutions, institutions? private and public strategic foresight tools,
89. industry, civil-society cybersecurity R & D sectors, to support the to serve as practical, organisations and the priorities? development and state-of-the-art research public sector in deployment of and innovation hubs? fostering cybersecurity cybersecurity tools and innovation? secure network infrastructure? 3 Have you conducted 1 Have strategic 1 Is there a 1 Do you regularly assess 1 Do you actively 1 any initial assessments objectives, priority areas comprehensive national the contribution of (semi- participate in or lead or studies on (semi and key stakeholders programme that )automated tools or any international- and EU- )automated tools or the been identified to drive supports (semi- other implemented level forums and integration of national R & D efforts to )automated tools, R & D innovative technologies discussions on cuttinginnovative technologies integrate (semi- or the adoption of any to the effectiveness of edge cybersecurity (e.g. AI or post- )automated tools or any other innovative cybersecurity solutions? research, innovation quantum cryptography) other innovative technologies (e.g. AI or and good practices in into cybersecurity technologies in post-quantum the use of (semipractices? cybersecurity solutions? cryptography), offering )automated tools or any incentives and other innovative collaboration cybersecurity opportunities to a wide technologies? range of public stakeholders and private entities? 4 Have you conducted a 1 Have guidelines been 1 Does the national 1 Are national data-sharing 1 Do you proactively 1 study on implementing developed to promote mechanism for mechanisms regularly contribute to responsible data- responsible data sharing responsible data sharing reviewed and updated to international research to sharing mechanisms for training and in cybersecurity ensure alignment with develop responsible for training users of improving cybersecurity research and innovation evolving legal data sharing for innovative tools with legal and include governance and frameworks, ethical cybersecurity cybersecurity ethical safeguards, coordination measures standards and innovations (e.g. opentechnologies, while incorporating practices that align with strategic operational needs? source initiatives, also considering how that encourage open- priorities such as open- standards and principles such as source projects, source collaboration, interoperability), while open source, recognised standards standards adoption and continuously integrating standards and and interoperability? interoperability? lessons learned into interoperability can national innovation strengthen these policies? mechanisms? 5 Has the integration of 1 Has coordination begun 1 Are there mechanisms 1 Do national 1 Do you actively 1 the General Data between cybersecurity in place to ensure that cybersecurity innovation contribute to the Protection Regulation and data protection the design, development programmes include development of good (GDPR) principles into authorities to align and use of innovative performance indicators practice focused on cybersecurity cybersecurity innovation technology, including AI, or review mechanisms to preserving privacy and
90. technology efforts with privacy comply with EU privacy systematically ensure data protection in development been requirements? and data protection law that GDPR principles are innovative cybersecurity formally acknowledged (e.g. principles of data embedded by design technologies? in your NCSS or in accuracy, minimisation, and by default in relevant cybersecurity fairness, transparency innovative cybersecurity policy documents? and data security)? technologies? 6 Has the need to embed 1 Do you provide national 1 Do you have a 1 Is stakeholder feedback 1 Do you actively promote 1 data protection by guidance for mechanism to control periodically collected to and share good design and by default implementing data the integration of data assess and improve practices for data in cybersecurity R & D protection by design and protection by design and national efforts in protection by design and activities been officially by default in by default into the supporting data by default in prioritised in a strategic cybersecurity R & D design of new protection by design and cybersecurity R & D or policy document? activities? cybersecurity solutions? by default in activities at the cybersecurity R & D international level? activities? 7 Are there any informal 1 Do you have a national 1 Do you actively promote 1 Are there formal 1 Are national 1 or formal framework to guide and or facilitate opportunities agreements or stakeholders (e.g. communication coordinate stakeholder for national stakeholders partnerships between government agencies, channels between participation in EU and (e.g. government your government and academic and research national stakeholders international agencies, academic and other Member States on institutions) actively (e.g. government cybersecurity R & D research institutions) to cybersecurity R & D? participating in leading agencies, academic initiatives (e.g. engage in EU-level or international discussions and research guidelines, contact international in the area of institutions) and EU points, matchmaking cybersecurity R & D cybersecurity R & D and international platforms)? projects and initiatives? activities? innovation networks (e.g. ENISA, the ECCC) to share information about cybersecurity R & D opportunities and funding (e.g. calls for consortia, calls for proposals, grants)?
91. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
92. 5 – Enhance a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 incident objective in your NCSS (formally or informally) defined and mechanism to regularly mechanisms in place to preparedness or do you plan to cover intended results, guiding documented action plan review and assess your ensure that the action and response it in the next edition? principles, or key that includes specific action plan to ensure plan is monitored and activities in your action activities with clear that it is correctly dynamically adapted to plan that contribute to goals, timelines, and prioritized and optimized, evolving technological, achieving the objective allocated resources? including progress geopolitical and threat in an uncoordinated tracking, performance landscapes? way? evaluation, and identification of areas for improvement? 1 Have discussions been 1 Has a draft national 1 Is your national cyber 1 Do you monitor and 1 Is research conducted 1 held to establish a cyber IPR framework IPR framework, as well regularly update the on improving the cyber national cyber IPR been developed and as associated protocols national cyber IPR IPR framework and its framework? shared with relevant and cooperation framework, associated associated protocols or stakeholders? mechanisms, protocols and cooperation implemented and cooperation mechanisms mechanisms, taking into operational? to ensure their account future threats effectiveness? and technological changes? 2 Have you initiated the 1 Are national cyber 1 Are national cyber 1 Are national cyber 1 Do national cyber 1 development of incident response incident response incident response incident response national cyber incident procedures documented procedures procedures regularly procedures incorporate response procedures and communicated to implemented and reviewed and refined, threat intelligence and (e.g. standard relevant stakeholders, to adopted by relevant incorporating input from analysis techniques, operating procedures) effectively identify, stakeholders to ensure relevant stakeholders informed by key national for identifying, classify and respond to efficient cyber incident (e.g. feedback and stakeholders and classifying and cybersecurity incidents? identification, lessons learned, national collaborative experience responding to classification and CSIRTs, EU-level across the EU and other cybersecurity incidents coordinated response to networks such as the international networks? (including large-scale cybersecurity incidents? European Cyber Crisis cybersecurity Liaison Organisation incidents)? Network (EU-Cyclone) or the CSIRTs Network)?
93. 3 Have preliminary roles 1 Have formal roles and 1 Are well-defined roles 1 Are formal roles and 1 Do the formal roles and 1 and responsibilities for responsibilities within the and responsibilities responsibilities within the responsibilities within relevant competent incident response chain formally established and incident response chain the incident response authorities (including been clearly established documented for regularly reviewed and chain allow for dynamic law enforcement and and communicated to competent authorities, optimised to align with adjustments and flexible sectoral authorities) relevant competent CSIRTs, law national- and EU-level public–private been outlined in cyber authorities, supported by enforcement and frameworks (including collaboration to incident response a centralised registry of sectoral actors to coordination with EU- strengthen response management chain? points of contact across ensure accountability Cyclone or the CSIRTs capabilities in evolving all actors? and coordination during Network)? threat landscapes? cyber incident response, supported by a regularly updated centralised registry of points of contact? 4 Is the role of CSIRTs 1 Have preliminary efforts 1 Are CSIRTs fully 1 Does your CSIRTs’ 1 Are CSIRTs employing 1 as national been undertaken to equipped with adequate supervisory body adaptive strategies and coordination hubs estimate and allocate resources and staffing regularly monitor, innovative technologies clearly understood by necessary resources to to function effectively as evaluate and adjust to enhance operational all relevant CSIRTs, ensuring that national coordination CSIRTs’ resources and resilience and fulfil stakeholders, ensuring they possess the hubs, including meeting staffing to ensure that proactive tasks (e.g. that they recognise the technical capabilities and the NIS2 requirements they can effectively fulfil proactive scanning, risk need to provide staffing required to fulfil for redundancy, secure their mandate as the analysis of future adequate resources for their tasks under NIS2? infrastructure and national coordination threats)? their operations? emergency protocols? hub? 5 Has the establishment 1 Are preliminary joint 1 Are joint incident 1 Are joint incident 1 Are joint incident 1 of joint incident incident response response protocols response protocols response protocols response protocols or protocols under documented and regularly reviewed and subject to continuous trusted communication development to facilitate operational, ensuring optimised, incorporating improvement, including channels between trusted communication seamless and secure lessons learned by both through the use of competent authorities and coordinated coordination between the competent adaptive methodologies, and operators of response between competent authorities authorities and the integration of advanced essential and important competent authorities and operators of operators of essential threat intelligence or entities been initiated? and operators of essential and important and important entities? new information-sharing essential and important entities during tools? entities during cybersecurity incidents, cybersecurity incidents in line with NIS2 (in accordance with cooperation principles? Article 10 of NIS2)? 6 Have discussions been 1 Are proactive 1 Are proactive 1 Are the proactive 1 Are the proactive 1 held to promote a approaches (e.g. the cybersecurity measures, cybersecurity measures cybersecurity measures proactive approach to European Cybersecurity including advanced regularly evaluated and continuously adapted,
94. identifying Alert System, regular detection capabilities, refined, incorporating utilising innovative tools cybersecurity threats at national sectoral actively implemented, lessons learned from (e.g. advanced threat the national level, exercises, training supported by incidents, exercises and intelligence, AI, data focusing on sessions, awareness- documented processes best practices? analytics) to enhance anticipating and raising campaigns) and stakeholder effectiveness and preventing incidents leveraged to establish engagement, to responsiveness to (e.g. workshops, frameworks and policies enhance incident emerging cyber threats, studies, exercises)? for threat management handling, reporting, and in line with NIS2 and the and coordinated analysis? Cyber Solidarity Act? response at the national and EU levels? 7 Is the significance of 1 Has the implementation 1 Are there frameworks in 1 Is the integration of 1 Do disaster recovery 1 integrating disaster of policies or pilot place that include disaster recovery and and resilience strategies recovery and continuity programmes been disaster recovery and resilience strategies adaptively incorporate of operations initiated to incorporate resilience, with regularly monitored, cutting-edge practices recognised within your disaster recovery and documented procedures evaluated and improved and innovative national cybersecurity resilience into the and cooperation to ensure technologies to ensure preparedness strategy, NCSS? between competent comprehensive operational continuity as encouraged by authorities, essential cybersecurity against emerging cyber NIS2 and the and important entities preparedness, in threats, in line with EU- Cybersecurity and other relevant accordance with NIS2 level coordination Emergency stakeholders? and EU-level mechanisms? Mechanism? coordination mechanisms? 8 Is the importance of 1 Have clear procedures 1 Are structured protocols 1 Are lessons-learned 1 Do lessons-learned 1 producing lessons- been established and consistently outcomes regularly processes evolve learned reports after applied for conducting implemented to integrated into the dynamically, leveraging significant lessons-learned reports document lessons NCSS, supported by data-driven insights and cybersecurity incidents and root cause analyses, learned across all periodic reviews to advanced analytics to acknowledged in initial incorporating relevant stakeholders, ensure continuous continuously refine and guidance or strategic stakeholder input and with outcomes improvement and enhance national planning documents? aligning with NIS2 systematically used to alignment with EU-level cybersecurity requirements? strengthen national- and coordination? capabilities? EU-level cybersecurity capabilities? 9 Are plans in place to 1 Have foundational 1 Are national 1 Is the alerting and threat- 1 Do alerting mechanisms 1 establish national systems or frameworks mechanisms fully intelligence-sharing continuously evolve, mechanisms and been developed to operational for real-time system regularly leveraging advanced platforms that are enable real-time alerting and threat assessed and integrated analytics and real-time secure and accessible distribution of intelligence sharing, with cross-sectoral and data capabilities (e.g. AI, for issuing cybersecurity alerts and supported by clearly EU-level networks (e.g. data analytics) to cybersecurity alerts cross-border cyber hubs, enhance threat
95. and sharing threat threat intelligence defined roles and cross- EU-Cyclone, CSIRTs) to intelligence distribution, intelligence? sharing? sectoral processes? optimise incident in line with NIS2 and the response? European Cybersecurity Alert System? 10 Are there discussions 1 Have preliminary 1 Are national CSIRTs 1 Is the role of national 1 Do national CSIRTs 1 or initiatives aimed at frameworks been operational with CSIRTs and their employ innovative threat enhancing the role of developed to formalise adequate resources to engagement with EU intelligence and national CSIRTs as the roles of national manage national and global coordination coordination central coordinating CSIRTs, including their cybersecurity incidents platforms regularly methodologies to adapt bodies, enabling their participation in platforms and enhance incident reviewed, optimised in real time to evolving engagement with EU such as ENISA, the response capabilities based on lessons cyber threats and and global incident CSIRTs Network and through collaborative learned from incidents continuously enhance response coordination other EU-level frameworks and and exercises, and their participation in EU platforms to strengthen coordination bodies? participation in EU and enhanced to strengthen and global platforms by situational awareness global coordination international integrating foresight and international platforms? cooperation? strategies and cooperation? innovative practices to anticipate and manage international cybersecurity risks? 11 Are there active 1 Have cooperative 1 Are structured 1 Is public–private 1 Is public–private 1 engagements and measures been mechanisms, including cooperation for collaboration evolving to discussions aimed at established to improve national cyber hubs, cybersecurity integrate advanced fostering public–private readiness and incident operational and preparedness, analytics and innovative cooperation in response, in line with the facilitating joint responsiveness and tools for anticipating cybersecurity, including Cyber Solidarity Act preparedness, real-time recovery regularly cyber threats, with preliminary meetings to guidelines for joint response and recovery reviewed and optimised, preparedness and develop sector-specific testing, threat activities between integrating cross-sector response measures objectives and intelligence sharing and competent authorities resilience measures regularly updated based measures for IPR? clear governance roles and private entities, endorsed by the EU and on national evaluations between authorities and leveraging cooperative aligning with and best practices? private entities? exercises and secure coordination policies in communication the NCSS, through channels? ongoing evaluation processes to refine incident response frameworks?
96. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
97. 6 – Address a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cybercrime objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Do you have any 1 Do you have a national 1 Is your national legal 1 Do you regularly assess 1 Is there a mechanism in 1 informal or formal framework for detecting, framework compliant whether sufficient place to promptly update procedures in place reporting and with the EU legal human, financial and your national cybercrime to facilitate prosecuting cybercrime framework on technical resources are strategy or framework in coordination between that sets out a structured cybercrime (e.g. as allocated at the national response to emerging law enforcement coordination approach regards illegal access to level to combating cyber threats and trends authorities, judiciary involving law information systems, cybercrime? at the national, regional authorities, enforcement, system interference, and global levels? cybersecurity cybersecurity competent data interference, competent authorities authorities and private interception and the use and private sector sector stakeholders? of tools to commit stakeholders in offences)? addressing cybercrime-related activities? 2 Do you have 1 Are you developing 1 Have you established 1 Are mechanisms in place 1 Do you actively lead or 1 established taxonomies, templates or formal cooperation to assess collaboration influence international cooperation channels national initiatives to mechanisms to enable between CSIRTs, and EU-level forums and (formal or informal) align the classification of secure and timely cybersecurity competent discussions on good for addressing cybercrime incidents information exchange authorities and national practices of cooperation, cybercrime-related between CSIRTs, between CSIRTs, law enforcement bodies including cross-border topics between cybersecurity competent cybersecurity competent and to implement cooperation?
98. CSIRTs, authorities and national authorities and national measures for its cybersecurity law enforcement bodies? law enforcement bodies enhancement? competent authorities involved in combating and national law cybercrime? enforcement bodies? 3 Do you have any 1 Are there national 1 Have you established or 1 Have you established an 1 Do you continuously 1 informal or formal initiatives to strengthen designated a central interinstitutional monitor and collect collaboration collaboration between coordinating entity to framework and inputs (e.g. emerging mechanisms in place public and private sector oversee national efforts cooperation mechanisms cybercrime trends, best between private stakeholders in in combating between all relevant practices for sector stakeholders combating cybercrime cybercrime? stakeholders (e.g. law cooperation) to and national (e.g. cooperation enforcement agencies, dynamically adjust authorities to share networks, joint task national CSIRTs and the cooperation information on forces, trusted judiciary), including the mechanisms with public cybercrime-related information-sharing private sector (e.g. and private sector incidents? platforms)? operators of essential stakeholders? services, service providers) where appropriate? 4 Do you have any 1 Are there 1 Have you established a 1 Have you established an 1 Do you collect 1 informal or formal policies/activities in your governance framework interinstitutional disaggregated collaboration NCCS and/or national that sets out the roles framework and cybercrime statistics mechanisms in place initiatives (e.g. and responsibilities of cooperation mechanisms (e.g. operational data, between private cooperation networks, key stakeholders between all relevant data for trend analysis, sector stakeholders joint task forces, trusted (CSIRTs, law stakeholders (e.g. law financial impact and national information-sharing enforcement agencies enforcement agencies, information) and monitor authorities to share platforms) that govern and the judiciary) and/or national CSIRTs and the emerging cybercrime information on and strengthen designates a central judiciary), including the trends to regularly cybercrime-related collaboration between coordinating entity to private sector (e.g. inform national policies incidents? public and private sector oversee national efforts operators of essential and adjust cooperation stakeholders in and ensure a services, service mechanisms with public combating cybercrime? coordinated response to providers) where and private sector cybercrime incidents? appropriate? stakeholders? 5 Have competent 1 Have you organised 1 Do you provide 1 Do you collect statistics 1 Do you regularly 1 authorities awareness-raising guidance to essential on the reporting of evaluate and adapt recognised the need campaigns for essential and important entities on cybercrime activities by awareness-raising to raise awareness and important entities identifying and reporting essential and important activities for essential among essential and aimed at improving the suspected cybercrime entities and use this and important entities important entities, identification of activities? information to adapt your based on emerging regarding the cybercrime activities? awareness-raising cybercrime trends, identification of activities? lessons learned and cybercrime activities?
99. feedback from previous campaigns?
100. 6 Are there any 1 Have you designated an 1 Is there a formal 1 Do you regularly assess 1 Do you participate in 1 informal or formal operational national point mechanism in place to and optimise your coordinated actions with cooperation channels of contact to exchange foster cooperation with participation in European other Member States for sharing information and respond other Member States Union Agency for Law and Europol to disrupt information on to urgent information and share information to Enforcement cybercrime activities cybercrime activities requests from other effectively prevent, Cooperation (Europol) (e.g. dismantling of with cybersecurity Member States detect and respond to cooperation networks organised groups, competent authorities regarding offences set cybercrime incidents? (e.g. EC3, the Joint takedown of criminal and law enforcement out in Directive Cybercrime Action infrastructure, dark web agencies in other 2013/40/EU on attacks Taskforce or the Europol markets or botnets) and Member States? against information platform for experts)? is there a structured systems and Directive process in place to (EU) 2016/680 (the Law review the aftermath of Enforcement Directive these incidents, (LED))? analysing what went wrong and what went right, to learn lessons and improve future responses to cybercrime? 7 Have you identified 1 Do you prioritise 1 Are appropriate tools 1 During cybercrime 1 Do you participate in 1 the privacy rules you compliance with personal and procedures in place investigations, do you developing and need to comply with data protection rules to ensure that consult or leverage maintaining during cybercrime during coordination and information sharing in guidance from Europol’s standardised tools, investigations? information sharing in cybercrime Data Protection Experts methodologies, forms cybercrime investigations complies Network to ensure and procedures for investigations? with personal data compliance with personal information sharing protection rules? data protection rules? during cyber investigations that are shared with EU stakeholders (law enforcement agencies, CSIRTs, ENISA and Europol’s EC3)?
101. 8 Have you assessed 1 Has your national 24/7 1 Do you cooperate and 1 Do you promote and 1 Do you use the EU 1 how key stakeholders point of contact for the share information with implement standards and Blueprint and/or the EU combating cybercrime EU law enforcement EU agencies (e.g. guidelines issued by EC3 law enforcement can benefit from the emergency response Europol’s EC3, the or ENISA for emergency response expertise and protocol established an European Union Agency collaboration and protocol to respond resources offered by information-sharing for Criminal Justice information sharing (e.g. effectively to large-scale EC3 and ENISA? procedure to get Cooperation (Eurojust), ENISA’s taxonomy for cyber incidents? expertise from EC3 ENISA) to ensure the the CSIRT community)? during a cyberattack effective prevention and response? detection of, and response to, cybercrime? 9 Have you identified 1 Are training materials 1 Is specialised training 1 Do you evaluate the 1 Are there 1 the requirements (e.g. and programmes on regularly provided to law adequacy of the training interinstitutional training knowledge, skills, cybercrime-related topics enforcement officials provided to law courses or workshops resources) for law provided at both the (e.g. police officers, enforcement agencies, for law enforcement, enforcement officials national and the EU prosecutors, judges) on the judiciary and national judges, prosecutors and (e.g. police officers, levels (e.g. by Europol, cybercrime-related CSIRT personnel to national/ prosecutors, judges) Eurojust, the European topics (e.g. prosecution address cybercrime? governmental CSIRTs at to effectively carry out Anti-Fraud Office, the EU of cyber-enabled crimes, the national level and/or their duties in the Agency for Law collection and handling the multilateral level? context of Enforcement Training, of electronic evidence, cybercrime? ENISA) to law computer forensics)? enforcement officials? 10 Have initial measures 1 Do CSIRTs provide law 1 Do law enforcement and 1 Do you have a 1 Do your law 1 been implemented to enforcement and judicial judicial authorities have mechanism in place to enforcement and judicial strengthen the authorities with guidance sufficient capabilities regularly evaluate the authorities actively detection, or support in identifying, (e.g. tools, personnel) to adequacy of law participate in the investigation and reporting or analysing effectively detect, enforcement and judicial transborder exchange of prosecution suspected cybercrime investigate and authorities’ resources best practices and legal capabilities of law incidents? prosecute cybercrime and adjust them as expertise (e.g. through enforcement and incidents? necessary? the European Judicial judicial authorities Cybercrime Network)? (e.g. police officers, prosecutors, judges) to address cybercrime?
102. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
103. 7 – Engage in a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 international objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to cooperation or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Has your government 1 Are you engaged in 1 Do key national 1 Are international 1 Do you take a leading 1 established a formal bilateral or multilateral stakeholders (e.g. the cybersecurity role or engage actively strategy and/or does it cooperation agreements ministry of foreign cooperation initiatives in discussions on one or maintain formal or with Member States, affairs, the national regularly assessed for more topics within informal cooperation non-EU countries or cybersecurity authority, effectiveness and multilateral cybersecurity channels with international partners for CSIRTs) have alignment with national- agreements? authorities or purposes such as sufficient/dedicated and EU-level objectives stakeholders in non-EU information sharing, means and budget to (e.g. as per the EU countries, expressing capacity building or the engage in international cybersecurity strategy)? the intention to engage provision of mutual cybersecurity in international assistance in the field of partnerships and cooperation on cybersecurity? cooperation frameworks cybersecurity-related to support strategic issues? alignment on cybersecurity topics? 2 Do you have any 1 Do you have procedures 1 Do you actively 1 Do you regularly identify 1 Do you proactively 1 formal or informal in place to facilitate the participate in any lessons learned and participate in coordination or coordination with your international cooperation areas for improvement international initiatives information-exchange international partners to network or partnership from your participation in that contribute to channels in place with tackle large-scale to coordinate and international cooperation enhancing the international partners cybersecurity incidents facilitate timely and networks and prevention of and (beyond the EU’s beyond the EU’s secure information partnerships for incident response to large-scale borders) to support the borders? exchange during large- response beyond the cybersecurity incidents response to large-scale scale cybersecurity EU’s borders? (e.g. OSCE confidence-
104. cybersecurity incidents beyond the building measures, the incidents? EU’s borders? UN Global Mechanism for Cyberspace) and build trust and confidence with international partners (beyond the EU’s borders)? 3 Do you have any 1 Are initial steps or 1 Do you have established 1 Do you provide any 1 Do you actively build 1 formal or informal negotiations under way cooperation incentives (e.g. trust, through secure cooperation or to establish formalised mechanisms between participation in national and reciprocal cybersecurity reciprocal cybersecurity key competent and cross-border cybersecurity information-sharing information-sharing authorities (e.g. cybersecurity exercises, information sharing, with channels established arrangements on threats, cybersecurity and NIS2 access to government multinational private between key vulnerabilities and best supervision authorities, briefings) to multinational sector entities operating competent authorities practices between key cyber crisis- private sector entities to in your Member State? (e.g. cybersecurity and competent authorities management encourage their NIS2 supervision (e.g. cybersecurity and authorities) and engagement in authorities, cyber crisis- NIS2 supervision multinational private cybersecurity information management authorities, cyber crisis- sector entities, and are sharing? authorities) and management authorities) these mechanisms multinational private and multinational private compliant with national sector entities sector entities operating and EU law (e.g. on the operating in your in your Member State? sharing of sensitive or Member State? classified information)? 4 Do you officially 1 Do your national CSIRTs 1 Do your national CSIRTs 1 Is the involvement of 1 Do your national CSIRTs recognise (e.g. in plan to or have they actively participate in your national CSIRTs in take a leading role in strategic documents or already taken initial steps international or regional international and regional international CSIRT guidelines) the to engage in any cybersecurity cybersecurity networks (e.g. the importance of your international or regional cooperation frameworks cooperation frameworks Forum of Incident national CSIRTs cybersecurity beyond the EU’s CSIRTs regularly evaluated to Response and Security participating in cooperation frameworks Network (e.g. the GFCE, ensure alignment with Teams) to drive international or regional beyond the EU’s CSIRTs the Task Force – national priorities and to innovation, share 1 cybersecurity Network? Computer Incident focus efforts on the most predictive threat cooperation Response Team, the impactful cooperation intelligence and frameworks? International Watch and frameworks? influence cross-border Warning Network, cybersecurity policies in Forum of Incident line with NIS2 Response and Security principles? Teams)? 5 Have you officially Do you foster the active Do you contribute to Do you conduct regular Have you developed 1 1 1 1 recognised the need to participation of national cybersecurity capacity- evaluations of the impact and funded any
105. actively participate in experts or organisations building initiatives at the and effectiveness of international international in international international or regional international cybersecurity capacitycybersecurity capacity- cybersecurity capacity- levels (e.g. GFCE, cybersecurity capacity- building projects, building initiatives building programmes Global Cyber Alliance, building initiatives in particularly targeting EU targeting EU candidate (e.g. through EU EU CyberNet or which you participate, candidate countries or countries or strategic CyberNet)? Cooperative Cyber and adjust your level of strategic regions (e.g. regions (e.g. the Defence Centre of involvement on the basis Western Balkans or Western Balkans or Excellence training)? of the findings? Eastern Partnership)? Eastern Partnership )? 6 Do you have an initial 1 Are roles and 1 Do you actively 1 Do you regularly 1 Do you proactively lead, 1 plan and specific responsibilities for participate in evaluate your chair or initiate activities priority areas for engagement with cybersecurity-related engagement with within international engagement with international activities and initiatives international organisations or EU international organisations and EU led by international organisations and EU agencies, including organisations and EU agencies (e.g. ENISA, organisations and EU agencies (e.g. ENISA, leading investigations or agencies (e.g. ENISA, Europol’s EC3, the agencies (e.g. working Europol’s EC3, the proposing new Europol’s EC3, the EEAS, the ITU, the groups, cybercrime EEAS, the ITU, the initiatives, to drive EEAS, the International OECD, Interpol) clearly investigations, OECD, Interpol) and strategic priorities, Telecommunication established and have development of adjust your involvement innovation and cross- Union (ITU), the they been communicated standards and norms)? based on strategic border coordination in Organisation for to the competent priorities or lessons line with NIS2 Economic Co-operation authorities to ensure learned? requirements? and Development effective coordination (OECD), Interpol)? and compliance with NIS2 requirements? 7 Do you acknowledge 1 Do you regularly 1 Do you engage with 1 Are results of 1 Do you organise or 1 the value of participate in regional organisations international and contribute to the participating in international and (e.g. the EU, NATO) in European cybersecurity planning and execution international and European cybersecurity participating in exercises (e.g. Blue of international or European cybersecurity exercises, at least in an multinational OLEx, Locked Shields) European cybersecurity exercises (e.g. Cyber observer role? cybersecurity exercises? regularly assessed to exercises? Europe, Blue OLEx, identify areas for Locked Shields) for improvement in crossexchanging best border coordination and practices and operational readiness? enhancing cross-border cooperation? 8 Have you conducted 1 Have you identified 1 Is there a procedure in 1 Are your national 1 Do you actively 1 any assessment of the priority areas (e.g. digital place to take part in cybersecurity legislation participate in crossalignment of national evidence exchange, international discussions and policy frameworks border initiatives, cybersecurity laws and attribution, cybercrime to ensure the alignment regularly reviewed and frameworks and working policy frameworks with investigation) for of the national updated to ensure groups aimed at
106. international standards, harmonising national cybersecurity legislation ongoing alignment with harmonising norms and best cybersecurity legislation and policy frameworks international cybersecurity norms and practices? and policy frameworks with international cybersecurity standards standards (e.g. the UN with international cybersecurity standards, and norms, while open-ended working cybersecurity standards norms and best supporting cross-border group on the security of and norms to facilitate practices? cooperation and and in the use of international compliance with NIS2 information and cooperation? governance communications requirements? technologies, the ITU)? 9 Have you formally 1 Have priority areas and 1 Is there a formal 1 Do you actively 1 Do you lead or actively 1 acknowledged the key national framework in place to participate in joint EU contribute to importance of stakeholders been implement tailored and diplomatic responses international developing norms of identified to support coordinated diplomatic and operational negotiations and responsible state national diplomatic measures, including measures as defined in discussions on the behaviour and efforts in the formulation attribution and restrictive the EU cyber diplomacy development of rules, confidence-building of a responsible state measures (sanctions), in toolbox? norms and principles for measures in behaviour framework in accordance with the EU responsible state cyberspace, in cyberspace? cyber diplomacy behaviour in alignment with EU and toolbox? cyberspace, their international applicability in cybersecurity international law and cooperation confidence-building frameworks? measures within regional and international organisations (e.g. the UN, OSCE)? 10 Do you officially or 1 Do your NCSS, sectoral 1 Do you participate in 1 Do you actively engage 1 Do you lead or actively 1 unofficially recognise policies or guidance EU-level initiatives in structured international coordinate international internet fragmentation documents embed promoting human rights, partnerships, including initiatives to strengthen as a challenge to the principles that safeguard fundamental freedoms with emerging and and implement the global, open and global, open and and a secure, open and developing countries multistakeholder model interoperable nature of interoperable internet, resilient internet, (e.g. in the Global South) for internet governance the internet? including our core ensuring inclusive and to promote a global, in global forums (e.g. the democratic values, affordable digital access open and secure UN Internet Governance fundamental freedoms (e.g. the cybersecurity cyberspace? Forum, the World Trade and human rights online? strategy for the Digital Organization, the Decade, the European Committee on Digital Internet Forum, the Economy Policy, the Connecting Europe GFCE), shaping norms, Facility (CEF Digital))? policies and cooperative frameworks to ensure a
107. secure, open and interoperable internet?
108. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
109. 8 – Establish trusted a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 information-sharing objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to mechanisms NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Has your NCSS 1 Have you created a 1 Do you have a formal 1 Have you optimised your 1 Is the national 1 acknowledged the policy or action plan that information-sharing information-sharing information-sharing strategic importance sets the scope and framework that aligns framework to distribute framework regularly of establishing trusted priorities for with EU law and national tasks among public and reviewed and adapted to information-sharing cybersecurity information security priorities, private stakeholders evolving cybersecurity mechanisms through sharing, identifies key ensuring structured (including strategic large- practices, while ensuring the development of stakeholders and coordination and scale private efficient distribution of robust partnerships establishes PPPs for compliance across stakeholders), ensuring a collected information between public and trusted information- relevant stakeholders high-quality, accurate among relevant public private stakeholders? sharing mechanisms? and incorporating and timely exchange of and private stakeholders national public–private information in line with through advanced data cooperation NIS2 requirements and processing technologies mechanisms? national cybersecurity such as AI or machine priorities? learning? 2 Does your NCSS 1 Does your national 1 Are essential and 1 Do you regularly 1 Do you regularly 1 actively promote and action plan include the important entities evaluate the integrate outcomes from raise awareness establishment and actively encouraged and performance and impact sectoral ISACs into about the existence support of sector-specific supported by national of established ISACs to national strategies and and development of cybersecurity authorities to participate review and adapt the operations while ISACs and PPPs as information-sharing in sectoral ISACs support provided to them collaborating with ISACs strategic tools for arrangements such as through regulatory, to optimise their and PPPs to ensure that pooling expertise and ISACs and PPPs through technical and financial cooperation and capacity their activities adapt to resources at the dedicated resources support to ISACs and for pooling expertise and evolving threats through provided to facilitate their PPPs to enable their resources? joint planning, cross-
110. national and EU activities and enable strategic role as defined sector coordination and levels? pooling and sharing of in your NCSS? alignment with EU information and initiatives? resources? 3 Have you conducted 1 Are the roles, 1 Are there guidelines in 1 Do you regularly review 1 Do you maintain formal, 1 an assessment to responsibilities and place setting out the and update the cross-sectoral identify the need for access control measures type and level of responsibilities and agreements or protocols differentiated access clear and documented information that an entity access control that specify and levels among key for all relevant should be able to access procedures of periodically adjust stakeholder groups stakeholders, competent based on its maturity stakeholders institutional access to such as competent authorities, critical level, ensuring that it participating in shared cyber-threat and authorities, critical infrastructure operators, receives useful, relevant information sharing? -incident data, based on infrastructure law enforcement and and actionable evolving operational operators, law private sector actors? information? roles, legal mandates enforcement and and strategic priorities? private sector actors? 4 Do you recognise the 1 Are draft legal provisions 1 Are legal safeguards 1 Are legal safeguards 1 Do you maintain cross- 1 need to protect or policy measures in formally adopted and regularly reviewed and sectoral agreements or entities that voluntarily place that cover liability, documented, including updated in coordination national-level guidance share sensitive confidentiality and GDPR liability protections and with data protection that clarify legal cybersecurity compliance for voluntary confidentiality protocols authorities and protections and information, including information sharing? for entities sharing cybersecurity confidentiality standards basic confidentiality sensitive information stakeholders to ensure for voluntary information expectations? voluntarily? alignment with evolving sharing, and are these national and EU law? integrated with EU-level mechanisms (e.g. EUlevel ISACs, the CSIRTs Network, EU-Cyclone)? 5 Do you maintain any 1 Do you have a national 1 Do competent 1 Do you assess the 1 Do you regularly update 1 formal or informal cooperation framework authorities and private effectiveness and strategic cooperation cooperation channels focused on the security sector entities involved limitations of cooperation agreements or protocols between competent of critical infrastructure, in critical infrastructure frameworks in fostering with critical infrastructure authorities and private such as advisory boards, actively participate in the cooperation between operators that enable sector entities steering groups, forums cooperation framework? competent authorities joint threat analysis, responsible for critical or expert groups? and private sector coordinated response infrastructure (i.e. entities and use the planning and integration essential and findings to optimise with EU-level important entities processes? mechanisms (e.g. EUunder NIS2 and level ISACs, EUcritical entities under Cyclone, the CSIRTs the CER Directive)? Network)?
111. 6 Does the NCSS 1 Have clear guidelines 1 Is information on cyber 1 When sharing sensitive 1 Do formal and regularly 1 establish roles and and conditions been threats, vulnerabilities national security reviewed protocols or responsibilities for documented for how and national security information (e.g. agreements exist that sharing essential different types of national status regularly intelligence or ensure secure, timely national cybersecurity cybersecurity information exchanged with private cybercrime findings), are and context-specific information with will be shared with sector entities, recipients selected based sharing of national relevant private relevant entities? particularly those on confidentiality and the security-related cyber entities? operating critical need-to-know principle? information with critical infrastructure? infrastructure entities? 7 Have you identified 1 Have you established a 1 Do you actively promote 1 Do you provide a 1 Do you regularly refine 1 benefits that could framework for private incentives for private sufficiently diverse set of the available incentives motivate private sector entities that sector entities to incentives (e.g. technical, to ensure that they entities to actively provides incentives – encourage their financial and intelligence- remain attractive and participate in wider such as early warnings, engagement in based) to engage a wider effective for target information-sharing official threat briefings information sharing? range of private sector private sector entities? initiatives? and participation in joint entities in informationexercises – for their sharing mechanisms? active involvement in information-sharing mechanisms? 8 Does your NCSS 1 Do you have 1 Does your information- 1 Do you have 1 Does your information- 1 contain strategic mechanisms in place to sharing framework mechanisms in place to sharing framework goals aimed at reach out to SMEs and include mechanisms ensure that SMEs and enable the dynamic supporting SMEs and small organisations to providing SMEs with small organisations can distribution of relevant small organisations in provide cybersecurity- access to certain levels effectively benefit from information across accessing nationwide relevant information, at of information? information sharing with sectors and entity types, or sectoral least on an ad hoc major organisations? ensuring that insights information-sharing basis? from more mature mechanisms in order entities are effectively to enhance collective shared with others? resilience? 9 Have you assessed 1 Does your NCSS 1 Have you established 1 Do you regularly 1 Do you use advanced 1 the availability of encourage integration of and operationalised, evaluate and refine the information-sharing tools secure voluntary inputs collected and through formal guidance effectiveness of your that combine real-time information-sharing centralised by a national from CSIRTs, information-sharing threat intelligence, AIplatforms with clear stakeholder from law cooperation platforms sources, procedures, driven analysis, and cross-sector enforcement, that enable real-time tools and platforms to secure cross-border responsibilities for intelligence, CSIRTs and and secure information ensure that they support exchange, that are stakeholders to be the private sector to build exchange among secure and coordinated regularly updated to stay incorporated into your a unified threat stakeholders? exchange through scalable, responsive to NCSS? landscape view? dedicated channels new threats, and able to among law enforcement, produce actionable
112. CSIRTs and private insights for national and entities? EU-level decisionmaking? 10 Is the need to 1 Are there ongoing 1 Do you support expert 1 Are legal and 1 Do you maintain cross- 1 address legal, initiatives to reduce legal, exchange programmes, organisational sector and cross-border organisational and organisational or cultural joint exercises or frameworks regularly cooperation cultural barriers to barriers and thereby participation in events to reviewed and adapted in mechanisms that information sharing foster effective actively overcome consultation with cross- proactively address formally information sharing? cultural barriers and sector stakeholders to emerging legal and acknowledged in your foster information reduce barriers to organisational barriers, NCSS or policy sharing? information sharing? incorporating lessons documents? learned from joint exercises and EU-level collaboration?
113. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
114. 9 – Establish mutual a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 assistance objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to processes NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Is there an initial 1 Have you identified key 1 Have you established 1 Do you have a 1 Are best practices in 1 awareness among national and cross- formal mutual mechanism to assess the cross-border supervisory national stakeholders border stakeholders assistance agreements effectiveness, efficiency and enforcement about the need for (including CSIRTs, law with other Member and consistency of cooperation mutual assistance in enforcement agencies States covering areas supervisory and continuously reviewed supervisory and and sectoral regulators) such as incident enforcement measures, and integrated into enforcement actions for cooperation in response, legal implemented under national processes? under NIS2? supervisory and proceedings and sharing mutual assistance enforcement measures of cybersecurity agreements? (including specialised capabilities? support and expertise)? 2 Has a preliminary 1 Are legal experts 1 Do you have any legal 1 Are mutual assistance 1 Are lessons learned 1 legal analysis been regularly consulted when mechanisms in place to activities related to from mutual assistance conducted to identify planning or conducting ensure that supervisory supervisory and activities regarding national provisions mutual assistance and enforcement enforcement regularly supervision and relevant to mutual activities related to measures under mutual evaluated for legal enforcement assistance under supervisory and assistance are in line compliance and updated systematically used to NIS2? enforcement measures? with national and EU accordingly? improve your legal law? framework and to enhance the timeliness and security of responses? 3 Are formal or informal 1 Have you designated a 1 Are secure and reliable 1 Are the single points of 1 Are lessons learned 1 points of contact single point of contact communication channels contact and from previous mutual
115. established for mutual within your competent available for mutual communication channels assistance requests assistance with other authorities for the assistance among regularly tested for used to improve Member States? purpose of mutual competent authorities? reliability and operational communication and assistance coordination? efficiency? coordination capabilities? 4 Have you considered 1 Are standardised 1 Are procedures 1 Do you regularly review 1 Are mechanisms in 1 developing templates templates available for documented for the procedures and place to ensure that and protocols to submission and handling submitting, responding adapt them accordingly, mutual assistance facilitate mutual of mutual assistance to and documenting especially to ensure procedures remain assistance requests requests? mutual assistance proportionality, relevant in light of and their handling? requests? competence alignment technological and respect for developments, legal sovereignty? changes and evolving security directives? 5 Do you have any 1 Are initial procedures in 1 Have documented 1 Do you have a 1 Are existing cooperation 1 formal or informal place to facilitate regular guidelines been mechanism to support networks (e.g. the NIS2 cooperation practices consultation and developed to support cross-sectoral and cross- Cooperation Group) among competent information exchange consistent domain (e.g. civilian and and/or participation in authorities to consult, among competent implementation of defence) consultation specific programmes inform and support authorities for mutual mutual assistance and coordination in (e.g. staff exchange) each other in cross- assistance activities? processes and ensure cross-border supervisory used to consult, inform border supervisory clarity among competent and enforcement and support Member and enforcement authorities? actions? States in supervisory actions? and enforcement measures, contributing to a coordinated cybersecurity approach and strengthening mutual understanding? 6 Do you use the NIS2 1 Cooperation Group as a platform to discuss specific requests for mutual assistance to enhance cooperation at the EU level? 7 Have you reviewed 1 Do your competent 1 Do you have a process 1 Do competent authorities 1 Do you proactively use 1 existing best practices authorities have internal in place to request or have established EU resources (e.g. in supervisory and procedures or guidelines provide mutual processes to handle ENISA’s cybersecurity enforcement in place to request assistance through the specific cybersecurity support action) to measures to support mutual assistance from Cybersecurity requests, such as on-site strengthen cross-border national mutual Emergency Mechanism? inspections, off-site mutual assistance in
116. assistance other Member States supervision or targeted supervisory and processes? under NIS2? security audits? enforcement activities? 8 Has your government 1 Are resources 1 Is proportionality taken 1 Are regular evaluations 1 Are lessons learned 1 informally or formally (personnel, budget or into account when conducted to ensure that from previous mutual recognised the need tools) currently allocated allocating resources sufficient and assistance activities to allocate sufficient to mutual assistance (personnel, budget or proportionate resources used to assess and resources to support activities? tools) for mutual (personnel, budget or adjust future resource effective mutual assistance activities? tools) are dedicated to allocations? assistance in mutual assistance supervisory and activities? enforcement actions under NIS2? 9 Are there any formal 1 Have you initiated joint 1 Are common 1 Do you monitor and 1 Are lessons learned and 1 or informal channels supervisory or inspection agreements or evaluate the best practices from joint for sharing information activities with other arrangements in place to effectiveness of joint supervisory actions, or coordinating Member States or conduct joint supervisory supervisory actions, inspections and audits inspections/audits with participated in early- actions, inspections or inspections and audits to actively shared in the other Member States stage coordinated audits, audits with other identify areas for NIS2 Cooperation Group under the NIS2 mutual as part of mutual Member States? improvement? or in other EU networks assistance assistance or to adapt national framework? cooperation efforts? processes? 10 Have you identified 1 Are clear conditions 1 Are clear conditions 1 If considering the refusal 1 If considering the refusal 1 potential situations in established under which established under which of a request, do you have of a request and upon which a request for a mutual assistance a mutual assistance processes to consult the the request of the mutual assistance request may be refused request may be refused other concerned concerned Member might be refused? due to a lack of if it concerns information competent authorities? States, are there competence or because or actions contrary to procedures in place to the request is national security, public consult the European disproportionate to the security or defence Commission and supervisory tasks of the interests? ENISA? competent authority?
117. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
118. 10 – Develop crisis a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 management objective in your NCSS or (formally or informally) defined and mechanism to regularly mechanisms in place to frameworks do you plan to cover it in intended results, guiding documented action plan review and assess your ensure that the action the next edition? principles, or key that includes specific action plan to ensure plan is monitored and activities in your action activities with clear that it is correctly dynamically adapted to plan that contribute to goals, timelines, and prioritized and evolving technological, achieving the objective allocated resources? optimized, including geopolitical and threat in an uncoordinated progress tracking, landscapes? way? performance evaluation, and identification of areas for improvement? 1 Has the need to establish 1 Have you proposed a 1 Is a dedicated cyber 1 Is the national cyber 1 Do you apply foresight 1 a national cyber crisis- national cyber crisis- crisis-management crisis-management techniques and management framework management framework framework established framework regularly integrated innovative been anchored in a outlining key processes, and integrated within reviewed and updated approaches to national strategic or stakeholder roles, your overall national based on stakeholders’ systematically update policy document? responsibilities and crisis-management feedback, lessons your national cyber accountability framework, including learned and international crisis-management structures? business continuity and best practices? framework, ensuring its disaster recovery effectiveness against aspects? emerging and future cyber threats? 2 Is there any formal or 1 Have draft plans, 1 Is cyber crisis 1 Is the integration of 1 Is the alignment 1 informal recognition that coordination guidelines management formally cyber crisis between cyber crisis cyber crisis response or working groups been defined and integrated management into the management and should be coordinated established to explore into the national crisis national crisis general crisis with national crisis- the alignment between governance framework governance framework management management structures? cyber crisis- with clear information regularly reviewed to continuously refined management and on roles and ensure that both through joint exercises, national crisis- responsibilities and systems stay aligned feedback loops and management coordination protocols, when changes occur? scenario-based mechanisms? planning involving
119. including cross-border relevant national- and aspects? EU-level actors? 3 Were initial steps taken to 1 Are predefined incident 1 Do you have structured 1 Are incident response 1 Are incident response 1 introduce predefined response plans for processes to train and plans regularly plans dynamically response plans tailored to various threat scenarios coordinate relevant evaluated and enhanced updated based on different cybersecurity formally established and authorities and based on feedback from predictive insights and threat scenarios? regularly updated? stakeholders for relevant stakeholders lessons learned, effective implementation and international best ensuring continuous of incident response practices? improvement and plans? fostering innovation in cyber crisis management? 4 Is there a preliminary 1 Is there a structured 1 Is there a designated 1 Is there a systematic 1 Is there a flexible, 1 approach to selecting approach that ensures authority with a clear mechanism that ensures dynamic and forwardcompetent authorities for that competent legal mandate and with that competent looking mechanism that managing large-scale authorities are formally adequate and authorities regularly ensures that specialised cybersecurity incidents, nominated and sustainable human, review their legal resources are in place outlining roles and introduced to all relevant financial and technical mandate, resources and for continuous forward responsibilities for public stakeholders and resources, and have capabilities, to maintain planning, threat and private stakeholders actively engage in cyber clear roles and the full alignment of anticipation and and ensuring adequate crisis management with responsibilities been stakeholders with their adaptive planning, and resources for national national actors (e.g. formally established for roles and that roles and cyber crisis security, defence, civil- all stakeholders to responsibilities, through responsibilities are management? protection and law ensure structured and continuous evaluation regularly reviewed and enforcement agencies, efficient collaboration in and adjustment of optimised based on ministries), with the managing large-scale resource adequacy and evolving threats and necessary resources to cybersecurity incidents to guarantee effective lessons learned? fulfil their mandate? and crises? coordination and response during largescale cybersecurity incidents and crises? 5 Is there a common 1 Are cybersecurity crisis 1 Are sector-specific 1 Is there a multi-year 1 Are national 1 understanding among exercises and exercises, including cybersecurity exercise cybersecurity exercise stakeholders of the simulations covering the tabletop and live programme with scenarios and importance and value of strategic, operational simulations, regularly dedicated funding for procedures regularly conducting exercises to and technical levels held at the national design, planning and updated and test and improve national organised nationally, at and/or international execution, including harmonised with other cyber crisis-management least on an ad hoc levels to test crisis procedures to collect, Member States to capabilities? basis? management, assess review and implement reflect technological preparedness, identify feedback to meet advances, evolving gaps and validate participants’ needs? threats, global coordination protocols, developments and
120. with documented integration into outcomes and European crisis stakeholder response mechanisms? involvement? 6 Do you acknowledge the 1 Do you participate in 1 Do you actively engage 1 Do you actively 1 Do you organise or 1 value of participating in cyber crisis- in EU-level, regional or encourage both public actively contribute to the EU-level, regional and management exercises international cyber crisis and private stakeholders organisation of tabletop international exercises at the EU level at least exercises? to participate in EU-level and live simulations at and simulations (e.g. in an observer role? cybersecurity the EU level to lead and Cyber Europe, Blue simulations to test and innovate cross-border OLEx, Locked Shields) optimise coordination cyber crisisfor sharing best practice protocols across sectors management and enhancing and borders? capabilities? cooperation across sectors and borders? 7 Is there an initial 1 Have procedures or 1 Are after-action and 1 Is there an established 1 Are lessons learned 1 recognition of the value of guidance been initiated evaluation reports lessons learned process from cyber crisis systematically gathering to document lessons systematically produced to systematically collect, exercises and reallessons learned from learned from cyber crisis following cyber crisis analyse and integrate world incidents exercises and real-world exercises and integrate exercises and incidents insights from cyber crisis systematically reviewed incidents to improve them into future to document outcomes exercises and incidents and integrated into national cyber crisis- planning efforts? and lessons learned? into national cyber crisis- national cyber crisismanagement management practices? management capabilities? frameworks through formal evaluation cycles and stakeholder consultations? 8 Is the importance of 1 Are frameworks being 1 Is there active 1 Are sector-specific cyber 1 Are insights from 1 sector-specific cyber developed to support engagement with sector crisis plans emerging threats and crisis planning or public– sector-specific cyber representatives, systematically updated technological private coordination crisis plans, aimed at including critical and integrated into the advancements acknowledged in national promoting preparedness operators not regulated broader national cyber systematically strategic documents? in critical sectors and under NIS2, through crisis plan, incorporating leveraged to strengthening public– regular meetings or feedback from both continuously enhance private coordination at forums to public and private sector-specific cyber the operational level? collaboratively develop stakeholders? crisis preparedness and and maintain cyber PPPs? crisis plans, ensuring ongoing coordination between competent authorities and private entities?
121. 9 Is there any formal or 1 Are national guides or 1 Is there a structured 1 Are BRPs regularly 1 Are BRPs 1 informal expectation or draft initiatives available BRP framework in reviewed and updated systematically general awareness that to support critical, place, developed in based on lessons integrated into broader public entities and critical, essential and important consultation with learned from incidents national continuity and essential and important entities in developing relevant stakeholders, and exercises, with resilience planning, entities should maintain business recovery plans based on recognised national authorities ensuring adaptation continuity and recovery (BRPs), including reference models (e.g. providing tailored driven by forward capabilities in the case of references to ISO 22301, NIST guidance to different planning and crosscyber incidents? frameworks such as ISO special publication 800- types of entities? sectoral coordination? 22301, NIST special 34 or the COBIT publication 800-34 or framework), with the control objectives for specified procedures for information and related resumption and technology (COBIT) recovery? framework?
122. NCSS # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R objective
123. 11 – Secure a Do you cover the 1 Have you defined (formally or 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 digital objective in your NCSS or informally) intended results, defined and documented mechanism to regularly mechanisms in place to identity and do you plan to cover it in guiding principles, or key action plan that includes review and assess your ensure that the action build trust in the next edition? activities in your action plan specific activities with action plan to ensure that plan is monitored and digital public that contribute to achieving clear goals, timelines, it is correctly prioritized dynamically adapted to services the objective in an and allocated and optimized, including evolving technological, uncoordinated way? resources? progress tracking, geopolitical and threat performance evaluation, landscapes? and identification of areas for improvement? 1 Has a gap analysis been 1 Have strategic guidelines (e.g. 1 Are cybersecurity 1 Are cross-sectoral 1 Have strategic decisions 1 conducted to identify high-level policies, general policies consistently strategic coordination been taken to ensure specific requirements for principles or technical implemented and efforts in place to allow that digital public transforming public standards) been developed to supported by an continuous feedback, services are secure by administrations and digital ensure cybersecurity, established governance update mechanisms design, to foster a public services? efficiency, accessibility and framework across public and/or framework culture of innovation and compliance with EU standards administrations to formalisation to maintain cybersecurity in public for digital public services? enhance trust in digital the required level of administrations and to public services? cybersecurity ensure that digital public effectiveness and trust in services are driven by digital public services? continuous monitoring and predictive analytics (or similar techniques)? 2 Does your NCSS include 1 Do you have a strategy and/or 1 Are secure and reliable 1 Have you implemented 1 Do you participate in 1 requirements that outline guidelines to develop or digital identity solutions mutual recognition of e- peer reviews as part of high-level security and promote national digital developed with identification means with e-identification schemes, privacy measures to identity systems and trust participation from both other Member States? to maintain high levels of protect sensitive services (e.g. e-signatures, e- public stakeholders (e.g. security, privacy and information in national seals, e-registered delivery cybersecurity and NIS2 interoperability, adapting digital identity systems services, time stamping, supervision authorities, to new technological and ensure reliable website authentication) for the European developments and identification? citizens and businesses that Commission, ENSIA) emerging threats? are in line with European and and private international norms on stakeholders, in line with
124. security, privacy-by-design guidelines to ensure and interoperability? effective cross-border interoperability and robust security and privacy protections? 3 Have you set out data 1 Are high-level policies, 1 Are national policies for 1 Are strategic 1 Are strategic decisions 1 security requirements for general principles or technical data security and coordination efforts in to enhance trust in digital public services in a standards in place to ensure protection implemented place across sectors to digital public services relevant strategic or policy the secure management of and operational across ensure data security in driven by continuous document? sensitive data exchanges in digital public services? digital public services? monitoring and forward digital public services? planning? 4 Have formal discussions or 1 Is there a structured 1 Are public trust surveys 1 Do you implement an 1 practice-sharing sessions approach in place to conducted to assess the adaptive approach to been conducted with key ensure transparent data impact of digital public enhancing data security stakeholders on transparent exchange practices service activities on in digital public data management in digital within digital public citizens’ trust? services? public services? services?
125. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
126. 12 – Establish a Do you cover the 1 Have you defined (formally 1 Do you have a 1 Do you have a formal 1 Do you have 1 national level risk- objective in your NCSS or informally) intended formally defined and mechanism to regularly mechanisms in place to assessment or do you plan to cover results, guiding principles, documented action review and assess your ensure that the action it in the next edition? or key activities in your plan that includes action plan to ensure that it plan is monitored and action plan that contribute specific activities with is correctly prioritized and dynamically adapted to to achieving the objective in clear goals, timelines, optimized, including evolving technological, an uncoordinated way? and allocated progress tracking, geopolitical and threat resources? performance evaluation, and landscapes? identification of areas for improvement? 1 Is there recognition that 1 Has a draft national 1 Is your national cyber 1 Does your national cyber 1 Is your national cyber 1 your NCSS should methodology for cyber risk risk assessment risk assessment risk assessment follow a assessment been methodology aligned methodology ensure framework flexible comprehensive, all- developed or piloted for with internationally coordinated identification enough to adapt to the hazards, risk-based priority sectors, such as recognised standards and management of risks to evolving cybersecurity approach to identifying those listed in Annexes I (e.g. ISO 31000, essential and important threat landscape? and managing and II to NIS2, or CER ISO/IEC 27005) or entities, while also cybersecurity risks? Directive critical entities? ENISA guidance? integrating with other Member States’ risk assessments and critical entity resilience assessments? 2 Has your national 1 Have you established 1 Do formal 1 Is there a structured process 1 Does your national asset 1 regulatory framework processes to ensure that all mechanisms exist to to regularly review and inventory deliver a incorporated relevant stakeholders coordinate asset update the list of relevant complete and detailed requirements for understand their roles and identification and risk entities and associated view of critical entities, identifying critical, responsibilities in identifying assessments across assets to remain aligned covering everything from essential and important these entities and their sectors as part of with the requirements of high-level services to entities? associated assets? your national NIS2 and the CER technical components? resilience and Directive? cybersecurity strategies? 3 Do you ensure that 1 Have procedures been 1 Is there a centralised 1 Is there a mechanism in 1 Are formal procedures in 1 stakeholders are aware established to regularly and regularly updated place to ensure that the place for cross-sectoral
127. that the inventory of compile and update inventory of critical inventory of assets validation, inter-agency critical assets must be inventories of critical assets, assets managed by supporting critical, essential data sharing and continuously updated to including physical, digital the designated and important entities is integration of the asset maintain and hybrid systems, to competent authority? systematically updated? inventory into nationalcomprehensive support national cyber risk and EU-level resilience coverage in the assessments? planning processes? national cyber risk assessment? 4 Have you established 1 Do national initiatives or 1 Is the national cyber 1 Are formal mechanisms in 1 Do you actively 1 high-level requirements guidelines promote the use risk assessment place to ensure that cyber participate in the that mandate the use of of structured methodologies process based on risk assessments are development of scientific and or tools (e.g. threat scientific and regularly updated using scientifically and technological methods modelling, vulnerability technological validated scientific models, technologically (e.g. quantitative risk scanning) in cyber risk methodologies and sector-specific data and grounded cyber risk modelling, threat assessments? applied consistently coordinated cross-sector assessment processes simulations, AI-driven across all relevant approaches? and share best practices analytics) in cyber risk sectors? with other Member management? States? 5 Do relevant 1 Have you initiated 1 Are the results of 1 Are there formal 1 Is resource coordination 1 stakeholders programmes or planning cyber risk mechanisms to coordinate informed by real-time acknowledge that efforts to align resource assessments resources and authorities cyber threat intelligence national cyber risk coordination with cyber risk systematically used to across sectors based on to support flexible and assessment findings assessment findings? guide national cyber risk assessment agile responses to should guide strategic resource planning, outputs and performance evolving threats? resource coordination threat monitoring and indicators? to reduce the likelihood mitigation strategies? and impact of cyber incidents on critical entities, in line with NIS2 and the CER Directive? 6 Is there any informal or 1 Does your national cyber 1 Is there a formal 1 Are lessons learned from 1 Is your national cyber 1 formal procedure risk assessment framework feedback mechanism cyber incidents and risk assessment among national include formal mechanisms to ensure that cyber exercises systematically continuously updated stakeholders to ensure to collect and integrate risk assessments are integrated into national cyber with new inputs, that the evolving cyber lessons learned from cyber updated based on risk assessments through a including emerging threat landscape incidents and exercises? incident notifications, formal review process? threats and lessons informs updates to threat intelligence and learned from cyber national cyber risk lessons learned from incidents and exercises, assessments? exercises? to ensure an accurate reflection of your
128. national cyber risk posture? 7 Do national authorities 1 Are there ongoing initiatives 1 Is the NCSS explicitly 1 Are formal mechanisms in 1 Are national cyber risk engage, even on an ad or documented efforts to based on a place to ensure ongoing assessments regularly 1 hoc basis, in activities systematically align national comprehensive cyber alignment between updated using scenario such as workshops or cybersecurity objectives risk assessment that cybersecurity strategy planning and simulations roundtables to align with national security incorporates national objectives and evolving that account for cybersecurity strategy priorities? security national security risks? geopolitical, objectives with national considerations? technological and hybrid security priorities? threat developments? 8 Are formal or informal 1 Have any formal or informal 1 Are cybersecurity 1 Are cybersecurity 1 Are up-to-date results of 1 practices used to methods been established priorities prioritisation decisions based national cyber risk identify key to prioritise key systematically derived on formal criteria and assessments cybersecurity cybersecurity challenges from national cyber performance indicators, and systematically made challenges through based on the outcomes of risk assessment coordinated across essential available to decisionnational-level cyber risk national cyber risk outcomes and and important entities, makers to support assessments? assessment? integrated into critical sectors and informed cybersecuritystrategic planning and competent authorities? related strategic resource allocation? decisions? 9 Do national 1 Have initial efforts or pilot 1 Are national cyber 1 Are cyber risk assessments 1 Are national cyber risk 1 stakeholders have a projects been launched to risk assessments embedded within national assessments common understanding assess interdependencies conducted regularly planning processes, continuously updated of the importance of and cascading effects and comprehensively, supported by cross-sector using advanced conducting periodic across critical sectors as addressing threats, collaboration and formal methodologies – such cyber risk assessments part of national cyber risk vulnerabilities, review cycles? as real-time data, that address threats, assessment practices? interdependencies simulations and strategic vulnerabilities and and cascading foresight – to anticipate impacts on critical effects? cascading impacts on sectors and essential critical entities, in entities? alignment with NIS2 and the CER Directive? 10 Have competent 1 Are all relevant 1 Are sector-specific 1 Are cyber risk assessments 1 Are sectoral cyber risk 1 authorities and priority stakeholders, including methodologies and formally coordinated across assessments sector entities begun critical entities, digital tools consistently sectors, ensuring data continuously updated collaborating to develop service providers and applied across priority sharing and integration into using real-time threat sector-specific SMEs, actively engaged in sectors, with the national threat landscape intelligence, predictive guidance for cyber risk national and sectoral cyber structured analysis? analytics and assessments under risk assessments to create participation from collaborative NIS2 and the CER a comprehensive threat critical entities, mechanisms with Directive? landscape? service providers and national and cross- SMEs? border stakeholders?
129. 11 Has a plan been 1 Have training programmes, 1 Are tools, training and 1 Are capacity-building 1 Is capacity-building 1 drafted to provide tools, standardised templates or guidance measures integrated into continuously enhanced training and guidance sector-specific tools been systematically national cybersecurity through feedback to support relevant developed or initiated to provided to relevant planning and supported by mechanisms, innovation competent authorities enhance the capacity of competent authorities formal evaluation programmes and and critical, essential competent authorities and and critical, essential mechanisms and cross- lessons learned from and important entities critical, essential and and important entities sectoral coordination? cyber exercises and in conducting cyber risk important entities to conduct under national cyber incidents? assessments? consistent cyber risk oversight and quality assessments? assurance mechanisms? 12 Is there a high-level 1 Do you have a draft 1 Are structured 1 Are formal cooperation 1 Does the national 1 structure or framework that allocates mechanisms in place frameworks in place to framework include an organogram that makes responsibilities to national for coordinated cyber support joint cyber risk advanced tool that clear the roles of and cross-border risk assessments and assessments and enables relevant relevant competent stakeholders for cyber risk mitigation by relevant information sharing among competent authorities authorities and critical, assessment, incident competent authorities relevant competent and critical, essential essential and important handling and operational and critical, essential authorities and critical, and important entities to entities in conducting resilience? and important entities, essential and important conduct cyber risk cyber risk with roles and entities, with responsibilities assessments, aggregate assessments? responsibilities clearly operationalised through results and provide upestablished in formal agreements, joint to-date data for different national policy or protocols or inter-agency management levels, legal frameworks, coordination mechanisms? while ensuring that roles communicated to all and responsibilities are stakeholders and regularly reviewed and supported by shared updated in line with methodologies? evolving threats, lessons learned and strategic foresight? 13 Are there any formal or 1 Have you aligned cyber risk 1 Are cyber risk 1 Are formal mechanisms in 1 Are cyber risk 1 informal practices for assessment outcomes with assessment findings place to ensure that cyber assessment results using cyber risk updates to your NCSS and systematically risk assessment outcomes continuously used in assessment results in with strategic planning or integrated into your directly inform national processes driven by national cybersecurity resource allocation for strategic planning, strategic priorities, resource forward planning to planning and resource cybersecurity risk policy development allocation and the dynamically inform the allocation (Articles 18– management? and capability- development of NCSS and sectoral 20 of NIS2)? building cybersecurity capabilities? frameworks, support programmes? risk-informed resource allocation and enhance the operational resilience and
130. cybersecurity capabilities of critical, essential and important entities?
131. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
132. 13 – Strengthening a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 national objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to cybersecurity or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action governance it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Has a national 1 Is a documented 1 Is a formal governance 1 Are governance 1 Is the governance 1 cybersecurity governance model in framework in place that structures routinely framework regularly governance structure place that clearly clearly sets out roles, reviewed, with updated to address been formally establishes roles, responsibilities and responsibilities aligned emerging risks and designated under the responsibilities, decision- interactions between all across ministries, stakeholders and to Cyber Solidarity Act, making processes and key stakeholders and agencies and sectors integrate foresight NIS2 or another legal coordination organisations? through binding capabilities? cybersecurity mechanisms and mechanisms? framework, with an allocates roles and identified lead authority responsibilities to responsible for competent authorities coordination across (e.g. national competent sectors? authorities, national cybersecurity certification authorities, NCCs), CSIRTs and relevant sectoral stakeholders? 2 1 Are coordination 1 Are there formal 1 Is collaboration 1 Are coordination 1 mechanisms under coordination frameworks institutionalised through mechanisms flexible and development (e.g. draft in place enabling joint activities, incident scalable, adapting to memorandums of structured collaboration exercises or shared new threats, understanding, informal among CSIRTs, single platforms with technologies and crosscommunication points of contact and harmonised procedures? border challenges channels)? competent authorities as
133. defined in Article 13 of through continuous NIS2? improvement?
134. 3 Are there basic 1 Is there an action plan 1 Is NCSS implementation 1 Are planning and 1 Is the strategy 1 planning structures or with timelines and roles managed through a implementation activities implementation at least ad hoc working to support structured central governance body coordinated through continuously monitored, groups overseeing implementation of the with oversight, cross-sector platforms evaluated and optimised NCSS implementation? NCSS? monitoring and reporting and aligned with national using strategic foresight functions? digital policies? and data-driven performance indicators? 4 Are cybersecurity and 1 Are initial efforts in place 1 Are coordination 1 Are dialogue 1 Is coordination driven by 1 sectoral authorities to build bridges between structures operational, mechanisms formalised integrated national risk aware of the need to cybersecurity bodies and ensuring that and aligned with sectoral assessments and collaborate on risk and sector-specific cybersecurity is crisis management or reviewed in light of joint threat management? authorities (e.g. critical embedded in sectoral operational continuity simulations or infrastructure)? regulatory frameworks protocols? multisector threat (e.g. covering transport intelligence? or energy), as per Article 13(4) of NIS2? 5 Have you identified the 1 Have any ad hoc, pilot or 1 Are regular, structured 1 Are the results of 1 Are assessments 1 need to periodically preliminary capability capability assessments capability assessments forward-looking, assess capabilities of assessments been conducted across used to shape national benchmarking against national cybersecurity conducted across national cybersecurity training, staffing and best practices and authorities across relevant national authorities, including the resourcing policies feeding into long-term human, technical and cybersecurity authorities identification and across national resilience and workforce financial dimensions? (e.g. the national prioritisation of capability cybersecurity development planning? cybersecurity certification gaps? authorities? authority for the peerreview exercise)? 6 Are supervisory 1 Have initial steps been 1 Are supervisory tasks 1 Are supervisory tasks 1 Are evaluation practices 1 activities (e.g. taken to explore ways to evaluated across evaluated across sectors (e.g. feedback loops, inspections, review and assess the sectors through through structured peer reviews, crossenforcement actions, performance of structured reviews or reviews or audits, even if sectoral assessments) guidance issuance) supervisory authorities audits, even if limited in limited in scope or regularly refined to systematically recorded based on recorded scope or frequency? frequency? enhance the and tracked? supervisory activities? effectiveness of supervisory authorities over time? 7 Have you started to 1 Is a draft or partial list of 1 Is there a central 1 Is the inventory 1 Is the stakeholder 1 identify national stakeholders maintained inventory of integrated with national landscape dynamically stakeholders and by any coordinating body stakeholders and crisis response planning updated based on policy authorities relevant to or authority? authorities, updated and used to manage shifts, incidents or
135. cybersecurity periodically and used for stakeholder engagement innovation ecosystems governance? coordination and and task allocation? to ensure full inclusion? communications?
136. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
137. 14 - Establish a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cybersecurity risk- objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to management or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action measures it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Have you established 1 Are there documented 1 Are cybersecurity 1 Are cybersecurity 1 Are adaptive security 1 any general sector-specific guidelines requirements for controls for operational models or threatcybersecurity or templates for essential essential and important and service-delivery informed architectures in requirements for and important entities on entities formally systems systematically place to ensure the essential and important implementing integrated into national monitored, assessed and ongoing protection of entities to protect their cybersecurity protections regulations or enforced across sectors, operational and serviceoperational and for operational and compliance with coordination delivery systems, service-delivery service-delivery frameworks? mechanisms in place? adjusted in near real systems? systems? time? 2 Is there a general 1 Do incident response 1 Are the incident 1 Are lessons learned from 1 Are predictive analytics 1 expectation that procedures and business response plans of critical past incidents integrated or simulations used to essential and important continuity plans exist for entities aligned with into improved preventive anticipate and reduce entities will report and essential and important national cyber crisis- and mitigation measures the potential impact of respond to incidents, entities, with minimal management plans? nationally? incidents across even if they are not implementation or sectors? fully formalised? testing? 3 Have you formulated 1 Do you support national 1 Do essential and 1 Are essential and 1 Are dynamic 1 any high-level initiatives that encourage important entities take important entities assessments used to recommendations for the adoption of into account recognised required to align with continuously validate essential and important cybersecurity tools (e.g. cybersecurity recognised cybersecurity whether technologies in entities to use state-of- zero-trust strategies, frameworks that frameworks that use by essential and the-art cybersecurity endpoint detection and incorporate state-of-the- incorporate state-of-the- important entities remain technologies and response, and security art measures? art measures? state-of-the-art in light of practices? information and event evolving threats?
138. management) by essential and important entities? 4 Are basic risk 1 Do you support essential 1 Are risk assessments 1 Do you conduct sector- 1 Is there an established, 1 assessment templates and important entities in used as the basis for wide risk exposure data-driven approach to or models available for conducting formal cyber selecting and analyses and share them dynamically adjusting entities to evaluate risk assessments tailored implementing security with essential and risk-management cyber threats? to their sector? controls? important entities to measures based on support harmonised threat intelligence and responses? exposure trends? 5 Does the overall risk 1 Do you tailor guidance to 1 Are regulatory 1 Are impact-based risk 1 Is a differentiated and 1 management approach distinguish between requirements risk based assessments used to predictive regulatory consider or plan to requirements for SMEs and scaled according to prioritise regulatory focus approach applied based consider the different and large entities in the size and systemic and resource allocation on impact potential, sizes of essential and terms of expected relevance of each to higher-risk essential business model important entities in controls? essential and important and important entities? evolution and entity designing risk- entity? scale? management measures? 6 Are any EU or 1 Are national regulations 1 Do national 1 Are public–private 1 Are regulatory 1 international or procurement practices cybersecurity audits or dialogues used to adapt frameworks continuously cybersecurity encouraging voluntary reports assess both the regulatory guidance updated to reflect both standards or norms use of EU/international implementation of based on industry cost-effective practices (e.g. ISO/IEC 27001, standards (e.g. standards and the cost- feedback regarding and emerging global the Cybersecurity Act, European effectiveness of security feasibility and cost– standards? open-source initiatives) standardisation measures? benefit alignment? referenced in national organisations)? guidance without mandatory enforcement? 7 Are there mechanisms 1 Do you recommend 1 Have you established a 1 Are feedback loops in 1 Are forward-looking 1 available for entities to maturity models or gap national framework to place between regulators technologies (e.g. AI for self-assess and analysis tools to evaluate and improve and entities to refine risk modelling) used to improve their own essential and important the relevance and practices and policies inform continuous cybersecurity posture? entities for periodic self- practicability of based on real-world adaptation and evaluation? cybersecurity measures outcomes? improvement in required from essential cybersecurity and important entities? measures? 8 Have you proposed 1 Do you provide baseline 1 Have you established 1 Have you established 1 Do you continuously 1 comprehensive non- guidance for the technical, operational different requirements monitor emerging binding implementation of and organisational based on system technologies and recommendations for technical, operational requirements for sensitivity, sector or evolving threat
139. essential and important and organisational essential and important threat exposure and landscapes to adapt and entities to comply with measures by essential entities in alignment with harmonised them with optimise minimum the risk-management and important entities to European and requirements set up in cybersecurity requirements set out in comply with the risk- international standards other sectoral regulations requirements, thereby Article 21 of NIS2? management and best practices? (e.g. DORA)? enhancing the resilience requirements set out in of essential and Article 21 of NIS2? important entities against future threats? 9 Have you conducted 1 Have relevant 1 Do you enforce 1 Is there a process in 1 Do you actively consult 1 consultations with stakeholders been obligatory requirements place for regularly with other Member representatives of identified and formally for digital service reviewing and updating States with the aim essential and important tasked with controlling providers as outlined in the baseline being to harmonise entities and relevant whether baseline Commission cybersecurity measures baseline cybersecurity sectoral associations to cybersecurity measures Implementing for essential and measures, leverage best incorporate their inputs are properly applied by Regulation (EU) important entities? practice and anticipate into the baseline essential and important 2024/2690 on emerging challenges? cybersecurity entities? cybersecurity riskrequirements? management measures under Directive (EU) 2022/2555?
140. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
141. 15 – Establish a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 incident reporting objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to mechanisms or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Have preliminary 1 Has a legal framework 1 Are standardised 1 Are mandatory incident- 1 Does the legal reporting 1 reporting procedures been adopted to regulate reporting templates (e.g. reporting mechanisms framework include been drafted to support voluntary structured the non-mandatory (e.g. procedures and innovative mechanisms structured voluntary incident reporting, reporting templates templates) regularly for secure tracking and incident reporting under covering non-significant developed by the NIS2 evaluated and audited to verification of incident NIS2, including incidents, cyber threats Cooperation Group) improve data quality, reports, enhancing templates for reporting and near misses? available for essential incorporating insights transparency and incidents, cyber threats and important entities to from NIS2 peer reviews, reliability through and near misses? support prompt and best practice guides and lessons learned? structured mandatory technological incident notification? developments? 2 Do you organise 1 Have you developed 1 Have you deployed a 1 Do you regularly review 1 Have you implemented 1 consultations with sector-specific centralised reporting and update templates advanced analytical sector representatives instructions to guide platform offering and instructions based tools (e.g. algorithms, to develop and refine entities to comply with standardised templates on industry feedback to data platforms) to reporting templates, incident-reporting for submitting cross- improve reporting improve data quality and leveraging the support requirements? border impact practices including cross- support real-time and updates provided assessments and for border reporting assessment of crossby the NIS2 essential and important procedures and data border impacts? Cooperation Group’s entities to submit quality? working session on accurate and compliant incident reporting? incident notifications? 3 Are requirements for 1 Are there channels 1 Do you have a secure, 1 Are incident reporting 1 Do incident reporting 1 tools to facilitate allowing essential and centralised platform that tools regularly evaluated tools use automated incident reporting being important entities and allows entities to submit and audited to improve technologies, such as
142. collected from other entities to submit incident notifications in a data quality, machine learning, to important and essential information about structured way, within incorporating insights refine reports submitted entities? significant incidents to the time frames from stakeholders (e.g. to CSIRTs, supporting competent authorities established by NIS2 and important and essential data validation and within the required time providing your CSIRTs entities, CSIRTs) and analysis for efficient frames or under with real-time alerts for best practices (e.g. from incident management voluntary incident individual incidents? NIS2 peer reviews or and strategic response reporting? guidance)? planning? 4 Have definitions and 1 Is there a set of clear 1 Have you incorporated 1 Do you regularly review 1 Have you used 1 criteria been criteria specifying the NIS2 definition of a threat assessments and advanced data analytics established to identify thresholds for severity ‘significant’ incident (i.e. stakeholder feedback to technologies to ‘significant’ incidents, and scope, particularly any incident causing or refine the criteria for continuously refine including factors such for digital infrastructure, capable of causing identifying significant incident classification as geographical ICT service management severe operational incidents, in line with parameters and support spread, duration, and digital providers, to disruption, financial loss evolving industry timely, informed impact severity and classify incidents as or considerable material standards and best decision-making? cross-border ‘significant’, including or non-material damage) practices? relevance? considerations of impact, into your national duration and cross- frameworks to ensure border implications? consistent assessment and notification procedures by entities? 5 Have you conducted 1 Have you developed and 1 Do you actively 1 Are your guidelines and 1 Have you deployed 1 initial training sessions made easily accessible participate in public and training programmes advanced educational for relevant entities to guidelines to support sector-specific events to regularly assessed and tools (e.g. interactive eclarify responsibilities relevant entities in raise awareness among updated based on learning platforms) that regarding mandatory meeting their reporting relevant entities about feedback from relevant incorporate new and voluntary reporting obligations? mandatory and voluntary entities? compliance and of incidents? incident reporting reporting requirements? obligations? 6 Have you conducted 1 Have you developed and 1 Have you developed 1 Do you regularly refine 1 Do you use advanced 1 workshops to help made accessible clear and consistent criteria for assessing techniques, such as entities assess and flag practical guidelines to criteria for entities to cross-sectoral and cross- predictive analytics, to incidents with potential help relevant entities assess and report cross- border impacts based on support dynamic cross-sectoral or cross- assess and report sectoral or cross-border feedback from reporting assessments of crossborder impact? potential cross-sectoral impacts in incident entities? border impacts in or cross-border impacts notifications? incident reporting? in incident notifications? 7 Have you engaged in 1 Have national CSIRTs 1 Have you implemented 1 Are the competencies of 1 Do designated CSIRTs 1 consultations with and sectoral authorities a centralised sectoral authorities and competent national CSIRTs and been formally tasked communication system regularly reviewed, and authorities use adaptive sectoral competent with receiving and linking CSIRTs and are new relevant technologies (e.g.
143. authorities to identify processing incident sectoral competent authorities identified to dynamic data the stakeholders who notifications and authorities with maintain an up-to-date monitoring) to improve will be responsible for providing stakeholder standardised procedures and effective stakeholder the responsiveness to receiving and consultations? for incident reporting network? incident reports? processing incident and processing? notifications and for stakeholder consultations? 8 Have you established 1 Have procedures and 1 Do you use 1 Do you regularly 1 Do you use automation 1 basic communication standard operating standardised evaluate and update and real-time analytics channels and protocols been adopted communication communication protocols tools to enhance rapid, coordination between to set out communication protocols and shared between competent efficient information competent authorities responsibilities and platforms to enable authorities and CSIRTs exchange and incident and CSIRTs to comply ensure rapid, efficient, timely and incorporating feedback routing between with reporting coordinated sharing of structured exchange of mechanisms to assess competent authorities obligations under cybersecurity incident cybersecurity incident incident report quality and CSIRTs? relevant legislation reports between CSIRTs information among and adapt to evolving (e.g. the GDPR, and competent competent authorities, operational and DORA)? authorities? CSIRTs and regulators? technological developments? 9 Have you assessed all 1 Have you established 1 Have structured 1 Do you regularly review 1 Do you use predictive 1 potential counterparts and documented protocols and and optimise the analytics, automation or of your national single processes ensuring communication processes and tools similar technologies to point of contact and the efficient information flows platforms been used by the single point enhance the single point expected information between the national implemented to ensure of contact to improve its of contact’s efficiency in flows to set up single point of contact that the single point of ability to handle and disseminating incident processes for receiving and other relevant contact can manage and disseminate incident information and and disseminating stakeholders (e.g. distribute incident data information? coordinating response incident information CSIRTs, sectoral accurately and in a efforts? promptly and competent authorities, timely manner? accurately? ENISA, the European Commission)? 10 Has the development 1 Have guidelines been 1 Do you use 1 Do you regularly 1 Do you use adaptive 1 of protocols for timely developed to coordinate standardised procedures evaluate and update technologies to support information sharing information flows and communication information-sharing real-time information with single points of between single points of tools to enable the protocols with the single sharing and contact during cross- contact during cross- seamless exchange of point of contact to collaboration, enhancing border or cross-sector border or cross-sector incident data between improve its effectiveness the single point of incidents been incidents? single points of contact in cross-border and contact’s ability to initiated? during cross-border and cross-sector incident manage cross-sector cross-sector incidents? coordination? and cross-border incidents effectively?
144. 11 Is there an ongoing 1 Have guidelines been 1 Are data analysis and 1 Are data aggregation and 1 Are adaptive data 1 initiative aimed at using developed for compiling aggregation systems in analysis processes analytics platforms in aggregated incident and analysing incident place to support cross- regularly reviewed and place that use machine data to enhance data to identify trends sectoral risk optimised to align with learning to generate national situational that inform national assessments and inform national cybersecurity real-time insights into awareness, sectoral cybersecurity planning? national cybersecurity and resilience emerging threats and risk assessments and planning? objectives? support strategic strategic planning? decision-making? 12 Are single points of 1 Have guidelines been 1 Do you submit reports to 1 Are lessons learned from 1 Is there a data-driven 1 contact and national developed to assist CIRAS on a regular past incidents integrated regulatory approach that authorities aware of the relevant national entities basis, at least every into future reporting and utilises insights from Cybersecurity Incident in understanding and three months, to response strategies, with CIRAS to inform national Reporting and Analysis effectively utilising maintain consistent and feedback loops cybersecurity policies System (CIRAS) and CIRAS for incident up-to-date incident established to and strategies? its capabilities for reporting? tracking? continuously improve facilitating structured CIRAS utilisation? incident reporting and analysis?
145. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
146. 16 – Balance a Do you cover the 1 Have you defined (formally or 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 security with objective in your informally) intended results, defined and documented mechanism to regularly mechanisms in place to privacy NCSS or do you plan guiding principles, or key action plan that includes review and assess your ensure that the action to cover it in the next activities in your action plan that specific activities with action plan to ensure that plan is monitored and edition? contribute to achieving the clear goals, timelines, it is correctly prioritized dynamically adapted to objective in an uncoordinated and allocated and optimized, including evolving technological, way? resources? progress tracking, geopolitical and threat performance evaluation, landscapes? and identification of areas for improvement? 1 Have you considered 1 Have steps been taken to draft 1 Has your NCSS 1 Do you regularly update 1 Does the NCSS include 1 incorporating the EU’s guidelines, policies or strategies incorporated EU data your NCSS to reflect all dynamic strategies to regulatory measures within your NCSS that protection laws and of the changes to the adaptively integrate data and privacy-by-design incorporate initial measures of applicable national data relevant regulatory tools protection principles, and data protection privacy-by-design and privacy- protection legislation to provided by the EU guided by regulatory principles into your by-default principles using EU ensure that through collaborative advancements, NCSS? regulatory tools? cybersecurity actions frameworks with stakeholder input and respect privacy rights stakeholders to emerging threats and and include safeguards systematically implement technologies? such as data GDPR/LED data minimisation and access protection principles? controls? 2 Have you considered 1 Are initial measures to 1 Are privacy-by-design 1 Do you conduct regular 1 Are adaptive measures, 1 integrating privacy- incorporate privacy-by-design and data protection reviews of cybersecurity such as real-time by-design, privacy-by- and privacy-by-default principles fully integrated frameworks to ensure privacy impact default and data principles in your cybersecurity into the standard ongoing compliance with assessments and protection principles frameworks under way, even if operating procedures of data protection automated compliance into your limited in scale? all cybersecurity regulations, refining checks, implemented to cybersecurity frameworks? processes based on continually improve initiatives? emerging threats and privacy and data technologies? protection integration in
147. your cybersecurity frameworks? 3 Does your NCSS 1 Have initial frameworks been 1 Are regular joint working 1 Are coordination 1 Are adaptive 1 include plans to set created to coordinate group meetings in place processes between collaboration tools in up coordination cybersecurity and data within the NCSS to national cybersecurity place, such as real-time structures, such as protection authorities in line with ensure that authorities and data data-sharing platforms, joint working groups, NIS2 and GDPR/LED cybersecurity measures protection authorities implemented within joint between requirements? comply with the systematically evaluated working groups to cybersecurity and GDPR/LED and and refined within your continuously enhance data protection applicable national data NCSS to enhance the efficiency, authorities? protection legislation? alignment and ensure responsiveness and compliance with NIS2, alignment of the GDPR/LED and cybersecurity and data applicable national data protection initiatives? protection legislation? 4 Have you conducted 1 Have you identified key national 1 Are structured 1 Do you regularly assess 1 Are technical and 1 studies or analyses to stakeholders to contribute to the frameworks in place and optimise frameworks organisational measures identify areas for enhancement of the protection within your NCSS to to ensure the consistent (e.g. encrypted logging, improvement in of citizens’ privacy within ensure that privacy is prioritisation of privacy anonymised threat protecting citizens’ cybersecurity? consistently prioritised within national intelligence sharing, privacy rights? across all cybersecurity cybersecurity efforts? privacy-compliant measures and activities? monitoring) systematically promoted and integrated into cybersecurity practices and frameworks? 5 Is there an initial effort 1 Have you piloted any national- 1 Are national-level 1 Is there an established 1 Is your country 1 under way to develop level guidance or frameworks to guidance documents process to systematically positioning itself as a guidance or support privacy-compliant and frameworks actively integrate lessons learned leader in EU forums and frameworks to cybersecurity implementation? published and from domestic and discussions on good support the disseminated to support international privacy- practices in developing implementation of privacy-compliant focused cybersecurity and distributing privacy-respectful cybersecurity initiatives into national guidance supporting cybersecurity implementation? frameworks? GDPR-/LED-compliant solutions? cybersecurity solutions? 6 Have you considered 1 Have you started to promote 1 Are technical and 1 Are certifications (e.g. 1 Are innovative solutions, 1 the importance of policies that encourage public organisational measures ISO/IEC 27701:2019) such as real-time data adopting technical and private entities to adopt actively adopted to meet promoted within a formal protection and adaptive and organisational technical and organisational both privacy and cross-sectoral framework compliance monitoring, measures that measures that align with EU cybersecurity standards that incorporates employed to address the balance privacy and cybersecurity (e.g. anonymised threat performance monitoring continuously optimise between privacy and requirements such as intelligence sharing)? the balance between
148. cybersecurity encryption and privacy- and regular feedback privacy and requirements? compliant monitoring? loops? cybersecurity? 7 Have you discussed 1 Have initial requirements been 1 Have you incorporated 1 Are DPIA practices 1 Are adaptive 1 with relevant established to conduct DPIAs the DPIAs as an integral regularly reviewed and technologies deployed stakeholders (e.g. law for evaluating personal data part of the NCSS enhanced through to support DPIA enforcement processing risks within development process, stakeholder consultations processes and enhance agencies, data cybersecurity policies? ensuring compliance to ensure alignment with their effectiveness in protection agencies) and risk mitigation in current data protection managing evolving the incorporation of data handling? requirements? personal data protection data protection risks? impact assessments (DPIAs) as a standard practice for assessing data protection risks in cybersecurity initiatives? 8 Have initial oversight 1 Has a responsible stakeholder 1 Are oversight 1 Are sector-specific 1 Do you have 1 mechanisms been been designated to oversee mechanisms established cybersecurity policies mechanisms in place to considered to assess and assess the impact of and functioning to and standards monitor the latest the impact of national national cybersecurity practices regularly assess and systematically reviewed technological cybersecurity and legal frameworks on address the impact of and updated to ensure developments in order to practices and legal privacy and data protection? national cybersecurity the integration of privacy adapt relevant privacy frameworks on practices and legal and data protection and data protection privacy and data frameworks on privacy considerations, guidelines and legal protection? and data protection? incorporating obligations? stakeholders’ feedback and best practices? 9 Have you taken initial 1 Have you identified key national 1 Are policies in place for 1 Are PET initiatives 1 Is the participation in 1 steps to support R & stakeholders for R & D efforts the adoption of PETs for continuously evaluated, and the promotion of D or the adoption of on the topic of PETs? public and private incorporating PET R & D driven by privacy-enhancing sectors? stakeholders’ feedback continuous innovation, technologies (PETs), to improve and support leveraging emerging such as frameworks and technologies and anonymisation adoption? strategic foresight to techniques and anticipate future needs secure multi-party and proactively advance computation in the solutions? public and private sectors? 10 Is there an initial plan 1 Have initial strategies been 1 Are privacy and data 1 Are sector-specific 1 Are advanced 1 to introduce developed to incorporate protection cybersecurity policies technologies, such as
149. preliminary privacy- privacy and data protection considerations fully regularly reviewed and adaptive solutions with focused frameworks measures into cybersecurity integrated into sector- optimised, incorporating real-time monitoring, into cybersecurity standards for sectors managing specific cybersecurity audits and stakeholder deployed to enhance policies for sectors particularly sensitive personal policies to ensure feedback loops, to privacy and data handling sensitive data (special categories of data consistent embedding ensure effective protection integration personal data, such per the GDPR), in alignment across cybersecurity integration of privacy and across sector-specific as health, finance and with the GDPR/LED and measures? data protection? cybersecurity initiatives? identity data? applicable national legislation?
150. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
151. 17 – Improve the a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cybersecurity of the objective in your NCSS (formally or informally) defined and documented mechanism to regularly mechanisms in place to supply chain or do you plan to cover intended results, guiding action plan that includes review and assess your ensure that the action it in the next edition? principles, or key specific activities with action plan to ensure that plan is monitored and activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Do you have any 1 Have you developed an 1 Have you performed a 1 Is the supplier risk 1 Do you proactively use 1 informal or formal plans initial framework or draft national-level risk assessment framework real-time intelligence, to evaluate supplier risk criteria to assess the risk assessment (services, regularly updated and EU warnings and and consider criteria for profile of ICT suppliers, technologies and used in national emerging threat the assessment of including geopolitical, products) based on a procurement policies and indicators to adapt the critical and high-risk legal, sector-specific and formal framework for regulations to restrict or supplier evaluation ICT suppliers? cybersecurity-related evaluating high-risk exclude high-risk framework, enforce factors? suppliers, and are suppliers from critical ICT responsive restrictions essential and important supply chains, based on and mandate entities required to national and EU- cybersecurity-related assess suppliers coordinated risk procurement accordingly, with assessments? requirements to mitigate national guidance and evolving supply chain oversight in place? risks? 2 Have you begun to 1 Have you created initial 1 Are policies on strategic 1 Have you 1 Do you dynamically 1 assess strategic policies or frameworks to dependency and institutionalised regular monitor and respond to dependencies in ICT support multi-vendor supplier diversification reviews of supplier strategic dependency supply chains or strategies and formally adopted and diversification and risks by adapting explored the feasibility considered thresholds for supported by operational strategic dependency supplier diversification of developing a supplier diversification mechanisms (e.g. risks, including applying policies (e.g. national-level multi- based on factors such as thresholds, criteria or specific thresholds (e.g. nearshoring, dual vendor strategy? market share or incentives), and are > 50 % market share or sourcing), promoting geopolitical risks? critical entities engaged geopolitical exposure) multi-vendor resilience and established across entities and
152. in applying these collaboration with entities incentivising innovation measures? for implementing and redundancy? mitigation strategies? 3 Have you performed a 1 Are initial guidelines or 1 Have you published 1 Are supply chain security 1 Do you actively 1 study on cybersecurity draft baseline security national guidance for requirements embedded contribute to and align good practices for requirements for supply supply chain security? across sectors and with international and supply chain chains under harmonised with EU- EU efforts on supply management that is development based on wide and international chain cyber resilience? used by procurement in European or international standards (e.g. ISO/IEC various industry standards? 27001)? segments and/or in the public sector? 4 Have you informally or 1 Do you 1 Do you have national 1 Are supplier compliance 1 Is the implementation of 1 officially acknowledged encourage/enforce any requirements or and effectiveness risk measures by the importance of requirements, pilots or incentives for critical monitored systematically suppliers regularly ensuring that critical sectoral efforts to suppliers to apply through audits and reviewed and adjusted suppliers implement promote baseline cybersecurity risk reports? based on evolving supply chain risk cybersecurity measures measures? threats and sector measures? for critical suppliers? needs? 5 Have you identified the 1 Are initial public 1 Is there comprehensive, 1 Is public guidance for 1 Is public guidance for 1 need for public guidance materials or regularly updated public SMEs co-developed or SMEs continuously guidance on supply awareness campaigns guidance tailored to validated with refined based on chain risk management targeting SMEs being SMEs on managing stakeholders and linked emerging risks, SMEs’ for SMEs? developed or supply chain to sector-specific or EU- feedback and lessons disseminated? cybersecurity risks? level guidance? learned from incidents and audits? 6 Do you actively 1 1 participate in the design and implementation of the EU cybersecurity certification framework and the development and/or maintenance of EU cybersecurity certification schemes for ICT digital products, services and processes, as established in the Cybersecurity Act (e.g. participation in the European Cybersecurity Certification Group,
153. promotion of technical standards and procedures for ICT product/service security)? 7 Have you initiated 1 Have you engaged 1 Is there structured 1 Do you contribute to EU- 1 Have you established 1 discussions on relevant stakeholders at cooperation and data level risk assessments to continuous collaboration identified ICT supply EU-level forums in ICT sharing across agencies promote inter-agency with EU-level forums chain risks at EU-level supply chain risk and national and cross-sector and programmes to forums? assessment through mechanisms (e.g. collaboration on ICT strengthen ICT supply shared lessons learned? covering cybersecurity, supply chain security? chain risk mitigation and procurement and critical awareness? infrastructure) to coordinate risk assessments and ICT supply chain incident collection and analysis, in line with Article 29 of NIS2? 8 Have you recognised 1 Have you started adding 1 Do you consistently 1 Have you aligned 1 Do you lead or co-lead 1 the need for secure ICT basic cybersecurity apply cybersecurity rules national procurement EU-wide initiatives to supply chains and requirements to ICT in procurement policies with EU strengthen supply chain begun identifying ways procurement processes processes, support recommendations and security, drive innovation to include cybersecurity and engaged with EU SMEs in doing so and promoted secure and update strategies in public procurement supply chain initiatives? cooperate with EU solutions across all based on new threats? processes? programmes in order to sectors? achieve them? 9 Have you 1 Have you started 1 Do you ensure regular 1 Have you established 1 Do you lead or co-lead 1 acknowledged the participating in representation in formal mechanisms to initiatives to shape relevance of standards, standardisation and relevant standardisation maintain and contribute international certification certification and certification activities at and certification bodies, to certification schemes and standards policies, secure-by-design the EU or international integrate vulnerability and vulnerability proactively coordinate principles for ICT levels, and initiated information into national assessments, while vulnerability information supply chain security coordination efforts supply chain risk supporting sharing between and begun identifying among market processes and promote multistakeholder stakeholders or foster relevant forums and surveillance, industry open standards and collaboration to apply innovation in secure-bystakeholders? and researchers on secure-by-design open standards and design practices, vulnerability practices across ensure coherence with promoting them as a discussions? sectors? EU frameworks? national norm for ICT procurement and supply chain resilience?
154. 10 Is there a national 1 Is the directory 1 directory of critical dynamically maintained suppliers used to inform using real-time updates, policy decisions, risk stakeholder inputs and assessments and threat intelligence incident response feeds? coordination? 11 Do you plan or pilot 1 Do you perform 1 Do you have national 1 Do you integrate testing 1 Do you continuously 1 structured testing structured testing (e.g. frameworks that (e.g. stress testing, improve the structured activities (e.g. stress stress testing, regularly conduct sandboxes) into the testing activities (e.g. testing, sandboxes) sandboxes) to validate structured testing procurement, certification stress testing, specifically targeting the resilience and activities (e.g. stress or operational life cycle sandboxes) based on critical sectors or security of supply chain testing, sandboxes) with of critical systems and feedback, simulations, suppliers? and ICT relevant entities and test results into national emerging risks and products/services? document lessons preparedness plans and international learned? supply chain policies? collaboration?
155. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
156. 18 – Protect critical a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 sectors objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Have initial steps been 1 Has a comprehensive 1 Is global governance 1 Are there any 1 Does the classification 1 taken to establish an inventory and (stakeholders’ roles and established mechanisms framework incorporate inventory and classification of essential responsibilities) clearly to regularly update and emerging data analytics classification system and important entities established to ensure refine the inventory and and technologies to for essential and and critical assets been the consistent classification system, enhance the important entities and completed to identify application of protective ensuring that it stays understanding and critical assets in line those that have a measures across aligned with national protection of essential with Annexes I and II significant impact on essential and important security needs and and important entities to NIS2 (e.g. national security and entities and high-priority priorities? and critical assets? identifying additional public safety? assets? sectors and defining classification or setting up a registration mechanism)? 2 Have you started the 1 Are there collaborative 1 Are these collaborative 1 Is there regular 1 Do these collaborative 1 creation of mechanisms in place, platforms operational, evaluation and structures employ collaborative platforms such as PPPs and with active participation improvement of these advanced between competent working groups on from both competent collaborative communication tools authorities and private critical information authorities and private mechanisms to ensure and strategies to sector operators, infrastructure protection, entities to enhance that they effectively proactively manage laying the foundation to engage stakeholders? security efforts within address the shared risks, leveraging realfor formal essential and important security needs of time data and insights cooperation? entities? essential and important for increased resilience? entities?
157. 3 Have you identified 1 Have sector-specific 1 Have sector-specific 1 Are sector-specific 1 Do you use foresight 1 the unique security policies and guidelines security policies, security policies and methodologies such as needs of essential and been developed to baselines and guidelines baselines regularly predictive analytics and important entities as ensure the availability, been implemented reviewed and updated to threat intelligence to defined in Annexes I integrity and across essential and address evolving regularly update sectorand II to NIS2? confidentiality of services important entities, with cybersecurity needs and specific security policies, in essential and monitoring and risks? anticipating emerging important entities? governance in place? risks and technological changes? 4 Is there informal or 0 Have specific action 0 Are protective measures 0 Are cross-sector 0 Are comprehensive 0 official recognition plans been established for undersea collaboration frameworks strategies in place that within your NCSS of to address the communications cables in place (e.g. involving leverage global insights the importance of cybersecurity needs of implemented and digital infrastructure, and best practices to protecting undersea undersea integrated into broader transport and public continuously adapt and communications communications cables, digital resilience administration) to support enhance cybersecurity cables as critical in line with sector- strategies? regular reviews of and measures for the public components of global specific guidelines? joint efforts to protect core of the internet, digital infrastructure undersea particularly undersea and connectivity? communications cables communications cables? as essential components of global connectivity? 5 Has the protection of 1 Have specific measures 1 Are comprehensive 1 Are performance 1 Are predictive analytics 1 foundational internet been established to protective measures for monitoring mechanisms and collaborative infrastructure (e.g. the protect foundational foundational in place to regularly platforms used to domain name system, internet infrastructure infrastructure elements assess and update dynamically refine border gateway through coordinated developed and protection strategies for protection measures for protocol routing, efforts involving relevant systematically foundational internet foundational internet internet exchange sectors and cross-border implemented across infrastructure? infrastructure, fostering points and time cooperation? relevant sectors, proactive resilience synchronisation supported by strategies against services) been governance frameworks emerging threats? incorporated into the coordinating NCSS? cybersecurity and physical resilience efforts?
158. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
159. 19 – Establish a a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 Coordinated objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to Vulnerability NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action Disclosure (CVD) to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and policy edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Have you taken the 1 Does your national CVD 1 Does your national CVD 1 Has your national CVD 1 Are processes in place 1 first steps to establish approach designate a policy include a implementation included to adapt the national a national CVD policy coordinating authority structured process for awareness campaigns to CVD policy to emerging and supporting (e.g. a CSIRT) and reporting vulnerabilities, reach NIS2 entities threats and legislative framework? establish its role and provide mechanisms for and/or incentives to changes? responsibilities as disclosure (including foster collaboration regards vulnerability anonymous options) and among stakeholders and reports? specify timelines for researchers? response and remediation that balance urgency, transparency and cybersecurity? 2 Do you recognise the 1 Have you published 1 Does your national CVD 1 Do you regularly review 1 Are there processes in 1 need to adopt guidelines for policy include provisions and improve protective place to predict and protective measures to cybersecurity for limited liability or measures or guidelines address upcoming legal prevent the researchers, including ‘safe harbour’ for that prevent the implications (stemming prosecution of acceptable and cybersecurity prosecution of from new regulations or cybersecurity unacceptable researchers acting in cybersecurity new technologies) researchers acting in vulnerability discovery good faith? researchers in order to affecting cybersecurity good faith? methods? optimise their researchers and CVD effectiveness? policies? 3 Have you identified 1 Do you provide 1 Have you adopted tools 1 Have you implemented 1 Do you regularly monitor 1 suitable technical tools guidelines for submitting (e.g. dedicated secure feedback mechanisms to the latest technology for secure and trusted vulnerability reports in a portals, validation improve the advancements and trusted and secure way systems) to facilitate cybersecurity and assess how they could
160. handling of (e.g. through a specific trusted and secure reliability of tools used for contribute to improving vulnerability reports? portal)? vulnerability disclosure handling vulnerability your CVD tools and with adequate reports? processes? anonymity and data protection mechanisms? 4 Have you framed 1 Do you promote the 1 Do you offer incentives 1 Do you promote CVD 1 Have you participated in 1 general conditions to adoption of CVD policies (e.g. financial rewards, practices among public international or EU-level promote safe and or bug bounty recognition) to and private researchers initiatives to encourage responsible programmes by essential encourage cybersecurity with the support of cybersecurity vulnerability research? and important entities? researchers to research programmes researchers to engage participate in CVD (e.g. Horizon Europe, the in CVD programmes activities? digital Europe (e.g. the European programme)? Commission’s free and open-source software auditing project)? 5 Are you planning to 1 Do you encourage 1 Does your competent 1 Does your competent 1 Do you actively support 1 actively consult with private sector entities authority or team (e.g. authority or team (e.g. or lead a broader the European (e.g. suppliers of network your CSIRT) actively your CSIRT) actively dialogue in EU and Vulnerability and information systems contribute to the cooperate with other international forums Database? or manufacturers) and European Vulnerability Member States’ (e.g. the CSIRTs cybersecurity Database? competent authorities or Network, the NIS2 researchers to share teams on CVD through Cooperation Group) on information in the official EU channels (e.g. vulnerability handling European Vulnerability the CSIRTs Network)? and management good Database? practices and/or share and improve protective measures for cybersecurity researchers?
161. NCSS objective # Level 1 R Level 2 R Level 3 R Level 4 R Level 5 R
162. 20 – Promote active a Do you cover the 1 Have you defined 1 Do you have a formally 1 Do you have a formal 1 Do you have 1 cyber protection objective in your (formally or informally) defined and documented mechanism to regularly mechanisms in place to NCSS or do you plan intended results, guiding action plan that includes review and assess your ensure that the action to cover it in the next principles, or key specific activities with action plan to ensure that plan is monitored and edition? activities in your action clear goals, timelines, it is correctly prioritized dynamically adapted to plan that contribute to and allocated and optimized, including evolving technological, achieving the objective in resources? progress tracking, geopolitical and threat an uncoordinated way? performance evaluation, landscapes? and identification of areas for improvement? 1 Are there unofficial or 1 Have you identified key 1 Have ACP policies been 1 Are ACP policies 1 Are ACP policies 1 formal efforts to stakeholders from the adopted under your regularly evaluated and continuously updated to promote ACP as part public and private NCSS and integrated optimised to ensure address emerging of a broader defensive sectors and civil society into a broader national alignment with a broader threats and strategy? to be involved in or defensive strategy? national defensive cybersecurity trends and benefit from ACP under strategy? integrated into the your NCSS? broader national defensive strategy? 2 Do you recognise the 1 Do you have any policy 1 Have you established 1 Do your sectoral SOCs 1 Do you promote threat 1 need for sectoral on establishing sectoral operational sectoral actively exchange threat information sharing and security operations SOC to support entities SOCs with clear roles intelligence information good practice sharing centres (SOCs) to across your country? and responsibilities and with other national between SOCs, enhance threat secure communication stakeholders (e.g. enabling cross-sector detection and incident channels for sharing national CSIRTs) to and cross-border response capabilities threat intelligence improve awareness and collaboration? across critical sectors among essential and incident response? in your country? important entities? 3 Do key public 1 Are safeguards in place 1 Are real-time 1 Is information sharing 1 Are analytics and 1 administration entities to support informed and detection/monitoring tailored to the cyber detections dynamically implement basic responsible capabilities (e.g. posture and the size/type adjusted using monitoring/alerting implementation and use intrusion detection of stakeholders (e.g. intelligence-driven capabilities (e.g. logs, of ACP? systems, security SMEs, large entities, models and continuous basic intrusion information and event public administration purple-team exercises to management, SOCs) entities) to ensure proactively anticipate
163. detection systems) for operational across relevance and avoid and respond to critical networks? critical sectors, information overload? emerging cyber threats? supported by clear incident response playbooks? 4 Are there awareness- 1 Have you identified 1 Is there a national 1 Are mechanisms in place 1 Is there a mechanism for 1 raising initiatives to target entities to offer programme for to ensure that ACP tools continuously integrating inform stakeholders free ACP tools and identifying, acquiring, and services are novel or emerging ACP about the benefits and services (e.g. self- customising and regularly updated and tools and services, use of ACP tools and service checks, detection operating ACP tools and optimised in response to including enhanced services? tools, takedown services and making operational feedback? threat intelligence services)? them available to sharing, into routine relevant stakeholders? cybersecurity operations across sectors? 5 Are formal or informal 1 Are formal mechanisms 1 Is a national threat 1 Are threat intelligence 1 Have national initiatives 1 procedures and being developed or intelligence platform sharing procedures and been launched to foster communication piloted to support (e.g. an MISP or arrangements regularly communities of trust channels (e.g. mailing structured and trusted OpenCTI platform) assessed, updated and among stakeholders and lists, ad hoc alerts) in threat intelligence operational and used by optimised based on to promote voluntary, place to facilitate exchange among key stakeholders to stakeholder feedback secure and optionally threat intelligence stakeholders? enable unified and and operational needs? anonymous threat sharing among public structured information intelligence sharing (e.g. and private sharing? anonymous sharing stakeholders? platforms)?