A GOVERNANCE FRAMEWORK FOR
NATIONAL CYBERSECURITY STRATEGIESFebruary 2023

ABOUT ENISA
The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cybersecure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s
citizens to develop advice and recommendations on good practice in information security. It assists
EU member states in implementing relevant EU legislation and works to improve the resilience ofEurope’s critical information infrastructure and networks. ENISA seeks to enhance existing expertisein EU member states by supporting the development of cross-border communities committed toimproving network and information security throughout the EU. Since 2019, it has been drawing up
cybersecurity certification schemes. More information about ENISA and its work can be found atwww.enisa.europa.eu.
CONTACTFor contacting the authors please use team@enisa.europa.eu
For media enquiries about this paper, please use press@enisa.europa.eu.
AUTHORSAnna Sarri, Gema Fernández Bascuñana (ENISA)
Ann-Kristin Gross, Federico Chiarelli, Marina Preasca (Wavestone)
ACKNOWLEDGEMENTSENISA would like to thank and acknowledge all the expert that took part and provided valuable input
for this report and especially the following, in alphabetical order:
Andrés Jesus Ruiz Vazquez (Spain);
Center for Cyber Security (Denmark), Chief Advisor;
Centre for Cybersecurity (Belgium);
Croatian National Security Authority, Senior Advisor, Vinko Kuculo;
Cyber Security Coordination and Policy Department (the Netherlands), Gijs Peeters;
Cyber Security Coordination and Policy Department (the Netherlands), Pieter van den Berg;
Department for Secure Communication, Senior Advisor and Sweden’s Liaison Officer to ENISA(Sweden), Peter Wallström;
Department of Environment, Climate & Communications, Staff Engineer, Cyber Security & Internet
Policy Division (Ireland), James Caffrey;
Digital Security Authority of Cyprus, Technical Officer, Costas Efthymiou;
Digital Security Authority of Cyprus, Technical Officer, Giorgos Loninos;
Federal Chancellery, Department I/8 – Cyber Security, GovCERT, NIS-Office and ZAS (Austria),
Deputy Head, Christian Zec;
Federal Ministry of the Interior (Germany), Sascha-Alexander Lettgen;
International Server Security Authority (Greece), Head of Competent Department for Cyber Security
Strategic Planning, Emmanouil Patsourakis;
International Server Security Authority (Greece), Head of the Directorate for Cyber Security, Ioannis
Alexakis;
Malta Information Technology Agency, Katia Bonello;
Malta Information Technology Agency, Martin Camilleri;
Ministry of Home Affairs, Security, Reforms and Equality (Malta);
Ministry of Economic Affairs and Communication, Department of National Cyber Security (Estonia),
Kristjan Kaskman;
Ministry of Economic Affairs and Communication, Department of National Cyber Security (Estonia),
Martin Sepp;
Ministry of National Defence of Lithuania;
National Cybersecurity Agency (Italy);
National Cyber and Information Security Agency, National Strategy and Policy Unit (Czech Republic),Tomáš Kellner;
National Cyber Security Centre (Finland), Olli Lehtilä;
National Security Authority (Slovakia).
ENISA would also like to thank for their valuable contribution to this study, all the experts thatprovided input, but prefer to stay anonymous.

LEGAL NOTICE
Notice must be taken that this publication represents the views and interpretations of ENISA, unlessstated otherwise. This publication should not be construed to be a legal action of ENISA or theENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881.
This publication does not necessarily represent state-of the-art and ENISA may update it from time totime.
Third-party sources are quoted as appropriate. ENISA is not responsible for the content of theexternal sources including external websites referenced in this publication.
This publication is intended for information purposes only. It must be accessible free of charge.
Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of
the information contained in this publication.
COPRYRIGHT NOTICE© European Union Agency for Cybersecurity (ENISA), 2023
Reproduction is authorised provided the source is acknowledged.
Copyright for the image on the cover and on cover page: © Shutterstock
For any use or reproduction of photos or other material that is not under the ENISA copyright,permission must be sought directly from the copyright holders.
ISBN: 978-92-9204-589-0
DOI: 10.2824/211856
Catalogue number: TP-04-22-152-EN-N

SCOPE, OBJECTIVES & AIM
The EU Cybersecurity Act states that ENISA shall support the Member States in developing national
strategies on the security of network and information systems, promote the correct deployment of
those strategies and set up a governance framework that ensures the sustainability of nationalstrategies (National Cybersecurity Strategy - NCSS). As part of this mandate, ENISA launched thisstudy to perform a systematic review of the governance models relevant to the deployment of an
NCSS to identify and select the most relevant instances, lessons learned, and good practices fromthe Member States.
This study aims to collect insights on the definition of processes, roles and responsibilities, thesubsequent deployment of monitoring measures and what are the main challenges and goodpractices that the European countries put in place to ensure an effective governance framework forthe implementation of current and future NCSSs of the EU Member States.

DEFINITIONSCYBERSECURITY ACT (CSA)The CSA establishes a cybersecurity certification framework and introduces rules for EU-widecertification of ICT products, processes and services. Additionally, it grants ENISA a permanent
mandate and increased responsibilities and resources to support cybersecurity across the Union.
GOVERNANCE
Governance describes a complex system, defining roles, responsibilities, processes and relationships.
Governance includes stakeholders from and covers the private sector, the public administration as
well as the civil society and spans over different topics such as economic, social and politicalpriorities.
CYBER GOVERNANCE“Operation of decision-making processes” which increase and ensure “participation, transparency, andaccountability in taking measures related to cyberspace together with the mechanism of international
agreements, strategies, laws, measures, regulations, and standards that interlock in the best way”
(Efe & Bensghir, 2019).
GOVERNANCE MODEL
A governance model provides a framework to systemise and organise stakeholders, actions,processes, and relationships to reach defined objectives of a policy, strategy or political system. This
study assesses governance models based on their political, strategic, operational and technicalelements to reach the objectives of the NCSS.

1

OACHESAPPRCTIVALOBJEODOLMETHANDPEOGIC
SCO

12Desk Research: The desk research has been
focused on good practices adopted in the EU
Member States, while insights collected fromaround the world complement the analysis.

Collection of experts and stakeholders'points of view: In this context, 19stakeholders from 18 EU Member
States have been interviewed. The
national stakeholders have all been partof the national authority or government
body in charge of the cybersecurity
strategy.

34Analysis of data: The data collected throughdesk research and interviews was analysed
to identify good practices in the design of agovernance framework.

Definition of good practices forgovernance: Thereafter, good practices
and trends in setting up governancemodels have been defined and validated
by national experts, before publication.

INTERVIEWED MEMBER STATES

18 Member States interviewedAustria
Belgium
Croatia
CyprusCzech Republic
Denmark
Estonia
FinlandGermany2Greece
Ireland
Italy
Lithuania
Malta
Netherlands
Slovakia
Spain
SwedenTHE NCSSs in the EU

NCSS generation in the EU

Out of the 27 Member States:
8 Member States have 3rd orlater generation NCSS;
14 Member States have a 2ndgeneration NCSS;
5 Member States are at their firstNCSS.

Every EU Member State is obliged, following the NIS Directive, to develop and implement aNational Cybersecurity Strategy (NCSS) to ensure fostering security of network and information
systems across the Union. Each NCSS aims to set out a plan of actions to improve the security
and resilience of national infrastructure systems and services. It aims to provide a high-level topdown approach to cybersecurity and to establish a range of national objectives and priorities.
However, the fast and ever-evolving cyberspace calls for constantly developing and adopting theNCSS and hence consistent monitoring and evaluation of the NCSS is necessary.
Additionally, establishing a functioning and effective governance model for the implementation of
the current and future NCSSs is essential to foster cybersecurity across the Union and to reachthe national strategies' as well as the institutions' objectives in this relation.

100%

The creation of a central body in charge of thesuccessful deployment of the NCSS is uniquely
affected by the type of government or its selfgovernance.

of the interviewed
stakeholders have inplace a central
cybersecurity body.

Some of the factors that play a role in thedefinition of the mandate of such a body are
related to the dimension of the country, stage ofmaturity and the country's self-governance.
3

DEVELOPING AN EFFECTIVE GOVERNANCE MODEL FORNCSSsSTRATEGIC GOVERNANCE

OPERATIONAL GOVERNANCE
Ensures translation ofNCSSs into actions toimprove cybersecurity
across the society.

Coordinates theprocesses of drafting
the strategy andbuilding thegovernance modelfrom the outset.

Aims to increase
cybersecurity across alllevels and sectors of anation’s society,economy, andgovernment.

Ensures cooperation
for identifying andmitigating risks.

STRATEGIC
GOVERNANCETECHNICAL
GOVERNANCETECHNICAL GOVERNANCE
Encompasses thedefinition and use ofstandards andspecifications.

GOVERNANCE
MODEL
FOR NCSSs

POLITICAL
GOVERNANCEOPERATIONAL
GOVERNANCE

POLITICAL GOVERNANCE
Provides general andlegal framework andestablishes processes,roles and responsibilities.

Ensures inclusion oftools, technology, andcertification schemes
accompanying theimplementation of thestrategy.

Ensures accountability,transparency andacceptance of theNCSSs, its policies andall related processes.

4Elementsof Political Governance
SCOPE
AND OBJECTIVES
Overview of the implementation status across the interviewed EU Member States

POLITICAL PROCESSESIn place (100%)

Focus on cooperative andcollaborative approaches atinternational, inter-sectoraland regional levelsIn place (89.47%)

In place (73.68%)

Not in place (10.53%)

Not in place (26.32%)

Focus on participatory
approaches, including
various stakeholder groups

Collaboration with PPPs

ROLES AND RESPONSIBILITIESIn place (84.21%)

In place (84.21%)

In place (89.47%)

In place (63.16%)

Not in place (15.79%)

Not in place (15.79%)

Not in place (10.53%)

Not in place (36.84%)

Creation of specialised
government authorities,
bodies and agencies toensure governance ofcybersecurity

Clear definition ofCreation of roles andresponsibilities, definition allocation of responsibilities inof roles and tasks in caserelation to internationalof incidents
cooperation on cybersecurity

Creation of PPPsLEGAL MEASURESIn place (61.11%)
Not in place (38.89%)

In place (72.22%)

In place (61.11%)

Not in place (22.22%)

Not in place (38.89%)

Don't know (5.56%)

Establishment of a legal
governance/legal framework
linked to specific legal
measuresInternational cooperation in
relation to legal measures

5Emphasis on human rights inlegal measures/legal
framework

Good Practices for Political Governance
Political processes

Involve all stakeholders in the processof developing an NCSS and agovernance model (choose the rightlevel of representation for the different
stakeholders)

Provide political support in thedevelopment and implementation ofNCSS and governance models.
Ensure adequate coordination andcooperation among the relevant
players.
Build trust between
stakeholders.

theSet up a collaborative platform tomonitor the progress of the actionplan.

different

Create a monitoring plan for entities inthe domain of cybersecurity.

Follow participatory approaches by
putting in place platforms of exchange

Define a concrete accompanying
Action Plan to set out measures for
implementing the objectives of thestrategy.

Ensure support from the highest
political level in the creation of PublicPrivate Partnerships.

Legal measures

Roles and responsibilities

Ensurethatthegovernanceframework is supported by anddefined in accordance with the legal
framework.

Mandate a single body to ensure thecoordination and the implementationof the overall strategy.
Preciselydefinerolesandresponsibilities
ofthedifferent
stakeholders
involvedinthegovernance model in one document.
Create PPPs.

6

Elementsof Strategic Governance
SCOPE
AND OBJECTIVES
Overview of the implementation status across the interviewed EU Member States

THE NCSS AND ITS IMPLEMENTATION

In place (100%)

In place (57.89%)

In place (100%)Pre-defining a governancemodel for the implementationof the NCSS in parallel todrafting the NCSS

Not in place (42.11%)

Institutional support foreseen
to implement the NCSS

Risk identification andmitigation supported bycreated agencies

STRATEGIC ASPECTS OF RISK IDENTIFICATION AND MITIGATION

In place (78.95%)

In place (73.68%)

In place (68.42%)

Not in place (10.53%)

Not in place (15.79%)

Not in place (26.32%)

Don't know (10.53%)

Don't know (10.53%)

Don't know (5.26%)

Coherent approach for risk
identification & mitigation
across government entities
and other criticalinfrastructure operators

Planning of allocation ofbudget and resources andintegration of cybersecurity
into the use of these

Mechanisms to ensureaccountability, transparency,
and human rights during risk
identification & mitigation

Good Practices for Strategic Governance
Strategic aspects of risk identification and mitigation

In Relation to the NCSS and its implementation
Develop the budget from bottom totop.

Follow a common methodology for risk
identification.

Include a paragraph on financials inNCSS.
Definition of accountability
transparency rules.

Thorough risk
different levels.

andidentification

across

Early on identification of risks andimplementation of risk assessment
mechanisms.

Include legislation ensuring humanrights in the NCSS.

Follow a common framework in case ofincidents.

7

Elementsof Operational Governance
SCOPE
AND OBJECTIVES
Overview of the implementation status across the interviewed EU Member States

AWARENESS RAISINGIn place (89.47%)

In place (94.44%)

Not in place (5.26%)

Don't know (5.56%)

Don't know (5.26%)

Awareness raising, knowledge and capacity building
within the cybersecurity relevant workforce

Awareness raising, knowledge and capacity building
within the complete workforce/population

INCIDENT RESPONSE

In place (89.47%)
Not in place (5.26%)
Don't know (5.26%)

Incident response mechanisms
and support of CSIRTs/CERTs

INFORMATION SHARINGIn place (84.21%)
Not in place (10.53%)
Don't know (5.26%)

Information sharing processes during theincident response (formal and informal)

Good Practices for Operational Governance
Awareness Raising

Information Sharing

Tailored awareness raising and training campaigns.

Centralise information sharing.

Incident ResponseFormalise
CSIRTs.

acoordinatedapproach

Taxonomy of best practices to ensure coherent
processes of information sharing.

between8Elementsof Technical Governance
SCOPE
AND OBJECTIVES
Overview of the implementation status across the interviewed EU Member States

INTERNATIONAL STANDARDS & TECHNICAL GUIDELINESIn place (77.78%)
Not in place (16.67%)
Don't know (5.56%)

Technical governance for cybersecurity based oninternational standards and technical guidelines

USE OF TOOLS, TECHNOLOGY AND CERTIFICATION SCHEMESIn place (55.56%)
Not in place (38.89%)
Don't know (5.56%)

Implemented/defined use of tools andtechnology

Good Practices for Technical GovernanceInternational Standards and Technical Guidelines
Develop in the NCSS and its governance model a section focused on the international standards and technicalguidelines. When developing this section, specify which technical standards should be used, and define clear
roles and responsibilities.
Use of Tools, Technology, and Certification Schemes
Have in place a body that supervises the compliance of regulated entities with the European and international
requirements.
Use certification schemes for ICT products, ICT services and ICT processes, especially for all the services oractivities provided by essential entities. The competent authorities should be empowered to apply sanctions
consisting of the suspension of a certification or authorisation concerning part or all the services provided by anessential entity.
Put in place in the NCSS action plan a group of tasks focused on using tools and technologies in respect tohuman rights, particularly to GDPR.

9TP-04-22-152-EN-N

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving
a high common level of cybersecurity across Europe. Established in 2004 and strengthened by theEU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy,
enhances the trustworthiness of ICT products, services and processes with cybersecurity
certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare forthe cyber challenges of tomorrow. Through knowledge sharing, capacity building and awarenessraising, the Agency works together with its key stakeholders to strengthen trust in the connectedeconomy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society
and citizens digitally secure. More information about ENISA and its work can be found here:
www.enisa.europa.eu.

ENISA
European Union Agency for Cybersecurity
Athens Office
Agamemnonos 14, Chalandri 15231, Attiki, Greece
Heraklion Office
95 Nikolaou Plastira700 13 Vassilika Vouton, Heraklion, Greece

enisa.europa.eu

ISBN: 978-92-9204-589-0
DOI: 10.2824/211856