博士論文

Proposals of Checking Method and Tool for
National Cybersecurity Capacity Enhancement

Shigeo MORI
森滋男

情報セキュリティ大学院大学
情報セキュリティ研究科
情報セキュリティ専攻
2019 年 3 月

Doctoral Thesis

Proposals of Checking Method and Tool for
National Cybersecurity Capacity Enhancement

Shigeo MORI
Department of Information Security
Institute of Information Security

March 20191

(Blank Page)
2

Acknowledgement
Firstly, I would like to express my sincere gratitude to my supervisor Prof. A. Goto for thecontinuous support of my Ph.D. study and related research, for his patience, motivation, andimmense knowledge. His guidance helped me in all the time of research and writing of thisthesis. I could not have imagined having a better advisor and mentor for my Ph.D. study.
Besides my advisor, I would like to thank the rest of my thesis committee: Prof. A. Nakanishi
of Meiji University, Prof. H. Yuasa, and Prof. T. Okubo, for their insightful comments andencouragement, but also for the hard question which incented me to widen my research fromvarious perspectives.
I would like to thank Dr. Paul Cornish, Ms. Lara Pace, and the Global Cyber Security
Capacity Centre for introduction to their Cybersecurity Capability Maturity Model. That was
the beginning of everything of my research.
Also, I would like to thank Prof. T. Nakaizumi of Kanto Gakuin University and Prof. K.
Hayashi for their valuable advices especially about policy appraisal and evaluation.
I thank my fellow labmates for the stimulating discussions, for the late night talks we had at
the camps, and for all the fun we have had in the last four years.
I also thank the faculties and the participants of the Doctoral Consortium at the Pacific Asia
Conference on Information Systems 2018 held in Yokohama for their valuable comments tomy research and delightful time during the stay.
I thank the professors and staff of the Institute of Information Security for their guidance andimmense support directed to me.
I thank the Mitsubishi Electric Corporation, Mitsubishi Electric Information Systems
Corporation, and my colleagues for their cooperation and encouragement to my Ph.D. Study.
Last but not the least, I would like to thank my family for supporting me spiritually
throughout writing this thesis and my life in general.

3

Table of Contents

Table of Contents
page

Acknowledgement

3

Table of Contents

4

List of Tables/Figures7

論文要旨（日本語）/ Abstract

9/14

Chapter 1. Introduction

19

1.1 Background
1.2 Rise of Public Sector’s Responsibilities in Cybersecurity
1.3 Necessity of Enhancement of National Cybersecurity Capacities
1.4 Importance of National Approaches for Cybersecurity Capacity Enhancement
1.5 Purposes of this Research
1.6 Contribution of this Research
1.7 Definition
1.7.1 Definition of Capacity
1.7.2 Definition of Approach

Chapter 2. Related Researches
2.1 Introduction
2.2 Policy Appraisal and Evaluation
2.2.1 What are Policy Appraisal and Evaluation
2.2.2 Effectiveness and Limitations of Policy Appraisal and Evaluation
2.2.3 Policy Appraisal and Evaluation and Proposed Method Coexist
2.3 Benchmarking of National Cybersecurity Capacities
2.3.1 ITU Global Cybersecurity Index
2.3.2 Cybersecurity Capacity Maturity Model
2.3.3 Other Benchmarking Models
2.4 Guidelines for Enterprises and Organisations
2.4.1 NIST Framework
2.4.2 FFIEC CAT
2.4.3 Other Guidelines for Enterprises and Organisations
2.5 Guidelines for Software Development Process
2.5.1 CMMI for Development

4

19
19
19
20
22
23
24
24
24

27
27
29
29
30
31
32
32
33
35
36
36
40
45
46
46

Table of Contents

2.5.2 Capability Levels and Maturity Levels in CMMI
2.6 Conclusion of Survey of Related Researches

Chapter 3. Proposal
3.1 Introduction
3.2 Method
3.2.1 Outline of the Method (ANC3M)
3.2.2 Collection
3.2.3 Itemisation
3.2.4 Mapping
3.2.5 Evaluation
3.2.5.1 Evaluation for Condition 1
3.2.5.2 Evaluation for Condition 2, 3, 4
3.3 Tool
3.3.1 Prerequisites of the Tool (ANC3T)
3.3.2 Outline of the Tool (ANC3T)
3.3.3 Deriving from CSCMMN
3.3.4 Requirements for Autonomous Enhancement Mechanism
3.3.5 Enhancement over CSCMMN
3.4 Database
3.4.1 Outline of the Database (ANC3DB)
3.4.2 Purposes
3.4.3 Details
3.4.4 Data Collection

48
49

51
51
51
51
51
52
52
53
53
54
56
56
56
57
58
61
62
62
62
62
63

Chapter 4. Verification

67

4.1 Introduction
4.2 Procedures and Criteria of Verification
4.3 Verification (Japan)
4.3.1 Cybersecurity Strategy of Japan
4.3.2 Mapping Result (Japan)
4.3.3 Evaluation Result (Japan)
4.3.3.1 Case 1: Autonomous Enhancement Mechanism
4.3.3.2 Case 2: “Few”
4.3.3.3 Case 3: “Low”
4.3.3.4 Case 4: “High”
4.3.3.5 Case 5: “A lot”
4.3.3.6 Case 6: Not Allocated

67
67
69
69
70
72
72
73
74
75
75
76

5

Table of Contents

4.3.4 Provisional Assessment of Japanese Cybersecurity Capacity
4.4 Verification (U.K.)
4.4.1 Cybersecurity Strategy of U.K.
4.4.2 Mapping Result (U.K.)
4.4.3 Evaluation Result (U.K.)
4.4.3.1 Case 1: Autonomous Enhancement Mechanism
4.4.3.2 Case 2: “Few”
4.4.3.3 Case 3: “Low”
4.4.3.4 Case 4: “High”
4.4.3.5 Case 5: “A lot”
4.4.3.6 Case 6: Not Allocated
4.5 Discussion
4.5.1 Discussion on Four Conditions
4.5.2 Discussion on Reproducibility of Checking
4.6 Conclusion of Verification

Chapter 5. Conclusion and Remaining Issues
5.1 Conclusion
5.2 Remaining Issues

78
82
82
82
84
84
85
86
87
87
87
88
88
89
91

93
93
94

References

97

Research Achievement

102

Appendices105

Appendix A Cybersecurity Capacity Maturity Model for Nations Revised Edition(reproduced from original document)
Appendix B ANC3T
Appendix C Japanese Cybersecurity Strategy ("Cybersecurity 2017" itemised to action items)
Appendix D U.K. Cybersecurity Strategy ("National Cyber Security Strategy 2016 - 2023"
itemised to action items)
Appendix E Japanese Action Items Allocated to Tentative ANC3T
Appendix F Japanese Action Items Mapping Result by Requirement
Appendix G U.K. Action Items Allocated to Tentative ANC3T
Appendix H U.K. Action Items Mapping Result by Requirement
Appendix I Provisional Assessment of Japanese Cybersecurity Capacity
Appendix J ANC3DB

6

List of Tables/Figures

List of Tables/Figures
Chapter 2
Table 2.3-1 Top 13 Nations in GCI 2017
Figure 2.3-1 Relationship of Elements in CSCMMN (Produced based on the Cybersecurity
Capacity Maturity Model for Nations Revised Edition)
Table 2.4-1 Functions, Categories and Subcategories of the NIST Framework Core
Table 2.4-2 Image of Inherent Risk Profile
Table 2.4-3 Image of Cybersecurity Maturity
Table 2.4-4 Risk/Maturity Relationship
Table 2.5-1 The Process Areas of the CMMI
Table 2.5-2 Comparison of Definitions of Levels

Chapter 3
FigureFigureTable
FigureTable
Figure
Table

3.2-1
3.2-2
3.3-1
3.3-1
3.3-2
3.4-1
3.4-1

Process of Mapping
Examples of Evaluation
Outline of the Tool (ANC3T)
Replacement of Names of Elements
List of Requirements for Autonomous Enhancement Mechanism
Image of the ANC3DB Tables
Sample of the ANC3DB

Chapter 4
Table
Table
Table
Table
Table
Table
Table
Table
Table
Table
Table
Table

4.3-1 Mapping Result of the Approaches of Japan
4.3-2 Number of Relationships with Requirements for Autonomous Enhancement
Mechanism (Japan)
4.3-3 Capacity Areas of Case 2 “Few” (Japan)
4.3-4 Capacity Areas of Case 3 “Low” (Japan)
4.3-5 Capacity Areas of Case 4 “High” (Japan)
4.3-6 Capacity Areas of Case 5 “A lot” (Japan)
4.3-7 Not Allocated Action Items (Japan)
4.3-8 Requirements Added for Enhancement
4.3-9 Summary Result of Provisional Assessment of Capacity of Japan
4.3-10 Stage Judgement of Japan by Aspect
4.4-1 Mapping Result of the Approaches of U.K.
4.4-2 Number of Relationships with Requirements for Autonomous Enhancement
Mechanism (U.K.)
7

List of Tables/Figures

Table
Table
Table
Table

8

4.4-3
4.4-4
4.5-1
4.6-1

Capacity Areas of Case 2 “Few” (U.K.)
Capacity Areas of Case 5 “A lot” (U.K.)
Part of ANC3T
Number of Findings

論文要旨

論文要旨
サイバー脅威が激化しており，サイバー攻撃に起因する大規模な被害，巨額金銭
損失，さらには市民の日常生活に影響する被害まで生じる事態となっている．加えて，一部のサイバー攻撃は国家による活動の一部であることが疑われる．このような状況下，個人，企業，組織による努力のみでは，最早サイバー攻撃に十分に対抗することができるとは言い難く，それらの対策に加えて，国レベルでのサイバーセ
キュリティ能力を向上させることが，国民の安全安心な生活を維持するためには必須となっている．
さらに，情報技術や，サイバー攻撃者の技能，他国家の能力は急速に進展しており，そのため，国レベルのサイバーセキュリティ能力も，同等程度のペースか，むしろより速いペースで向上させていく必要がある．もしも後手に回ってしまった場
合には，取り戻すために多大なる労力と多額のコストを要するものとなる．
また，国レベルのサイバーセキュリティ能力は，国レベルに求められる能力領域
において包括的に向上されなければならない．例えば，法執行機関のサイバー犯罪対応能力の向上は果たしたが，検察や法廷の能力向上はできなかったということではいけないのである．さらに，能力は必要な水準まで高められなければならない．
能力向上はしたものの攻撃者等の能力に追いつかない，というようなことは許されないのである．一部の能力向上が置き去りにされる，あるいは，能力向上はしたものの不十分であるという状態は，上述した，能力向上が後手に回るということなので，こういった状態を避けなければならないことは明らかであろう．
加えて，国レベルのサイバーセキュリティ能力向上は，効率的に行われなければならない．税金を無駄にしてはいけないということもあるが，予算は有限であり，もしも無駄な向上策が採られた場合には，本来実施すべき，より有効な向上策が阻害されるかもしれないのである．
このように，個人，企業，組織によるサイバー攻撃対策に加えて，国レベルでのサイバーセキュリティ能力を向上させなければならないのであるが，その向上は，
以下の 4 要件を満たさなければならない．
1) 国レベルのサイバーセキュリティ能力は，技術発展，攻撃者／他国家の能力向上と，同等もしくはそれ以上のペースで向上されなければならない．（以下、「要件 1『速度』」）
2) 国レベルのサイバーセキュリティ能力は，国レベルで必要な能力領域を包括的にカバーしなければならない．（以下、「要件 2『包括性』」）
3) 国レベルのサイバーセキュリティ能力は，攻撃者や非友好的国家の能力に対抗し得る水準まで向上されなければならない．（以下、「要件 3『水準』」）
4) 国レベルのサイバーセキュリティ能力向上は，限られた資源から最大の効果を得られるよう、効率的でなければならない．（以下、「要件 4『効率性』」）
9

論文要旨

したがって，国レベルのサイバーセキュリティ能力向上が 4 要件を満たすように施策が立案されているかを確認することは極めて重要である．もしいずれかの要件が満たされていない場合には，国のサイバーセキュリティ戦略に照らして適切な対応，例えば施策の追加や変更，を行う必要がある．
一般的に国の施策が，その目的に照らして適切であるかを確認する方法としては，政策評価が実施されている．しかしながら，調査したところ，政策評価は，本来実施されるべき施策が検討対象に挙がっていないというような状態を検出することには適していない．すなわち，政策評価は，要件 2『包括性』を確認することができない．施策が要件 2『包括性』を満たしているかを評価するためには，政策評価とは異なる方法が必要である．その一方，政策評価は，要件 4『効率性』を確認する
ことには適していると考えられる．
政策評価の調査に加え，国レベルのサイバーセキュリティ能力測定モデル，および，組織や企業向けのサイバーセキュリティガイドラインについて調査を行った．
しかしながら，国レベルのサイバーセキュリティ能力を向上させる施策が 4 要件を満たすかどうかを評価する手法は存在しないことが分かった．主な理由は，既存モデルが施策を評価するようには設計されていないこと，および／または，要件 2『包括性』や 3『水準』を評価できないためである．
したがって，国レベルのサイバーセキュリティ能力を向上させる施策が 4 要件を満たすかどうかを評価する手法を開発しなければならない．また，その手法で用いられるチェックリストも開発する必要がある．
チェックリストに関しては，国レベルのサイバーセキュリティ能力測定モデルのひとつであり，グローバル・サイバーセキュリティ能力センターにより開発された「国レベルのサイバーセキュリティ能力成熟度モデル改訂版」（以下、『サイバー成熟度モデル』）が，国レベルで必要な能力領域を包括的に有しており，また，能力を段階的に向上させていけるような水準も示していることから，チェックリストのベースとなり得ることが分かった．
さらに，調査によって，チェックリストには自律的強化機構に関する要求事項を含めるべきであることが分かった．「能力成熟度モデル統合」は，もとはカーネギ
ーメロン大学ソフトウエア工学研究所によって開発され，現在ではプロセス改善の遂行，および，評価のプログラムとして幅広く活用されているものであるが，ここでは，能力が自律的，かつ，永久に最適化するような成熟度が求められる．これをサイバーセキュリティ能力に置き換えてみると，能力が，環境の変化に応じて，外部から指摘を受けずとも自律的に向上できる，そのような能力を醸成する必要があるということであり，それによって要件 1『速度』を満たすことができるということである．したがって，要件 1『速度』は，チェックリストに自律的強化機構に関する要求事項を盛り込み，施策がそのような機構の獲得を目指しているかを評価することで確認できる．
10

論文要旨

よって，関連研究調査によって，国レベルのサイバーセキュリティ能力を向上させる施策が 4 要件を満たすかどうかを評価する手法を開発しなければならないこと，
および，その手法で用いられるチェックリストはサイバー成熟度モデルをベースとすることができることが分かった．4 要件は，以下のように評価する．
1) 要件 1『速度』は，チェックリストに自律的強化機構に関する要求事項を盛り込
むことにより評価する．
2) 要件 2『包括性』は，国レベルで必要な能力領域を包括的に有しているサイバー
成熟度モデルをベースにチェックリストを策定することにより評価する．
3) 要件 3『水準』は，能力を段階的に向上させていけるような水準を示しているサ
イバー成熟度モデルをベースにチェックリストを策定することにより評価する．
4) 要件 4『効率性』は，政策評価と本手法を連携させる，すなわち，手法が非効率である可能性のある施策を指摘し，そこに政策評価を集中的に行う，といった形で効果的に評価する．
よって，本論文において，国レベルのサイバーセキュリティ能力の向上を図る施策を評価するための手法を提案する．手法においてチェックリストとして使用する
ツ ー ル も 提 案 す る ． 手 法 は 「 ANC3M 」 （ Approaches for National Cybersecurity
Capacity enhancement Checking Method：国レベルサイバーセキュリティ能力向上施策
評価手法）と呼称する．ツールは「ANC3T」（Approaches for National Cybersecurity
Capacity enhancement Checking Tool： 国レベルサイバーセキュリティ能力向上施策評価ツール）と呼称する．
手法である ANC3M は，能力向上施策が適切に立案されていない疑いのある，換言すれば，4 要件のいずれかを満たしていないサイバーセキュリティ能力領域を検出するように設計されている．ANC3M は以下のプロセスによって実行される．
1) 収集：
ある国における国レベルのサイバーセキュリティ能力の向上を図るための施策を全て収集する．
2) 細分化：それらの施策を個々の行動計画に細分化する．
3) マッピング： 行動計画をツール（ANC3T）上にマップする．マップするとは，各行動計画が満たす，もしくは，満たすことに貢献することのできるツール上の要求事項を特定することである．
4) 評価：
マッピング結果を評価する．
評価プロセスにおいて，4 要件は以下のとおり評価される．
1) 要件 1『速度』は，自律的強化機構に関する要求事項に関連付けられた行動計画の数を精査することで評価する．ツール（ANC3T）にはそのような要求事項が58 項目ある．
2) 要件 2『包括性』は，関連付けられた行動計画が極めて少ない能力領域を検出することで評価する．
3) 要件 3『水準』は，関連付けられた行動計画が低水準に集中している能力領域を検出することで評価する．
11

論文要旨

4) 要件 3『水準』は，また，関連付けられた行動計画が高水準に集中している能力
領域を検出することでも評価する．このケースは，要件 2『包括性』を満たさない可能性も指摘する．
5) 要件 4『効率性』は，関連付けられた行動計画が非常に多い能力領域を検出する
ことで評価する．
ANC3M は，日本，および，英国の施策に同手法を適用することにより，検証を行った．本検証において，ツールについては，サイバー成熟度モデルをベースとしたものを暫定 ANC3T として使用した．検証の結果，日本，および，英国，双方において，施策が要件を満たしていない可能性のある能力領域が相当数検出された．よって，ANC3M が有効であるものと判断した．
一方，検証によって，暫定 ANC3T が改善を要することが判明した．施策のいくつかが，暫定 ANC3T に定義されている要求事項の，いずれとも対応しなかったのである．したがって，それらの施策に対応する新たな要求事項を ANC3T に追加することとした．
このように，国は，ANC3M によって施策が要求事項を満たしていない可能性があると指摘された能力領域を詳しく精査することによって，サイバーセキュリティ能力向上が 4 要件を満たすよう，適切に施策が立案されているかを確認することができる．しかしながら，もし何らかの要件が満たされていない場合，国は，そのサイ
バーセキュリティ戦略に照らして対応を検討しなければならない．すなわち，施策を追加するか，削除するか，変更するかである．そのような意思決定を支援するため，施策のデータベースを提案する．このデータベースは，当該能力領域，または，類似の能力領域において，他の国が計画し実行している施策の事例に関する情報を提供するものであり，「ANC3DB」（Approaches for National Cybersecurity Capacity
enhancement Checked DataBase：国レベルサイバーセキュリティ能力向上施策評価済
みデータベース）と呼称する．
ANC3DB は，ANC3M によって関連付けられた行動計画と要求事項の組み合わせのデータベースである．AC3DB は以下の機能を提供する．
1) ある能力領域の強化を検討している国に，他国で導入されている施策事例を提供する．
2) 他国の取り組みを模範としたい国に，模範国の施策事例を提供する．
3) 統計分析機能も提供する．例えば，
a) 世界的に見て，積極的に向上に取り組まれている能力領域は何か？
b) 世界的に見て，多くの国が目指している能力水準は，どの水準か？
c) 積極的に取り組まれている領域は，時間の経過とともに変化しているか？
d) 目指す能力水準は，上昇しているか？
など．

12

論文要旨

本研究は，国レベルのサイバーセキュリティ能力の向上を図る施策の適切性を評価する手法とツールを提案することで，国が施策適切性を確認することに貢献するものと考える．ANC3M，ANC3T，および，ANC3DB は，施策を改善することの一助となる．したがって，これらは，国レベルのサイバーセキュリティ能力の向上に貢献するものと考える．究極的には，本研究は，サイバー攻撃の減少と，サイバー攻撃による被害の縮小に貢献できることを目指すものである．
本研究が施策改善に貢献するためには，政府が ANC3M，および，ANC3T を使用
して施策評価を行い，ANC3DB を参照して施策改善を検討することが望ましい．しかしながら，これらを使用するのは必ずしも政府である必要はなく，第三者が利用することも可能である．政府以外の誰か，あるいは，他の国の誰かが施策の評価を行い，その結果が施策に関する意思決定に影響することができれば，本研究が，その国の施策の改善に貢献することができる．多くの人が ANC3M を使用して様々な国の施策を評価すれば，本研究の貢献もより大きなものとなる．
本手法は，使用する人による非再現性があまり大きくならないように設計されている．評価者による多少の評価結果の相違は生じるであろうが，非常に大きな相違となる可能性は低い．多少の相違は，評価プロセスにおいて，閾値を調整することで吸収可能である．さらに，ANC3M を使用しての施策評価は，評価者に高度なスキルを求めない．サイバーセキュリティに関する基本的知識があれば十分である．したがって，複数の評価者でマッピング・プロセスを並行して実施し，結果を持ち寄ることで再現性の高い評価結果を目指すことも可能である．
ANC3DB については，現在，データベースには約 1,000 件の組み合わせが含まれている．多様な国の，より多くのデータが収集されれば，データベースの機能性は向上する．したがって，データ収集の努力は今後も継続していく所存である．

13

Abstract

Abstract
Cyber threat became so intense that cyber-attacks now can cause huge impacts and monetarydamages and even affect daily life of citizens. Additionally, some cyber-attacks are suspected
to be parts of national campaigns. Under such circumstances, efforts by the individuals,
enterprises and organisations cannot sufficiently counteract against cyber-attacks, and the
public sector must enhance the national cybersecurity capacity on top of the countermeasuresby the private sector in order to maintain safe and secure lives of citizens.
Moreover, rapid development of information technology, skills of cyber-attackers andcapacities of other nations forces a nation to enhance the national capacities at the same velocity
or even faster. If a nation falls behind, it will require very hard work and high cost to catch up.
Then, a nation must enhance its cybersecurity capacities in the areas that a nation has to havecomprehensively. For example, a nation may not enhance anti-cybercrime capacity of its law
enforcement, while the cybersecurity capacities of prosecution and courts are not enhanced.
Furthermore, a nation must enhance the national cybersecurity capacities up to the necessarylevels. It will not be acceptable that a nation enhances some particular capacities but theenhanced capacities do not match the opponents. The failure of enhancement of some particular
capacities and/or insufficient enhancement of capacities will cause a nation to fall behind thedevelopment race. It is apparent that a nation must prevent such situations.
Additionally, the national cybersecurity capacity enhancement must be carried out efficiently.
Inefficient enhancement will waste tax payers’ money, and more importantly, incompetentenhancement may crowd out the essential and more effective enhancement approaches under
the limited budget.
Thus, a nation must enhance the national cybersecurity capacity on top of thecountermeasures by the private sector, and, furthermore, a nation must satisfy the following
four conditions when it enhances its capacities.
1) National cybersecurity capacities must be enhanced at the same velocity as technology,
skills of attackers and capacities of other nations develop, or even faster than those.
(hereafter ‘condition 1 “velocity”’)
2) National cybersecurity capacities must be enhanced comprehensively over the various
capacity areas that are necessary for nations. (hereafter ‘condition 2 “coverage”’)
3) National cybersecurity capacities must be enhanced up to the levels that can match thecapacities of the attackers and other hostile nations. (hereafter ‘condition 3 “levels”’)
4) National cybersecurity capacities must be enhanced efficiently so that it can extract the
optimised effects from the limited resources. (hereafter ‘condition 4 “efficiency”’)

14Abstract

It is essential for a nation to assure that its cybersecurity capacity enhancement is planned sothat the four conditions are satisfied. If any conditions are not satisfied, it should consider
appropriate actions, for example, addition and/or alteration of the approaches, in light of its
cybersecurity strategy.
In order to ensure that the national approaches are appropriate to accomplish the objectives
in general, the policy appraisal and evaluation are carried out. However, the survey about thepolicy appraisal and evaluation revealed that they are not suitable for finding out the situation
where the necessary approaches have not even come up for discussion. This means that thepolicy appraisal and evaluation cannot check the above-mentioned conditions 2 “coverage”.
In order to make sure that the approaches satisfy the condition 2, a different checking procedureis needed. On the other hand, the policy appraisal and evaluation are supposed to be good atchecking the condition 4 “efficiency”.
In addition to the above-mentioned policy appraisal and evaluation, the benchmarking
models of the national cybersecurity capacities and the cybersecurity guidelines fororganisations and enterprises were surveyed. However, the survey revealed that there does notexist the method to check if the national cybersecurity enhancement approaches satisfy the four
conditions, mainly because the existing methods are not designed for checking the approaches
and/or cannot check the condition 2 “coverage” and/or 3 “levels”.
Therefore, the method to check if the national approaches satisfy the four conditions must
be created. The checklist that will be used in the method should also be created.
With regard to the checklist, the survey about the benchmarking models of the national
cybersecurity capacities indicated that one of the models, namely, the “Cybersecurity Capacity
Maturity Model for Nations Revised Edition” (hereafter “CSCMMN”) developed by the Global
Cyber Security Capacity Centre can become the basis of the checklist, as it has thecomprehensive coverage of the capacities that a nation has to have and indicates the levels sothat a nation can plan to enhance the capacities in step by step manner, in other words, cancheck the condition 2 “coverage” and 3 “levels”.
Another implication obtained from the survey is that the checklist should include therequirements for autonomous enhancement mechanism. The “Capability Maturity Model
Integration”, which was originally developed by Software Engineering Institute of Carnegie
Mellon University and is now widely utilised as a process improvement training and appraisal
program, requires the maturity where the capabilities optimise autonomously and everlastingly.
When it is put into the case of cybersecurity capacity, a nation has to cultivate the ability to
improve its capacities autonomously in response to the changes of environments without being
instructed to do so by the outside organs, in order to satisfy the condition 1 “velocity”.
Therefore, the condition 1 “velocity” can be checked by incorporating the requirements for15

Abstractautonomous enhancement mechanism into the checklist and checking if the approaches areintended to obtain such mechanisms.
Thus, the survey of the related researches indicated that the method must be created to checkif the approaches for the national cybersecurity capacity enhancement satisfy the four
conditions, and that the checklist that will be used in the method can be based on the CSCMMN.
The four conditions will be checked as follows;
1) The condition 1 “velocity” will be checked by incorporating the requirements ofautonomous enhancement mechanism to the checklist.
2) The condition 2 “coverage” will be checked by creating the checklist based on the
CSCMMN which has the comprehensive coverage of the capacities that a nation has tohave.
3) The condition 3 “levels” will be checked by creating the checklist based on the CSCMMN
which indicates the levels so that a nation can plan to enhance the capacities in step bystep manner.
4) The condition 4 “efficiency” will be effectively checked by combining the policy appraisal
and evaluation and the method, where the method indicates the possible inefficientapproaches which will be intensely applied the policy appraisal and evaluation.
Therefore, in this thesis, the method for checking the approaches for the national
cybersecurity capacity enhancement and the tool that is used as the checklist in the method areproposed. The method is called “ANC3M” (Approaches for National Cybersecurity Capacity
enhancement Checking Method). The tool is called “ANC3T” (Approaches for National
Cybersecurity Capacity enhancement Checking Tool).
The method, ANC3M, is designed to find out the cybersecurity capacity areas for which theenhancement approaches are suspected to be inappropriately planned, in other words, notsatisfying any of the four conditions. The ANC3M consists of the following processes.
1) Collection: All approaches of a nation for national cybersecurity capacity enhancement
are collected.
2) Itemisation: The approaches are itemised into pieces of action items.
3) Mapping:
The action items are mapped onto the tool (ANC3T). “Map” in this casemeans to identify the requirements of the tool that each action item will fulfil
or contribute toward fulfilling.
4) Evaluation: The mapping result is evaluated.
The four conditions are checked in the evaluation process as follows;
1) The condition 1 “velocity” will be checked by examining the number of the action items(itemised approaches) related to the requirements for autonomous enhancement
mechanism. There exist 58 such requirements in the tool (ANC3T).

16

Abstract2) The condition 2 “coverage” will be checked by finding out the capacity areas that few
action items are related to.
3) The condition 3 “levels” will be checked by finding out the capacity areas where the action
items are related only to the lower levels.
4) The condition 3“levels” will also be checked by finding out the capacity areas where theaction items are related only to the higher levels. This case may also indicate theunsatisfaction of the condition 2 “coverage”.
5) The condition 4 “efficiency” will be checked by finding out the capacity areas that a lotof action items are related to.
The ANC3M was verified by applying the method to the approaches of Japan and the United
Kingdom. For this verification, the tool based on the CSCMMN was used as the tentative
ANC3T. The verification discovered a number of capacity areas where the enhancement
approaches may not be satisfying the conditions in both Japan and the U.K. Therefore, it isthought that the ANC3M is effective.
On the other hand, the verification also revealed that the tentative ANC3T needs to beenhanced, because some approaches did not match any of the requirements described in thetentative ANC3T. Therefore, new requirements that correspond the unmatched approaches areadded to the ANC3T.
Thus, by further examination of the capacity areas where the ANC3M indicates the possible
dissatisfactory approaches, a nation can assure that its cybersecurity capacity enhancement isplanned appropriately so that the capacity enhancement satisfies the four conditions. However,
if any conditions are not satisfied, a nation must consider corresponding actions in light of its
cybersecurity strategy, i.e., addition, reduction and/or alteration of the approaches. In order tosupport such decisions by providing with the information about the approaches that are
implemented by the other nations, the database of the approaches is also proposed. The
database is called “ANC3DB” (Approaches for National Cybersecurity Capacity enhancement
Checked DataBase).
The ANC3DB is the database of the pairs of the action items and the requirements that are
related each other by the ANC3M processes. The ANC3DB is supposed to function as follows;
1) When a nation plans to enhance some particular capacities, the ANC3DB can provide withthe examples of the approaches that are implemented by other nations.
2) When a nation considers another nation as a role model, the ANC3DB can provide withthe examples that are implemented by the model nation.
3) The ANC3DB can provide with the functionality for statistical analysis, for example;a) What capacity areas are emphasised on a global basis?
b) What levels are intensely aimed at on a global basis?
c) Are the emphasised areas shifting according to the lapse of time?

17

Abstractd) Are the aimed levels rising?
and so on.
By proposing the method and the tool to check the appropriateness of the approaches for thenational cybersecurity capacity enhancement, this research should contribute toward ensuring
the appropriateness of the approaches. And the ANC3M, ANC3T and ANC3DB will help
improving the approaches. Then, they should contribute toward improvement of the national
cybersecurity capacities. Ultimately, this research is aiming at contribution to the decrease of
cyber-attacks world-wide and reduction of the possible damages caused by cyber-attacks.
In order for the research to contribute toward improvement of the approaches, it is desirable
that the policymakers carry out the check of the approaches using the ANC3M and ANC3T,
and refer to the ANC3DB for consideration of improvement of the approaches. However, it is
not necessarily the policymakers who use them, but anyone else can do. If anyone other thanthe policymakers of the nation, or even anyone outside of the nation carry out the check of theapproaches and the result informs to the decision of the approaches, this research can contributetowards improvement of the approaches of that nation. If a lot of people join and check theapproaches of various nations using the ANC3M, the contribution of this research will begreater.
The method is designed so that the checking result will not be much inconsistent subject tothe person who use it. There may be some inconsistency of the checking results subject to thechecker, but the inconsistency is hardly supposed to become significant. And small
inconsistency can be absorbed by adjusting the thresholds when evaluating the mapped results.
Additionally, checking the approaches using the ANC3M does not require the checkers to havevery high skills. People with a basic knowledge about cybersecurity can do. Therefore, it ispossible for two or more checkers to perform the mapping process in parallel and then to
consolidate the outputs for a stable result.
With regard to the ANC3DB, the database currently contains approximately 1,000 pairs. The
database will function better if it contains more data of the various nations. Therefore, it isplanned to continue collecting the data.

18

Chapter 1. Introduction

Chapter 1. Introduction
1.1 Background
Cyber incidents are reported almost daily. Although there exist various targets, attack
methods, damages, presumed attackers and presumed objectives, their impact seems tobe getting larger, broader and more serious. In October 2017, Yahoo! announced thatthree billion (roughly 40%! of the global population) of its customer data had been
exfiltrated by cyber-attackers [1]. In February 2016, the Bangladesh Bank, which is thecentral bank of Bangladesh, was attacked and had US$ 951 million stolen via the SWIFT(Society for Worldwide Interbank Financial Telecommunication) network [2]. In
December 2015 and in December 2016, Ukraine experienced wide area power downs as
a result of cyber-attacks [3, 4]. Nowadays, cyber-attacks can cause huge impact andmonetary damages and even affect the daily life of citizens. Moreover, some incidents
are arguably suspected to be parts of national campaigns [5].

1.2 Rise of Public Sector’s Responsibilities in Cybersecurity
Under such circumstances which are described in section 1.1, efforts by the private
sector, including individuals, cannot sufficiently counteract against cyber-attacks.
Therefore, the public sector must endeavour to enhance the national cybersecurity
capacity such that a nation can retain safe and secure life of its citizens.
Tagawa and Hayashi believe that it is necessary to enhance the national cybersecurityin every aspect with the combined efforts of the entire country. They also think that thisshould be done by building the proactive national cybersecurity capacities, based onsustained and private-sector-initiated reactive cybersecurity countermeasures [6](original in Japanese).

1.3 Necessity of Enhancement of National Cybersecurity Capacities
A nation must have sufficient cybersecurity capacities in order to counteract against
cyber-attackers and to retain safe and secure life of its citizens. If the capacities are notsufficient, the public sector must enhance the capacities to the sufficient level.
Furthermore, information technology, skills of cyber-attackers and capacities of othernations develop rapidly. Such a rapid development forces a nation to enhance its
capacities at the same velocity or even faster. If a nation falls behind, the nation will be
required very hard work and high cost to catch up. The nations with the insufficient
capacities must work even harder to surpass the development speed of the others.
Additionally, a nation has to have comprehensive cybersecurity capacities that arenecessary for nations. For example, a nation must have the capacities to prosecute andjudge cybercrimes as well as anti-cybercrime capacity of its law enforcement. And, of
19

Chapter 1. Introduction

course, those capacity areas must be enhanced as technology and capacities of the others
develop.
Moreover, a nation must enhance the national cybersecurity capacities up to thenecessary levels. It will not be acceptable that a nation enhances some particular capacity
areas but the enhanced capacities do not match the opponents.
If a nation fails enhancement of some particular capacity areas, or enhances its
capacities but the enhanced capacities do not match the opponents, the nation will fallbehind and will be forced to pay a lot of work and money to catch up, or otherwise thecyber-attackers may bring serious damages to the nation.
Thus, a nation must have sufficient cybersecurity capacities and must enhance its
capacities. Moreover, the enhancement must have the following characteristics.
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, or even fasterthan those.
2) National cybersecurity capacities must be enhanced comprehensively over thevarious capacity areas that are necessary for nations.
3) National cybersecurity capacities must be enhanced up to the levels that can matchthe capacities of the attackers and other hostile nations.

1.4 Importance of National Approaches for Cybersecurity Capacity
Enhancement
The public sector has the responsibilities to ensure that the national cybersecurity
capacities are sufficient and to enhance the capacities satisfying the following three
conditions (as stated in section 1.3)
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, or even fasterthan those. (hereafter ‘condition 1 “velocity”’)
2) National cybersecurity capacities must be enhanced comprehensively over thevarious capacity areas that are necessary for nations. (hereafter ‘condition 2“coverage”’)
3) National cybersecurity capacities must be enhanced up to the levels that can matchthe capacities of the attackers and other hostile nations. (hereafter ‘condition 3“levels”’)
If the condition 1 “velocity” is not satisfied, the capacities will not effectively mitigate
the risk. For example, even if a security device capable to detect unknown malwares is

20

Chapter 1. Introduction

developed and used, if cyber-attackers have already developed the techniques to evadesuch a device, the defender may not effectively prevent the malwares to intrude.
If the condition 2 “coverage” is not satisfied, the capacities will not effectively
mitigate the risk. For example, even if the countermeasures against cyber-attacks arerobust, if the legal framework against cybercrimes are unestablished, cyber-attackers will
be encouraged to act vigorously and even foreign attackers may be attracted to recognise
the nation as an attacking base.
If the condition 3 “levels” is not satisfied, the capacities will not effectively mitigate
the risk. For example, even if the approaches are executed successfully to promote theanti-malware softwares used in the PCs that have internet connectivity and such PCs
become secure, if cyber-attackers shift their attacking accesses to the PCs that are notconnected to internet and/or to the IoTs (Internet of Things), the above-mentioned
approaches alone cannot sufficiently contribute to the security of the network and need
to be considered for expansion to promote security on the wider coverage of the devices.
Additionally, a nation must carry out the enhancement of its cybersecurity capacities
efficiently. This is the fourth condition.
4) National cybersecurity capacities must be enhanced efficiently so that it can extract
the optimised effects from the limited resources. (hereafter ‘condition 4“efficiency”’)
If the condition 4 “efficiency” is not satisfied, i.e., if the enhancement of the capacities
is done inefficiently, it will be a waste of taxpayers’ money, and moreover, may be
preventing other more important approaches from being implemented. For example, two
or more government agencies plan and execute the different approaches that are aimed
at the same result, they may possibly be integrated into fewer and more efficientapproaches. Or, if the approaches that are aimed at the very basic cybersecurity, forexample, the promotion of anti-malware softwares, are continued even after such
attitudes have been widespread, it should be considered to cancel the approaches andreallocate the resources to others such as awareness raising of IoT security, etc.
Thus, the public sector must assure that the enhancement of the national cybersecurity
capacities satisfies the four conditions. Can they check it by assessing the enhanced
capacities? No. It’s already dissatisfactory in the condition 1 “velocity”. They must checkit before enhancing. Therefore, the public sector must ensure that the approaches forenhancement of the national cybersecurity capacities are planned so that the four
conditions will be satisfied.

21

Chapter 1. Introduction

1.5 Purposes of this Research
In the previous sections (1.1 - 1.4), it was pointed out that the cyber-attacks became
more serious and the sufficient national cybersecurity capacity became essential in orderto retain safe and secure life of citizens. Moreover, rapid development of information
technology, skills of cyber-attackers and capacities of other nations forces a nation toenhance the national capacities at the same velocity or even faster. If a nation falls behind,it will require very hard work and high cost to catch up. In order to avoid falling behind,a nation must assure that the enhancement covers the necessary capacity areas
comprehensively and aims at the levels to match the opponents, as well as being efficient.
Thus, the public sector must ensure that the approaches for enhancement of the national
cybersecurity capacities are satisfying the following four conditions.
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, or even fasterthan those. (condition 1 “velocity”)
2) National cybersecurity capacities must be enhanced comprehensively over thevarious capacity areas that are necessary for nations. (condition 2 “coverage”)
3) National cybersecurity capacities must be enhanced up to the levels that can matchthe capacities of the attackers and other hostile nations. (condition 3 “levels”)
4) National cybersecurity capacities must be enhanced efficiently so that it can extract
the optimised effects from the limited resources. (condition 4 “efficiency”)
Then, how can they make sure that the approaches are satisfying the four conditions?
The purpose of this research is to help ensuring it by providing with the method tocheck the approaches for the national cybersecurity capacity enhancement. The tool thatis used in the method is also proposed.
The method (and the tool) can be used in the following occasions.
1) When policymakers ensure that the existing approaches are satisfying the conditions.
2) When policymakers check that the planned approaches are satisfying the conditions.
3) When policymakers plan the new approaches to enhance particular capacities.
4) When the third parties review the approaches if they are satisfying the conditions.
5) When anyone learn the aims and the targeted levels of the approaches of othernation(s).
In order to check the appropriateness of the national approaches (or regulations), thepolicy appraisal and evaluation (or regulatory impact analysis) are widely executed [7].
The proposed method is complementary to the appraisal and evaluation. The difference
between the proposed method and the appraisal and evaluation is discussed in section 2.2,
where it is also indicated that the former complements the latter.
22

Chapter 1. Introduction

Additionally, the national approaches for cybersecurity capacity enhancement must be
considered for improvement if the approaches appear to be dissatisfying any of the four
conditions. In order to support such consideration and decision making for alteration,
addition and/or reduction of the approaches, the database of the approaches is also
proposed in this research.

1.6 Contribution of this Research
By proposing the method and the tool to check the appropriateness of the approaches
for the national cybersecurity capacity enhancement, this research will contribute toward
ensuring the appropriateness of the approaches. And the method, the tool and the
database will help improving the approaches. Then, they should contribute toward
improvement of the national cybersecurity capacities. Ultimately, this research is aiming
at contribution to the decrease of cyber-attacks world-wide and reduction of the possible
damages caused by cyber-attacks.
In order for the research to contribute toward improvement of the approaches, it isdesirable that the policymakers carry out the check of the approaches using the method
and the tool, and refer to the database for consideration of improvement of the approaches.
However, it is not necessarily the policymakers but anyone else who use the method, tooland database. If anyone other than the policymakers of the nation, or even anyone outsideof the nation carry out the check of the approaches and the result informs to the decisionof the approaches, this research can contribute towards improvement of the approachesof that nation.
In the verification process, the author checked the approaches of Japan and the United
Kingdom. Even if the author continues checking the approaches of other nations, thenumber of the nations whose approaches are check by the method will be limited.
However, if other people join and check the approaches of various nations using themethod, the approaches of an increased number of nations will be checked and thecontribution of this research will be greater.
The method is designed so that the checking result will not be much inconsistentsubject to the person who use it. The discussion about the reproducibility is in section
4.5.2.
Furthermore, the database that is proposed in this research can be used with or without
the checking method. In other words, while the database can be used after checking theapproaches using the method, it can also be used on its own for consideration of
improvement of the approaches.
Therefore, this research is supposed to contribute widely toward improvement of theapproaches, the national cybersecurity capacities and ultimately cyber threat
environment.

23

Chapter 1. Introduction

1.7 Definition
1.7.1 Definition of Capacity
In this research, national ability to do something with regard to cybersecurity iscalled “capacity”. “Capacity” also includes the state where something is at a
certain status that enables something to be done with regard to cybersecurity. For
example, the followings all describe that the nation has capacities.
1) Law enforcement can utilise sophisticated digital forensic tools.
2) Analytical capacity exists to support the coordination of resource allocation
for national cyber defence;3) The majority of users trust in the secure use of e-commerce services andmake use of them.
4) Cybersecurity standards and good practices in guiding procurement
processes are being adhered to widely within public and private sectors.
On the other hand, “capability” is not used in this research except for the cases
referring to the Capability Maturity Model Integration, because it is not essential
in this research that an ability is capacity or capability. Please note that anotherexception using “capability” is the name of the Cybersecurity Capability Maturity
Model v1.2 in December 2014, which then was renamed as the Cybersecurity
Capacity Maturity Model for Nations Revised Edition in February 2017. The
publisher of the models is the Global Cyber Security Capacity Centre.
Additionally, “capacity area” means the domain where some capacities
assemble to enable something more significant with regard to cybersecurity, forexample;1) Identification of incidents.
2) Risk management and response in critical infrastructure protection.
3) Executive awareness raising.
4) Legislative framework for ICT security.
5) Adherence to ICT security standards.
6) Responsible disclosure.
and so on.

1.7.2 Definition of Approach
In this research, the “approaches” mean practical actions that are performed by
the public sector. The actions carried out by the central government of a nation
are usually classified to the following three tiers; [7]1) Policy: a basic course to counteract against a concern
2) Program: a practical means to achieve the objective of the policy
24Chapter 1. Introduction

3) Project: an individual project/service under the program
The actions that are the subjects of this research range from the programs to theprojects. Therefore, the “approach” represents the programs and the projects thatare the subjects of the research.
The approaches that are planned and executed in order to enhance the national
cybersecurity capacities are the subjects of the research. The approaches carriedout by organisations and enterprises in order to enhance their capacities or tocounteract against cyber-attacks are not the subjects of this research. However,the cybersecurity capacities of the organisations and enterprises are the parts of
the national cybersecurity capacity. Therefore, a national approach that urges theorganisations and enterprises to bring about the approaches for enhancing theircapacities is included in the subjects of the research.

25

(Blank Page)
26

Chapter 2. Related Researches

Chapter 2. Related Researches
2.1 Introduction
The purpose of this research is to provide with the method and the tool to check if thenational approaches for cybersecurity capacity enhancement are satisfying the following
four conditions.
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, or even fasterthan those. (condition 1 “velocity”)
2) National cybersecurity capacities must be enhanced comprehensively over thevarious capacity areas that are necessary for nations. (condition 2 “coverage”)
3) National cybersecurity capacities must be enhanced up to the levels that can matchthe capacities of the attackers and other hostile nations. (condition 3 “levels”)
4) National cybersecurity capacities must be enhanced efficiently so that it can extract
the optimised effects from the limited resources. (condition 4 “efficiency”)
As mentioned in section 1.5, the policy appraisal and evaluation are widely executed.
The survey about the policy appraisal and evaluation revealed that the existing appraisal
and evaluation do not satisfy the purpose of this research. Therefore, the proposed
method is necessary in order to complement the appraisal and evaluation. The survey
about the appraisal and evaluation is introduced in section 2.2.
Thus, the method is necessary to check if the national approaches are satisfying thefour conditions. The survey revealed that there does not exist any such method at present,
but there do exist the benchmarkings of the national cybersecurity capacities.
Benchmarking the national capacities is different from checking the national approaches
for capacity enhancement. Nevertheless, the benchmarkings of the national cybersecurity
capacities were surveyed to see if the tools can be used for checking the approaches.
The survey about the benchmarkings revealed the tools for benchmarking cannot be
used for checking the approaches. However, it was also revealed that one of those tools
can become the basis of the tool that will be used in the method for checking theapproaches. The survey about the benchmarkings is introduced in section 2.3.
Also, there exist the tools to guide the organisations and enterprises for enhancementof their cybersecurity. One of the most notable guidelines of the kind is the “Framework
for Improving Critical Infrastructure Cybersecurity” (hereafter “NIST framework”)
established by the National Institute of Standards and Technology (NIST) of the UnitedStates [8]. However, the NIST framework is targeted at enterprises and organisations,and does not cover some of the capacity areas that nations have to have, for example, the27Chapter 2. Related Researches

anti-cybercrime legal framework. Therefore, the NIST framework cannot check thecondition 2 “coverage” at least, and is apparently not suitable for checking the national
approaches. Other tools and guidelines for cybersecurity for organisations and enterprises
are surveyed but no such tools or guidelines that are suitable for checking the national
approaches were found. The survey about the tools and guidelines for organisations andenterprises is introduced in section 2.4.
The survey about the policy appraisal and evaluation, the benchmarkings of thenational cybersecurity capacities, and the tools and guidelines for cybersecurity fororganisations and enterprises revealed that the existing tools are not suitable for checking
the approaches, and the method and the tool for checking the approaches for national
cybersecurity capacity enhancement should be created. The survey also revealed that oneof the benchmarking tools can be used as the basis for the checking tool.
Then, the Capability Maturity Model Integration” (hereafter “CMMI”) was surveyed
because the CMMI is a process improvement program and was supposed to give good
implication for the development of the method and the tool that are aimed at improving
the approaches. The survey about the CMMI is introduced in section 2.5.

28

Chapter 2. Related Researches

2.2 Policy Appraisal and Evaluation
2.2.1 What are Policy Appraisal and Evaluation
It is pointed out that the role of the public sector must be based on the market
principle and divided clearly from the roles of the private sector. The public sector
itself must function more efficiently. Moreover, the public sector must refresh its
recognition that it owes to account for its activities both in ex ante and ex post
manners. One of the mechanisms to do that is the “policy appraisal and evaluation”
which is sometimes referred to as a “quality management of policy” [7] (originalin Japanese).
The Green Book: Central Government Guidance on Appraisal and Evaluation[9] published by the Treasury of the United Kingdom says that the policy appraisalis the process of assessing the costs, benefits and risks of alternative ways to meetgovernment objectives. It helps decision makers to understand the potential
effects, trade-offs and overall impact of options by providing an objective
evidence base for decision making. Economic appraisal is based on the principles
of welfare economics – that is, how the government can improve social welfare
or wellbeing, referred to in the Green Book as social value. According to thedefinition in the green book, the policy appraisal is done before policy
implementation while the policy evaluation is the systematic assessment of anintervention’s design, implementation and outcomes and done after
implementation.
The policy appraisal and evaluation vary by nations and by fields of activitiesof the public sector [7].
Regulations: In the U.K., the U.S.A., Canada, Australia and so on, when the
public sector implements a new regulation or alters the existing regulation, theappraisal of the regulation must be carried out. This appraisal is usually called“Regulatory Impact Assessment (RIA)” or “Regulatory Impact Analysis (RIA)”.
RIA consists of explanation of the necessity of the regulation, the estimated costs
and benefits arising from the implementation of the regulation, explanation thatthe benefits exceed the costs and comparison among the alternatives. In somenations, publication of the result of the RIA and collection of the public comments
are mandatory.
Public Works Projects: The appraisal for the public works projects has been
executed for very long time. Appraisal is usually done by cost-benefit analyses.
Science and Technology Researches: The evaluation of resource allocation ismainly used for the appraisal of science and technology researches policy rather
than cost-benefit analysis.

29

Chapter 2. Related Researches

Official Development Assistance: The appraisal for official development
assistance (ODA) has been institutionalised for long time. Appraisal andevaluation are done both before and after the project.
General Public Sector Services/Activities: Various appraisal methods are
institutionalised for the appraisal of general public sector services and activities.
The Green Book [9] of the U.K. is the general guideline for the policy appraisal
in the U.K.

2.2.2 Effectiveness and Limitations of Policy Appraisal and Evaluation
As mentioned in section 2.2.1, the policy appraisal and evaluation are widely
carried out for the various policy fields under the various institutionalised systems
using the various methods. The policy appraisal and evaluation are the processesof assessing the costs, benefits and risks, and mainly focus on 3E (economy,
efficiency and effectiveness).
Kodama says in “Verification of the Policy Appraisal and Evaluation of theUnited Kingdom and Suggestion to Japan” [10] that the policy appraisal andevaluation of the U.K. originated from the Comprehensive Spending Review(CSR) in 1998 (Original in Japanese). The CSR is a governmental process in the
U.K. to set the expenditure limits and define the improvements. In 1997, Tony
Blair, leader of the Labour Party, became the Prime Minster of the U.K. after 18
years of governance of the Conservative Party. Mr. Blair coped withadministrative and financial reforms under his pledge “Modernising Government”
and published Economic and Fiscal Strategy Report (EFSR). The CSR was basedon the EFSR. Thus, the CSR from which the policy appraisal and evaluation
evolved is aimed at streamlining the expenditure of the public sector.
Therefore, the policy appraisal and evaluation alone cannot assure that theapproaches effectively enhance the national cybersecurity capacities.
For example, even if the approaches are effectively implemented to enhance thecapability of the law enforcement for tackling cyber-crimes and arresting thecriminals, if there do not exist any plan to enhance the capabilities of theprosecutors to handle the digital evidence and to pursue the cyber cases, the nation
may become a good haven for cyber-attackers. The policy appraisal andevaluation can probably improve the approaches for enhancing the law
enforcement, but may fail to point out the lack of the approaches for enhancing
the prosecution.
Thus, the policy appraisal and evaluation are good at evaluating theeffectiveness and efficiency of the approaches (and their alternatives) that havecome up for discussion, but are not suitable for discovery of the approaches thathave not. In other words, the policy appraisal and evaluation cannot check if the30

Chapter 2. Related Researches

approaches satisfy the condition 2 “coverage”, while they are supposed to besuitable for checking the condition 4 “efficiency”.

2.2.3 Policy Appraisal and Evaluation and Proposed Method Coexist
As mentioned in the previous section (section 2.2.2), the policy appraisal andevaluation are not suitable for discovering the approaches that have not come up
for discussion. The proposed method is most useful in finding out such approaches.
It can discover the cybersecurity capacity areas that the approaches are notplanned to enhance sufficiently by some reasons. The reasons may include thatthe areas are considered to have been enhanced enough, that the areas are
considered necessary to be enhanced but not prioritised, or that the areas are notrecognised to be important. After discovery, the reasons should be examined andthe additional approaches should be planned if necessary. Then the new
approaches will be appraised accordingly.
The proposed method can also discover the capacity areas for which theapproaches are planned possibly inefficiently. It can be used as an indicator forthe policy appraisal and evaluation to be focused on. The policy appraisal andevaluation are the processes that require a lot of hard and nervous work. By
pointing out the possibly inefficient capacity areas, the proposed method may
improve the effectiveness of the policy appraisal and evaluation.
Thus, the policy appraisal and evaluation and the proposed method can coexist.
The proposed method will complement the policy appraisal and evaluation. The
combination is considered to contribute to the effectiveness of the cybersecurity
policy.

31

Chapter 2. Related Researches

2.3 Benchmarking of National Cybersecurity Capacities
2.3.1 ITU Global Cybersecurity Index
In July 2017, the Cybersecurity Team of the International Telecommunication
Union (ITU) investigated and announced the Global Cybersecurity Index(hereafter “GCI”) 2017 as a measure of the commitment of countries tocybersecurity [11]. This is their second iteration following the GCI presented in
2014.
The GCI is a composite index that combines 25 indicators categorised into fivepillars: Legal, Technical, Organizational, Capacity Building and Cooperation.
Nations receive and answer the questionnaires that include 157 questions. The
questionnaires are collected and scored.
The GCI 2017 top 13 nations are shown in the Table 2.3-1.
Table 2.3-1 Top 13 Nations in GCI 2017
Rank
Nation1 Singapore
2 United States of America
3 Malaysia
4 Oman5 Estonia
6 Mauritius
7 Australia
8 Georgia
France10 Canada
11 Russia
12 Japan
Norway

Score
0.925
0.919
0.893
0.871
0.846
0.830
0.824
0.819
0.819
0.818
0.788
0.786
0.786

The GCI covers 193 ITU member states.
The questions included in the questionnaires are simple and understandable, forexample:- Is there any substantive cybercriminal law?
- Are there any articles on the unauthorized access of computers, systems anddata?
- Is there any cybersecurity training for law enforcement officers, judicial andother legal actors?
- Is the training recurring?
and so on.

32Chapter 2. Related Researches

The questions are not considered to be comprehensive as a measurement of thenational cybersecurity capacities. Also, the questions are not prioritised.
Therefore, the GCI does not have the levels of cybersecurity capacities.
The GCI cannot check the national approaches. In addition, it cannot become
the basis of the checking tool, because it would not check the condition 2“coverage” or the condition 3 “levels” of the approaches.

2.3.2 Cybersecurity Capacity Maturity Model
The Global Cyber Security Capacity Centre founded around Oxford University
released the Cybersecurity Capability Maturity Model v1.2 in December 2014 as
the first public edition, and the Cybersecurity Capacity Maturity Model for
Nations Revised Edition (hereafter “CSCMMN”) in February 2017 [12, 13].
The Cybersecurity Capability/Capacity Maturity Models are aimed at assisting
nations in improving their cybersecurity capacities in systematic and substantive
ways.
The Global Cyber Security Capacity Centre considers cybersecurity capacity tocomprise the following five ‘dimensions’.
1) Devising cybersecurity policy and strategy
2) Encouraging responsible cybersecurity culture within society3) Developing cybersecurity knowledge
4) Creating effective legal and regulatory frameworks5) Controlling risks through standards, organisations and technologies
Each dimension is categorised into several ‘factors’, which are then divided into
multiple ‘aspects’ (in the Revised Edition. It was called as ‘category’ in the v1.2).
The Revised Edition has five dimensions, 24 factors and 53 aspects (the v1.2 had
five dimensions, 20 factors and 47 categories).
The Centre also defined the five ‘stages’ (‘levels’ in the v1.2) as the degree ofthe progress of the nation in relation to a certain aspect of cybersecurity capacity.
The five stages are ‘start-up’, ‘formative’, ‘established’, ‘strategic’ and ‘dynamic’,with the ‘start-up’ being the very first stage and the ‘dynamic’ being the mostdeveloped.
Each stage has ‘indicators’ which describe the steps, actions, or building blocks
that are indicative of a specific stage of maturity within a distinct aspect. A nationmust fulfil all indicators within a particular stage to advance to the next stage.
The relationship of ‘dimension’, ‘factor’, ‘aspect’, ‘stage’ and ‘indicator’ isshown in the Figure 2.3-1.

33

Chapter 2. Related Researches

Start-upstage
Indicator

Formative
stage
Indicator
Indicator
Indicator

Dimension
FactorAspectEstablishedstage
Indicator
Indicator

Strategic
stage
Indicator
Indicator
Indicator

Dynamic
stage
Indicator
Indicator

Figure 2.3-1 Relationship of Elements in CSCMMN(Produced based on the Cybersecurity Capacity Maturity Modelfor Nations Revised Edition)
Uganda, Senegal, Bhutan and Kosovo had pilot assessments using the v1.2 andthe official assessment of the United Kingdom was carried out with the sameversion [14, 15, 16, 17, 18]. Latin American and Caribbean states had assessments
under the initiatives of the Organization of American States and the InterAmerican Development Bank with a slightly different version from either the v1.2
or the Revised Edition [19].
Also, the nations namely, Albania, Armenia, Bangladesh, Bosnia andHerzegovina, Cyprus, Fiji, Gambia, Georgia, Ghana, Iceland, Indonesia,
Kyrgyzstan, Lithuania, Macedonia, Madagascar, Montenegro, Myanmar, Samoa,
Sierra Leone, Thailand, Tonga and Zambia had carried out the assessment using
either the v1.2 or the Revised Edition. As of December 2018, the CSCMMs havebeen deployed almost 100 times according to the Global Cyber Security Capacity
Centre web site [20].
The CSCMMN has more than 500 indicators in as many as 53 aspects. A lot of
researchers and business people from all over the world have been involved informulating the model. It is believed to include the cybersecurity capacities that anation has to have comprehensively. Therefore, the CSCMMN appears to besuitable for checking the condition 2 “coverage” of the approaches, while it has
the level (called as the ‘stages’ in the CSCMMN) structures and is suitable forchecking the condition 3 “levels”.
The CSCMMN is designed for benchmarking the national cybersecurity
capacities, not for checking the approaches. Therefore, it cannot be used as themethod for checking the approaches, but can become the basis for the checking
tool because of its characteristics that are suitable for checking the condition 2“coverage” and the condition 3 “levels”.

34Chapter 2. Related Researches

2.3.3 Other Benchmarking Models
Other models for benchmarking the national cybersecurity capacities, forexample, “Cyber Maturity” [21] of the Australian Strategic Policy Institute and“Cybersecurity Dashboard” [22] of the Software Alliance (BSA), are also
surveyed.
There do not exist any benchmarking models that can be used for checking theapproaches, nor can become the better basis for the checking tool than the
CSCMMN, because the other models are simple and seem to be focusing on
geographical coverage as the comparison of the national cybersecurity capacities.

35

Chapter 2. Related Researches

2.4 Guidelines for Enterprises and Organisations
2.4.1 NIST Framework
In February 2013, President Barack Obama of the United States of America
issued Executive Order (EO) 13636 “Improving Critical Infrastructure
Cybersecurity”, recognising the national and economic security of the UnitedStates depends on the reliable function of critical infrastructure. The National
Institute of Standards and Technology (NIST) worked with stakeholders todevelop a voluntary framework for reducing cyber risks to critical infrastructure,
based on existing standards, guidelines, and practices.
The NIST released the “Framework for Improving Critical Infrastructure
Cybersecurity Version 1.0” in February 2014, which was then updated andreleased as Version 1.1 in April 2018 [8].
The NIST framework is composed of three parts, namely “Framework Core”,“Framework Implementation Tiers” and “Framework Profiles”.
The framework core is a set of cybersecurity activities, desired outcomes andapplicable references that are common across critical infrastructure sectors, andpresents industry standards, guidelines and practices. The core consists of fiveconcurrent and continuous functions, Identify, Protect, Detect, Respond, Recover,then identifies underlying key categories and subcategories for each function.
The framework implementation tiers provide context on how an organisation
views cybersecurity risk and the processes in place to manage that risk. The tiers
describe the degree to which an organisation’s cybersecurity risk management
practices exhibit the characteristics defined in the framework. The tiers
characterise an organisation’s practices over a range, from Partial (Tier 1) to
Adaptive (Tier 4).
A framework profile represents the outcomes based on business needs that anorganisation has selected from the framework categories and subcategories. The
profile can be characterised as the alignment of standards, guidelines, andpractices to the framework core in a particular implementation scenario. The
profiles can be used to identify opportunities for improving cybersecurity posture
by comparing a “Current” profile with a “Target” profile.
The functions, categories and subcategories of the framework core are shownin the Table 2.4-1.
As shown in the Table 2.4-1, the NIST framework is a comprehensive guideline
for cybersecurity capacities for enterprises and organisations, but does not coversome of the capacity areas that nations have to have, for example, the anticybercrime legal framework.
36Chapter 2. Related Researches

Table 2.4-1 Functions, Categories and Subcategoriesof the NIST Framework Core
Function
CategoryID:
ID.AM:
Identify AssetManagement

PR:
Protect

Subcategory (98 subcategories)
ID.AM-1 Physical devices and systems within the organization are
inventoried
ID.AM-2 Software platforms and applications within theorganization are inventoried
ID.AM-3 Organizational communication and data flows are
mappedID.AM-4 External information systems are catalogued
ID.AM-5 Resources (e.g., hardware, devices, data, and software)are prioritized based on their classification, criticality,and business value
ID.AM-6 Cybersecurity roles and responsibilities for the entire
workforce and third-party stakeholders (e.g., suppliers,
customers, partners) are established
ID.BE:
ID.BE-1 The organization’s role in the supply chain is identified
and communicatedBusiness
The organization’s place in critical infrastructure and its
ID.BE-2
Environment
industry sector is identified and communicatedID.BE-3 Priorities for organizational mission, objectives, andactivities are established and communicatedID.BE-4 Dependencies and critical functions for delivery ofcritical services are established
ID.BE-5 Resilience requirements to support delivery of criticalservices are established
ID.GV:
ID.GV-1 Organizational information security policy is established
Governance
ID.GV-2 Information security roles & responsibilities arecoordinated and aligned with internal roles and external
partners
ID.GV-3 Legal and regulatory requirements regarding
cybersecurity, including privacy and civil liberties
obligations, are understood and managed
ID.GV-4 Governance and risk management processes address
cybersecurity risks
ID.RA:
ID.RA-1 Asset vulnerabilities are identified and documented
Risk Assessment ID.RA-2 Threat and vulnerability information is received frominformation sharing forums and sources
ID.RA-3 Threats, both internal and external, are identified anddocumented
ID.RA-4 Potential business impacts and likelihoods are identified
ID.RA-5 Threats, vulnerabilities, likelihoods, and impacts are used
to determine risk
ID.RA-6 Risk responses are identified and prioritized
ID.RM:
ID.RM-1 Risk management processes are established, managed,
and agreed to by organizational stakeholders
Risk
ID.RM-2 Organizational risk tolerance is determined and clearlyManagement
expressed
Strategy
ID.RM-3 The organization ’ s determination of risk tolerance isinformed by its role in critical infrastructure and sector
specific risk analysis
PR.AC:
PR.AC-1 Identities and credentials are managed for authorized
devices and users
Access Control
PR.AC-2 Physical access to assets is managed and protected
PR.AC-3 Remote access is managed
PR.AC-4 Access permissions are managed, incorporating theprinciples of least privilege and separation of duties
PR.AC-5 Network integrity is protected, incorporating network
segregation where appropriate(continue…)

37

Chapter 2. Related Researches

Function

Category
PR.AT:
Awareness andTraining

PR.DS:
Data Security

PR.IP:
Information
Protection
Processes andProcedures

PR.MA:
Maintenance

PR.PT:
Protective
Technology

DE:
DetectDE.AE:
Anomalies andEventsSubcategory (98 subcategories)
PR.AT-1 All users are informed and trained
PR.AT-2 Privileged users understand roles & responsibilities
PR.AT-3 Third-party stakeholders (e.g., suppliers, customers,
partners) understand roles & responsibilities
PR.AT-4 Senior executives understand roles & responsibilities
PR.AT-5 Physical and information security personnel understandroles & responsibilities
PR.DS-1 Data-at-rest is protected
PR.DS-2 Data-in-transit is protected
PR.DS-3 Assets are formally managed throughout removal,transfers, and disposition
PR.DS-4 Adequate capacity to ensure availability is maintained
PR.DS-5 Protections against data leaks are implemented
PR.DS-6 Integrity checking mechanisms are used to verify
software, firmware, and information integrity
PR.DS-7 The development and testing environment(s) are separate
from the production environment
baseline
configurationof
information
PR.IP-1 A
technology/industrial control systems is created andmaintained
PR.IP-2 A System Development Life Cycle to manage systems is
implemented
PR.IP-3 Configuration change control processes are in place
PR.IP-4 Backups of information are conducted, maintained, andtested periodically
PR.IP-5 Policy and regulations regarding the physical operating
environment for organizational assets are met
PR.IP-6 Data is destroyed according to policy
PR.IP-7 Protection processes are continuously improved
PR.IP-8 Effectiveness of protection technologies is shared withappropriate parties
PR.IP-9 Response plans (Incident Response and BusinessContinuity) and recovery plans (Incident Recovery andDisaster Recovery) are in place and managed
PR.IP-10 Response and recovery plans are tested
PR.IP-11 Cybersecurity is included in human resources practices(e.g., deprovisioning, personnel screening)
PR.IP-12 A vulnerability management plan is developed andimplemented
PR.MA-1 Maintenance and repair of organizational assets is
performed and logged in a timely manner, with approvedand controlled tools
PR.MA-2 Remote maintenance of organizational assets isapproved, logged, and performed in a manner thatprevents unauthorized accessPR.PT-1 Audit/log records are determined, documented,
implemented, and reviewed in accordance with policy
PR.PT-2 Removable media is protected and its use restrictedaccording to policy
PR.PT-3 Access to systems and assets is controlled, incorporating
the principle of least functionality
PR.PT-4 Communications and control networks are protected
DE.AE-1 A baseline of network operations and expected data flows
for users and systems is established and managed
DE.AE-2 Detected events are analyzed to understand attack targets
and methods
DE.AE-3 Event data are aggregated and correlated from multiple
sources and sensors
DE.AE-4 Impact of events is determined
DE.AE-5 Incident alert thresholds are established(continue…)

38

Chapter 2. Related Researches

Function

Category
DE.CM:
Security
Continuous
Monitoring

DE.DP:
Detection
Processes

Subcategory (98 subcategories)
DE.CM-1 The network is monitored to detect potential
cybersecurity events
DE.CM-2 The physical environment is monitored to detect
potential cybersecurity events
DE.CM-3 Personnel activity is monitored to detect potential
cybersecurity events
DE.CM-4 Malicious code is detected
DE.CM-5 Unauthorized mobile code is detected
DE.CM-6 External service provider activity is monitored to detect
potential cybersecurity events
DE.CM-7 Monitoring for unauthorized personnel, connections,devices, and software is performed
DE.CM-8 Vulnerability scans are performed
DE.DP-1 Roles and responsibilities for detection are well definedto ensure accountability
DE.DP-2 Detection activities comply with all applicablerequirements
DE.DP-3 Detection processes are tested
DE.DP-4 Event detection information is communicated toappropriate parties
DE.DP-5 Detection processes are continuously improved
RS.RP-1 Response plan is executed during or after an event

RS:
RS.RP:
Respond Response
Planning
RS.CO:
RS.CO-1
Communications
RS.CO-2
RS.CO-3
RS.CO-4
RS.CO-5
RS.AN:
Analysis

RS.MI:
Mitigation

RS.AN-1
RS.AN-2
RS.AN-3
RS.AN-4
RS.MI-1
RS.MI-2
RS.MI-3

RS.IM:
RS.IM-1
Improvements
RS.IM-2
RC:
RC.RP:
RC.RP-1
Recover Recovery
Planning
RC.IM:
RC.IM-1
Improvements
RC.IM-2
RC.CO:
RC.CO-1
Communications RC.CO-2
RC.CO-3

Personnel know their roles and order of operations whena response is needed
Events are reported consistent with established criteria
Information is shared consistent with response plans
Coordination with stakeholders occurs consistent withresponse plans
Voluntary information sharing occurs with external
stakeholders to achieve broader cybersecurity situationalawareness
Notifications from detection systems are investigated
The impact of the incident is understood
Forensics are performed
Incidents are categorized consistent with response plans
Incidents are contained
Incidents are mitigated
Newly identified vulnerabilities are mitigated or
documented as accepted risks
Response plans incorporate lessons learned
Response strategies are updated
Recovery plan is executed during or after an event
Recovery plans incorporate lessons learned
Recovery strategies are updated
Public relations are managed
Reputation after an event is repaired
Recovery activities are communicated to internal
stakeholders and executive and management teams

39Chapter 2. Related Researches

2.4.2 FFIEC CAT
The Federal Financial Institutions Examination Council (FFIEC) wasestablished in March 1979, and is a formal interagency body empowered by thefive banking regulators of the United States of America to prescribe uniform
principles, standards, and report forms for the federal examination of financial
institutions and to make recommendations to promote uniformity in the
supervision of financial institutions. The five banking regulators are the Board ofGovernors of the Federal Reserve System (FRB), the Federal Deposit Insurance
Corporation (FDIC), the National Credit Union Administration (NCUA), theOffice of the Comptroller of the Currency (OCC) and the Consumer Financial
Protection Bureau (CFPB).
In light of the increasing volume and sophistication of cyber threats, the FFIEC
developed the “Cybersecurity Assessment Tool” (hereafter “CAT”) to help
institutions identify their risks and determine their cybersecurity preparedness[23]. The CAT provides a repeatable and measurable process for financial
institutions to measure their cybersecurity preparedness over time.
The CAT consists of two parts: Inherent Risk Profile and Cybersecurity
Maturity.
Cybersecurity inherent risk is the level of risk posed to the institution, andincorporates the type, volume, and complexity of the institution’s operations andthe threats directed at the institution. Inherent risk does not include mitigating
controls.
The inherent risk profile (image is shown in the Table 2.4-2) includes
descriptions of activities across risk categories with definitions for the least to
most levels of inherent risk, and thus helps management determine institution’s
exposure to risk.
The cybersecurity maturity (image is shown in the Table 2.4-3) is designed tohelp management measure the institution’s level of risk and corresponding
controls. The levels range from baseline to innovative. The cybersecurity maturity
includes statements to determine whether an institution’s behaviours, practices,and processes can support cybersecurity preparedness.
Once the two parts of the CAT are completed, management can evaluate
whether the institution’s inherent risk and preparedness are aligned. The
risk/maturity relationship (shown in the Table 2.4-4) depicts the relationshipbetween an institution’s inherent risk profile and its domain maturity levels. In
general, as inherent risk rises, an institution’s maturity levels should increase. But
there is no single expected level for an institution. An institution’s inherent risk
profile and maturity levels will change over time as threats, vulnerabilities, andoperational environments change. Thus, management should consider
40Chapter 2. Related Researches

reevaluating the institution’s inherent risk profile and cybersecurity maturity
periodically and when planned changes can affect its inherent risk profile.
Designed for financial institutions, the FFIEC CAT includes the componentsthat are not applicable to the non-financial corporates or organisations, forexample, automated teller machines (ATM) (category: delivery channel), issue
debit or credit cards (category: online/mobile products and technology services),originating wholesale payments (e.g., CHIPS) (category: online/mobile products
and technology services), and so on.
On the other hand, the CAT requires the maturity assessment after assigning
the risk profile. In other words, the institutions who have higher risks need to
endeavour to achieve the higher maturities. Those who have lower risks do nothave to seek for the higher maturities but need to care about the basic maturities.
This structure is comprehensible and efficient as a guideline.
The FFIEC CAT is not applicable to nations, because it does not cover some of
the capacity areas that nations have to have, for example, the anti-cybercrime legal
framework.

41

Chapter 2. Related Researches

Table 2.4-2 Image of Inherent Risk Profile

Category: Technologies and Connection Types
Wholesale customers with dedicated connections
Internally hosted and developed or modified vendor applications
supporting critical activities
Internally hosted, vendor-developed applications supporting
critical activities
User-developed technologies and user computing that support
critical activities (includes Microsoft Excel spreadsheets andAccess databases or other user-developed tools)
End-of-life (EOL) systems
Open Source Software (OSS)
Network devices (e.g., servers, routers, and firewalls; include
physical and virtual)
Third-party service providers storing and/or processing
information that support critical activities (Do not have access tointernal systems, but the institution relies on their services)
Cloud computing services hosted externally to support criticalactivities
Category: Delivery Channels
Online presence (customer)
Mobile presence
Automated Teller Machines (ATM) (Operation)
Category: Online/Mobile Products and Technology Services
Issue debit or credit cards
Prepaid cards
Emerging payments technologies (e.g., digital wallets, mobile
wallets)
Person-to-person payments (P2P)
Originating ACH payments
Originating wholesale payments (e.g., CHIPS)
Wire transfers
Merchant remote deposit capture (RDC)
Global remittances
Treasury services and clients
Trust services
Act as a correspondent bank (Interbank transfers)
Merchant acquirer (sponsor merchants or card processor activity
into the payment system)
Host IT services for other organizations (either through joint
systems or administrative support)

Most

Significant

Moderate

MinimalLeast

Risk Levels

Descriptions(continue…)

42

Chapter 2. Related Researches

Least

MinimalModerate

Significant

Most

Least

MinimalModerate

Significant

Most

Risk Levels

Category: Organizational Characteristics
Mergers and acquisitions (including divestitures and joint
ventures)Direct employees (including information technology andcybersecurity contractors)
Changes in IT and information security staffing
Privileged access (Administrators–network, database,applications, systems, etc.)
Changes in IT environment (e.g., network, infrastructure, criticalapplications, technologies supporting new products or services)
Locations of branches/business presence
Locations of operations/data centers
Category: External Threats
Attempted cyber attacks
Number of statements selected in each risk level
Based on individual risk levels selected,
assign an inherent risk profile

43

Chapter 2. Related Researches

Table 2.4-3 Image of Cybersecurity Maturity

1 Cyber Risk
GovernanceOversight
Management
Strategy/Policies
and Oversight
IT Asset Management
Risk Management Risk Management Program
Risk Assessment
Audit
Resources
Staffing
Training
Culture2 Threat
ThreatThreat Intelligence andIntelligenceIntelligence
Information
andMonitoring and Monitoring and Analyzing
Collaboration Analyzing
Information
Information Sharing
Sharing
3 Cybersecurity Preventative
Infrastructure Management
Controls
Controls
Access and Data Management
Device/Endpoint Security
Secure Coding
Detective
Threat and Vulnerability
Controls
Detection
Anomalous Activity Detection
Event Detection
Corrective
Patch Management
Controls
Remediation
4 External
Connections
Connections
Dependency RelationshipDue Diligence
Management Management
Contracts
Ongoing Monitoring
5 Cyber
Incident
Planning
Incident
Resilience
Testing
Management Planning andand Resilience Strategy
Detection,
Detection
Response, andResponse and Mitigation
Mitigation
Escalation andEscalation and Reporting
Reporting44

Descriptions

Innovative

Advanced

ComponentIntermediate

Assessment
Factor

Evolving

DomainBaseline

Maturity Level

Chapter 2. Related Researches

Table 2.4-4 Risk/Maturity Relationship
Inherent Risk Levels

Cybersecurity
Maturity Levelfor Domain

Least

MinimalModerate

Significant

Most

Innovative
Advanced
Intermediate
Evolving
Baseline

2.4.3 Other Guidelines for Enterprises and Organisations
There exist a lot of cybersecurity guidelines designed for enterprises andorganisations, for example, “ISO/IEC 27032:2012” [24], “Cybersecurity
Management Guidelines” [25] co-developed by the Ministry of Economy, Tradeand Industry of Japan and the Independent Administrative Agency Informationtechnology Promotion Agency, and so on. However, they are designed forenterprises and organisations as well as for individuals, and are not suitable fornations.

45

Chapter 2. Related Researches

2.5 Guidelines for Software Development Process
2.5.1 CMMI for Development
The “Capability Maturity Model Integration” (hereafter “CMMI”) is a process
improvement training and appraisal program [26]. It was originally developed by
Software Engineering Institute (SEI) of Carnegie Mellon University (CMU) andis now developed by the CMMI project, which consists of members of industry,
public sector and SEI. The CMMI is required by many United States Government
contracts especially in software development.
Mary Beth Chrissis, Mike Konrad and Sandy Shrum, who are the authors of“CMMI for Development: Guidelines for Process Integration and ProductImprovement” [27], have stated in their book that we live in a world where
technology is changing at an incredible speed. To deal with such a world and to
maximize the productivity, we need to focus on process. Many organizations in
manufacturing and service industries now recognize the importance of quality
processes in addition to the process effectiveness and efficiency. Process helps anorganization’s workforce to work smarter, not harder, and with improved
consistency. Effective processes also provide a vehicle for introducing and using
new technology in a way that best meets the business objectives of theorganization.
The CMMI defines 22 process areas and five maturity levels. The process areas
are classified into four categories. Each process area is determined what maturity
level it is required. For the highest maturity level, all process areas must be
satisfied.
The maturity levels are characterised as follows, which draw the property of the
CMMI well.
1) Level 1 Initial: Processes unpredictable, poorly controlled and reactive.
2) Level 2 Managed: Processes characterized for projects and is often reactive.
3) Level 3 Defined: Processes characterized for the organizationand is proactive.
4) Level 4 Quantitatively Managed: Processes measured and controlled.
5) Level 5 Optimizing: Focus on process improvement
The process areas and the maturity levels that each area must be satisfied areshown in the Table 2.5-1.

46

Chapter 2. Related Researches

Table 2.5-1 The Process Areas of the CMMI

Quantitatively
Managed

x

x

x

x
x

3

x

x

x

3

x

x

x

x

x

x

3

x

x

x

3

x

x

x

Category

1 Casual Analysis and Resolution (CAR) Support
2 Configuration Management (CM)SupportDecision Analysis and Resolution
3
Support(DAR)
Project
4 Integrated Project Management (IPM)Management
5 Measurement and Analysis (MA)SupportOrganizational Process Definition Process
6(OPD)
Management
Process
7 Organizational Process Focus (OPF)
Management
Organizational
Performance Process
8Management (OPM)
Management
Organizational Process Performance Process
9(OPP)
Management
Process
10 Organizational Training (OT)Management
11 Product Integration (PI)Engineering
Project
12 Project Monitoring and Control (PMC)Management
Project
13 Project Planning (PP)Management
Process and Product Quality Assurance
14
Support(PPQA)
Quantitative Project Management Project
15(QPM)
Management
16 Requirements Development (RD)Engineering
Project
17 Requirements Management (REQM)
Management
Project
18 Risk Management (RSKM)Management
Supplier Agreement Management Project
19(SAM)
Management
20 Technical Solution (TS)Engineering
21 Validation (VAL)
Engineering
22 Verification (VER)
Engineering

5
2

2

x

5

Optimizing

DefinedProcess Area

Initial#ManagedMaturity Level

x

4

x

x

3

x

x

x

3

x

x

x

2

x

x

x

x

2

x

x

x

x

2

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x

x
x
x

x
x
x

x
x
x

4
3
2

x

3
2
3
3
3

x

Note: “x” denotes that the process area is required in the maturity level.

47

Chapter 2. Related Researches

2.5.2 Capability Levels and Maturity Levels in CMMI
The CMMI for development defines two representations; the continuous
representation and the staged representation [27].
The continuous representation is used by an organisation to improve processes
corresponding to an individual process area (or group of process areas), while thestaged representation is used to improve a set of related processes. The continuous
representation enables the organisation to achieve “capability levels”. The staged
representation enables to achieve “maturity levels”. In other words, the capability
levels apply to achievement of an organisation’s process improvement inindividual process areas, and the maturity levels apply to achievement of anorganisation’s process improvement across multiple process areas.
The definition of the capability levels is different from that of the maturity
levels mentioned in the 2.5.1. The comparison of the two definitions is shown in
the Table 2.5-2.
Table 2.5-2 Comparison of Definitions of Levels
Level
Level 0Level 1
Level 2
Level 3
Level 4
Level 5

Capability Levels(Continuous Representation)
Incomplete
Performed
ManagedDefined-Maturity Levels(Staged Representation)
InitialManagedDefinedQuantitatively Managed
Optimizing

It is notable that there do not exist the level 4 or 5 in the capability levels. Thismeans that there is no point in improving the capability in an individual processarea higher than the level 3. Instead, an organisation that wants to improve its
processes higher than the level 3 needs to aim at achieving the maturity levels. In
other words, an organisation can pay efforts on improving its capability until itreaches a certain level of capability, but after that it must focus on improving its
maturity.
Another notable characteristic of the maturity levels is that the definition of thelevel 5 is not “optimized” but “optimizing”. It insists that there is no perfection of
the processes and the processes must be improved everlastingly. In other words,
improvement of the capability transforms into improvement of the maturity, andthe maturity means the capability to improve its capabilities as a whole. In themost matured stage, the capabilities optimise autonomously and everlastingly.
When it is put into the case of cybersecurity capacity, a nation enhances its
cybersecurity capacity but it also has to consider cultivating the ability to improve48

Chapter 2. Related Researches

its capacities autonomously. It is very important because the very fastdevelopment of information technology and cyber-attackers’ skills do not allow anation to evaluate the effectiveness of the capacities one year and implement otherapproaches to enhance the inferior capacities the following year. A nation mustenhance the capacities immediately after they notice that the current capacities areleft behind the latest technology and skills. This means an autonomous evaluationenhancement process must be built-in into the capacities. Therefore, when thenational cybersecurity capacities are evaluated, the existence of an autonomousenhancement mechanism must be checked.
The fact that a nation must enhance the capacities immediately after they noticecorresponds to the condition 1 “velocity”. Therefore, the checklist will havefunctionality to check the condition 1 “velocity” by incorporating the items tocheck the autonomous enhancement mechanism.

2.6 Conclusion of Survey of Related ResearchesFirstly, it has been ascertained that the policy appraisal and evaluation do not find out
the approaches that have not come up for discussion. Therefore, the policy appraisal andevaluation are not suitable for checking if the approaches satisfy the condition 2“coverage”. Therefore, a complementary checking method is needed. Besides, the policy
appraisal and evaluation are supposed to be good at checking the condition 4 “efficiency”,
and, therefore, the proposed method will be able to check the condition 4 “efficiency”
more effectively when it is combined with the policy appraisal and evaluation.
Secondly, the attempts to benchmark the national cybersecurity capacities are notsuitable for checking the approaches, as they are designed to measure the capacities.
However, it was revealed that the CSCMMN developed by the Global Cyber Security
Capacity Centre has a comprehensive coverage of the cybersecurity capacity areas that anation has to have, and shows the levels that help nations to develop the capacities in stepby step manner. It means that the CSCMMN has the characteristics to check theconditions 2 “coverage” and 3 “levels”, and can become the basis for the checking tool
when the method and the tool have to be created.
Thirdly, the guidelines that are intended for the use by enterprises and organisations toenhance their cybersecurity capacities were surveyed. It was discovered that they are notsuitable for nations because they do not include some capacity areas that are necessary
for nations, for example, the capacities of law enforcement or legal framework. In otherwords, such guidelines are not suitable for checking the condition 2 “coverage”.
Finally, the survey of the CMMI for development revealed that the cybersecurity
capacities must include the abilities to autonomously enhance its capacities according to49

Chapter 2. Related Researches

the recognition of the environment. The checklist will be able to check the condition 1“velocity” by incorporating the items to check the existence of the autonomousenhancement mechanism
Thus, the survey of the related researches indicated that the method and the tool tocheck the approaches for the national cybersecurity capacity enhancement have to becreated and can be designed to check all four conditions by the following courses.
Condition 1 “velocity”: the checklist should have the items to check the existence of
the autonomous enhancement mechanism.
Condition 2 “coverage”: the checklist should be based on the CSCMMN which has thecomprehensive coverage of the capacity areas that arenecessary for nations.
Condition 3 “levels”:
the checklist should define the capacity levels based on the‘stages’ defined in the CSCMMN.
Condition 4 “efficiency”: the result of the check using the method should be informed
to the policy appraisal and evaluation for more effective
appraisal/evaluation.
The proposal that realises the above-mentioned is introduced in Chapter 3. Proposal.

50Chapter 3. Proposal

Chapter 3. Proposal
3.1 Introduction
As stated in Chapter 1. Introduction, the approaches for national cybersecurity
capacity enhancement must be checked if they are satisfying the four conditions.
However, as mentioned in Chapter 2. Related Researches, there is no existing methodor tool for that purpose at present.
Therefore, in this research, a method and a tool to check the approaches for the national
cybersecurity capacity enhancement are proposed.
The method is called “ANC3M” (Approaches for National Cybersecurity Capacity
enhancement Checking Method).
The tool is called “ANC3T” (Approaches for National Cybersecurity Capacity
enhancement Checking Tool).
In addition, creation of a database of the approaches that are categorised and classified
by the method/tool is proposed.
The database is called “ANC3DB” (Approaches for National Cybersecurity Capacity
enhancement Checked DataBase).
The ANC3DB is supposed to provide with the functionality of transnational analysesof cybersecurity approaches.

3.2 Method
3.2.1 Outline of the Method (ANC3M)
The basic flow of the method is shown below.
1) Collection: All approaches of a nation for national cybersecurity capacity
enhancement are collected.
2) Itemisation: The approaches are itemised into pieces of action items.
3) Mapping:
The action items are mapped onto the tool (ANC3T).
4) Evaluation: The mapping result is evaluated.
Each process is described in the following sections.

3.2.2 Collection
It is desirable that all approaches that are related to enhancement of the national
cybersecurity capacity are collected. If not, the checking result will becompromised. For example, even if the result reveals that the approaches are notsatisfying the condition 2 “coverage”, i.e., enough approaches are not planned in51

Chapter 3. Proposal

some capacity areas, if there exist some uncollected approaches, it will be unable
to judge.

3.2.3 Itemisation
If a collected approach includes two or more actions, it must be split into several
actions as the preparation for the following step. These separated actions arecalled “action items” in this research. Each action item must have one single
action. An approach that has one single action will be called “action item” as it is.

3.2.4 Mapping“Mapping” in this research means allocating the action items onto the tool
(ANC3T). The tool, the details of which will be described in section 3.3, isbasically the list of the requirements which are categorised by the cybersecurity
capacity areas and classified by the capacity levels. In order to allocate an action
item onto the tool, it is necessary to identify the requirement(s) that the action
item will fulfil or contribute toward fulfilling. When an action item will fulfil orcontribute toward fulfilling a requirement, the action item is said to be “related”
to the requirement in this research. An action item is not necessarily related to asingle requirement, but to two or more requirements.
Once all action items are allocated onto the tool, the number of the related
action items are counted by each requirement to obtain the mapped result.
The process of mapping is drawn in the Figure 3.2-1.
action items
1:-----------2:-----------3:-----------4:-----------5:------------

allocatetool (ANC3T)
Cap area
Lv1
Lv2
Lv3
Lv4
A
requirement requirement requirement requirementB
requirement requirement requirement requirement
C
requirement requirement requirement requirement
D
requirement requirement requirement requirementE
requirement requirement requirement requirement
count the number of the related action items
by each requirement

Cap area
A
B
C
D
E

Lv1
0 related action items
1 related action items
0 related action items
2 related action items
1 related action items

Lv2
2 related action items
0 related action items
1 related action items
3 related action items
2 related action items

Lv3
1 related action items
2 related action items
0 related action items
5 related action items
1 related action items

Note: Cap area = capacity area, Lv = level.

Figure 3.2-1 Process of Mapping52

Lv4
3 related action items
0 related action items
2 related action items
1 related action items
0 related action items

Chapter 3. Proposal

3.2.5 Evaluation
The purpose of evaluation of the mapping result is to see whether theapproaches are satisfying the four conditions.
Among the four conditions, the condition 1 “velocity” is checked by examining
the number of the action items related to the requirements for the autonomousenhancement mechanism, while the other conditions are checked by finding out
the capacity areas that may not satisfy the conditions.

3.2.5.1 Evaluation for Condition 1
As mentioned in section 2.6, the condition 1 “velocity” is checked by
the requirements for the autonomous enhancement mechanism.
Among the requirements described in the ANC3T, some requirements
refer to the capacities with the built-in autonomous enhancement
mechanism. Such capacities enable a nation to enhance its capacities
according to the changes in cybersecurity environments and the threat
landscape without being instructed to do so by the outside organs.
Without such capacities, a nation cannot enhance its capacities at thesame velocity as information technology and the opponents develop, i.e.
fails satisfying the condition 1 “velocity”.
There are 58 requirements that include the autonomous enhancement
mechanism in the ANC3T. The details of the requirements are
introduced in section 3.3.4.
To help checking if the nation satisfies the condition 1 “velocity”, themethod counts the number of the action items related to the requirements
for the autonomous enhancement mechanism. It indicates whether thenation is planning to obtain such capacity in a particular capacity area.
However, it is not learned from this analysis whether the nation has suchcapacities. Likewise, if no action item is related to a particularrequirement for the autonomous enhancement mechanism, it does notmean that the nation is not concerned about obtaining the capacity, as
the nation may already has the capacity.
Furthermore, if the nation has only a primitive capacity in a particular
capacity area, the nation should concentrate to enhance the capacity to
the higher level, rather than try to obtain the autonomous enhancement
mechanism.
Thus, the evaluation for the condition 1 “velocity” only tells that thenation plans to obtain the autonomous enhancement mechanism, andcannot give definitive verdicts. However, it is supposed to help checking
53

Chapter 3. Proposal

the condition 1, because the nation can ensure that it satisfies thecondition 1 by examining if the result is along with its cybersecurity
strategy.

3.2.5.2 Evaluation for Condition 2, 3, 4
The condition 2 “coverage”, 3 “levels” and 4 “efficiency” arechecked by finding out the capacity areas that have the following
characteristics.
1) The areas that few action items are related to.
2) The areas where the action items are related only to the lower levels.
3) The areas where the action items are related only to the higher levels.
4) The areas that a lot of action items are related to.
The areas that few action items are related to are the capacity areasthat are not planned to be enhanced. It means that the nation has alreadyhigh level of capacities in those areas, or otherwise the areas are to beleft unenhanced by some reasons. There may be necessary to havefurther examination in those areas. This helps checking if the nation
satisfies the condition 2 “coverage”.
The areas where the action items are related only to the lower levels
are the capacity areas that are planned to be maintained at the lower
levels or to be enhanced from the very low levels. It means that thenation only has low level of capacities but does not intend to enhance tothe higher levels in those areas. It is alright if the nation does not haveto obtain the high level of capacities in those areas by some reasons, forexamples, the nation relies on other nations in those capacities. Theremay be necessary to have further examination in those areas. This helps
checking if the nation satisfies the condition 3 “levels”.
The areas where the action items are related only to the higher levels
are the capacity areas that are planned to be aimed at the very high levels.
It is alright if the nation already has the high level of capacities in thoseareas and intends to have the higher levels of capacities. However, if thenation does not have enough capacities in the more fundamental levels,the capacities may not effectively mitigate the cyber threats. There may
be necessary to have further examination in those areas. This helps
checking if the nation satisfies the condition 3 “levels” and possibly thecondition 2 “coverage” as well.

54

Chapter 3. Proposal

The areas that a lot of action items are related to are the capacity areasthat are planned to be enhanced by executing a lot of approaches. It
means that the nation is emphasising to obtain the capacities in thoseareas. It is alright if that is consistent with its cybersecurity strategy.
However, it is possible that the nation has a lot of legacy activities thatare not easily canceled by some reasons. There may be necessary to havefurther examination in those areas. Or, the areas may have to be applied
the policy appraisal and evaluation intensely for more effective andefficient appraisal/evaluation. Thus, this helps checking if the nation
satisfies the condition 4 “efficiency”.
Each characteristic is abbreviated in this research as follows;
1) The case 2 “few”
2) The case 3 “low”
3) The case 4 “high”
4) The case 5 “a lot”
Please note that the case 1 denotes the evaluation for the condition 1.
The examples are shown in the Figure 3.2-2.
Mapping Result (number of related action items)
Capacity area
Level 1
Level 2
Level 3
Level 4
A
0
1
0
0
B
1
4
5
2
C
10
8
0
0
D
0
3
4
3
E
0
0
1
8
F
2
5
6
3
G
10
15
8
6

“Few”
“Low”
“High”“A lot”

Figure 3.2-2 Examples of Evaluation
It is difficult to define the thresholds for judging “few” or “a lot”. For
example, in the case of “few” in the Figure 3.2-2, is one related action
item few? If that is zero, it is definitely few. How about two or three?
The thresholds differ according to the number of the total action items.
Similarly, how many action items can be said a lot?
It’s been decided not to define the distinct thresholds. As mentioned
earlier, the findings do not immediately mean dissatisfactory of theconditions, and will require the further examination of the approaches.
Therefore, the thresholds can be decided by the checker depending on
how many capacity areas he/she wants to indicate for the further
examinations.

55

Chapter 3. Proposal

3.3 Tool
3.3.1 Prerequisites of the Tool (ANC3T)
The tool (ANC3T) is basically the list of the requirements which are categorisedby the cybersecurity capacity areas and classified by the capacity levels.
Moreover, the tool must have the following characteristics.
1) The tool must have the comprehensive coverage of the cybersecurity capacity
areas that a nation has to have. (hereafter ‘prerequisite 1 “coverage”’)
2) The tool must indicate several levels in each capacity area that a nation canplan to achieve in a step by step manner. (hereafter ‘prerequisite 2 “levels”’)
3) The tool must be updated regularly according to the development of
information technology and cyber-attacking technology. (hereafter‘prerequisite 3 “updates”’)
4) The tool must include the items that require nation’s maturity to sustain highlevel of capacities by the autonomous enhancement mechanism. (hereafter‘prerequisite 4 “autonomy”’)
The prerequisite 1 “coverage” corresponds to the condition 2 “coverage”. The
prerequisite 2 “levels” corresponds to the condition 3 “levels”. The prerequisite
4 “autonomy” corresponds to the condition 1 “velocity”.
It is obvious that the prerequisite 3 “updates” of the tool itself is requiredconsidering rapid development of information technology, skills of attackers andthe capacities of other nations.

3.3.2 Outline of the Tool (ANC3T)
The outline of the tool is shown in the Table 3.3-1.
Table 3.3-1 Outline of the Tool (ANC3T)#

Category

Subcategory

111

Capacity
area
A

z
112
121

211

B

a

b

y

C

x

D

Note: req’t = requirement

56

Level 1
111L1-1
112L1-1
112L1-2
121L1-1
211L1-1
211L1-2
-

req’t
req’t
req’t
req’t
req’t
req’t
-

Level 2
111L2-1
111L2-2
112L2-1
121L2-1
121L2-2
121L2-3
211L2-1
211L2-2
211L2-3

req’t
req’t
req’t
req’t
req’t
req’t
req’t
req’t
req’t

Level 3
111L3-1
111L3-2
112L3-1
112L3-2
121L3-1
121L3-2
211L3-1
211L3-2
211L3-3

req’t
req’t
req’t
req’t
req’t
req’t
req’t
req’t
req’t

Level 4
111L4-1
111L4-2
112L4-1
121L4-1
121L4-2
121L4-3
211L4-1
-

req’t
req’t
req’t
req’t
req’t
req’t
req’t
-

Chapter 3. Proposal

The “capacity areas” are supposed to cover the necessary cybersecurity capacity
areas that a nation has to have comprehensively. The capacity areas are
categorised and subcategorised for easier reference. Then each area is numberedsuch as “111”, “112”, “113”, ….
The number of levels is four, mainly because the CSCMMN which the tool isbased on has five levels. Please note that the tool is assuming that there exists thelevel 0 and the requirements of the level 1 mean stepping up from the level 0 to
the level 1.
The requirement for a level in an area is not necessarily one. There may be two
or more requirements. Then the requirements are numbered such as “111L1-1”,“111L1-2”, “111L2-1”, …. which stand for “capacity area number, level number- order within the level/area”.

3.3.3 Deriving from CSCMMN
As mentioned in section 2.6, the tool (ANC3T) is created based on the
CSCMMN [13].
The CSCMMN (Cybersecurity Capacity Maturity Model for Nations Revised
Edition) has the following characteristics.
1) CSCMMN was developed by a lot of researchers and business people fromall over the world and aiming at covering the comprehensive cybersecurity
capacity areas that a nation has to have. (satisfying the prerequisite 1“coverage”)
2) CSCMMN indicates the levels that a nation can plan to advance toward.
(satisfying the prerequisite 2 “levels”)
3) CSCMMN has already been updated once and is expected to be updated
regularly in accordance with changes in the field of cybersecurity. (satisfying
the prerequisite 3 “updates”)
4) CSCMMN requires a nation such maturities that it advances its capacities
autonomously and continuously in the higher stages. For example, theindicators in the ‘strategic’ (2nd highest) stage for the ‘strategy development’
aspect of the ‘national cybersecurity strategy’ factor of the 1st dimension
require that the reviewing process of the strategy is defined. There exist 58
indicators that require the autonomous enhancement mechanism in the
CSCMMN. (satisfying the prerequisite 4 “autonomy”)
The CSCMMN is able to satisfy all four prerequisites described in section 3.3.1.
Therefore, the CSCMMN is used as a base of the ANC3T and the names of theelements are replaced as in the Figure 3.3-1.

57

Chapter 3. Proposal

CSCMMN
Dimension
FactorAspectStage
Start-up
Formative
Established
Strategic
Dynamic
Indicator

AC3T
Category
Subcategory
Capacity area
Leveln/a (supposed as Level 0)
Level 1
Level 2
Level 3
Level 4
Requirement

CSCMMN
Dimension

FactorAspectStart-up

FormativeStage
Established

Strategic

Dynamic

Indicator(s) Indicator(s) Indicator(s) Indicator(s) Indicator(s)ANC3T
Category Subcategory

Capacityarea

Level 1

Level
Level 2

Level 3

Level 4

Requirement(s) Requirement(s) Requirement(s) Requirement(s)Figure 3.3-1 Replacement of Names of Elements
The indicators of the CSCMMN are described literarily. An indicator usuallydenotes a single condition, but some indicators include two or more conditions. A
requirement must denote one single condition. Therefore, such indicators havebeen split into two or more requirements in the process of transforming the
CSCMMN into the ANC3T.

3.3.4 Requirements for Autonomous Enhancement Mechanism
As mentioned in section 3.3.3, the CSCMMN has 58 indicators that require theautonomous enhancement mechanism, which then become the requirements forautonomous enhancement mechanism in the ANC3T.
The list of the requirements for autonomous enhancement mechanism is shownin the Table 3.3-2.

58

Chapter 3. Proposal

Table 3.3-2 List of Requirements for Autonomous Enhancement Mechanism
ID
Keywords
Details
111L4-1 Continual revision of strategy Continual revision and refinement of cybersecurity strategy isconducted proactively to adapt to changing socio-political, threat
and technology environments.
112L3-1 PDCA
processesof Evidence exists of iterative application of metrics and resulting
cybersecurity programme
refinements to operations and strategy across government,
including resource allocation considerations.
112L4-1 Reassignment & reallocation A singular national cybersecurity posture exists with the ability toof resources for cybersecurity reassign tasks and budgets dynamically according to changing
programmerisk assessments.
113L4-1 Continual revision of strategy New content is periodically incorporated in the strategy inresponse to evolving threat landscapes.
121L3-1 Regular revision of incident Regular, systematic updates to the national-level incident registry
registry
are made.
124L3-3 Regular review of incident Key processes (detection, resolution, prevention, etc.) are being
response processes
monitored and reviewed in regular basis, and tested with different
case scenarios.
124L4-2 Evaluating effectiveness of The benefits of training and accreditation are being evaluated and
CSIRT members training
inform the future training planning.
131L4-1 Regular review of CI risk Priority listing of CI assets is regularly re-appraised to capture
priorities
changes in the threat environment.
132L4-1 Ability to adjust of CI Owners of critical infrastructure and assets are able to rapidly
protection
respond to the changing threat landscape.
133L3-4 Regular review of resource Resources are allocated in proportion to the assessed impact of an
allocation for CI protection
incident to ensure rapid and effective incident response.
133L4-1 Regular audit of CI
Audit practices to assess network and system dependencies andvulnerabilities (i.e. unmitigated dependencies) are implemented
on a regular basis and inform continuous reassessment of CI risk
portfolio, technologies, policies and processes.
141L3-4 Evaluation of national incident (Specific, Measurable, Attainable, Relevant, and Time-Bound
exercise informing investment (SMART) objectives and performance key indicators (PKI)
inform decisions in crisis management,) and evaluation results
inform future investment in national cybersecurity capacity.
161L3-3 Evaluation of national incident The results of these scenarios then inform strategic investment inexercise informing investment future emergency response assets.
221L4-1 Users can evaluate risk & Individuals assess the risk in using online services, including
adjust behaviourchanges in the technical and cybersecurity environment andcontinuously adjust their behaviour based on this assessment.
222L4-1 Promotion of e-gov revised
E-government services and promotion thereof are continuously
improved and expanded to enhance transparent/open and securesystems and user trust.
223L4-1 Continuous improvement of e- E-commerce services are continuously improved in order tocommerce
promote transparent, trustworthy and secure systems.
231L4-1 Users can adapt to changing Users have the knowledge and skills necessary to protect theirenvironments
personal information online, adapting their abilities to thechanging risk environment.
231L4-3 Security & privacy balanced in Policies are in place in private and public sectors to ensure thatchanging environment
privacy and security are not competing in a changing environment
and are informed by user feedback and public debate.
231L4-4 Regular assessment of privacy Assessments of personal information protection in eservices areprotection
regularly conducted and feed back into policy revision.
241L4-1 Regularenhancementof All relevant stakeholders actively collaborate and share good
incident reporting
practice to enhance existing reporting mechanisms and there is aclear distribution of roles and responsibilities, including regarding
the response to reported incidents.
251L4-1 Discussion changing policy & The broad discussion of personal experiences and personalsociety
attitudes of individuals across mainstream and social media
inform policy making and facilitate societal change.
311L4-1 Awarenessraising Awareness raising programmes are adapted in response toprogrammes
adapted performance evidenced by monitoring which results in theaccording to effectiveness
redistribution of resources and future investments.

(continue…)
59

Chapter 3. Proposal
ID
Keywords
Details
311L4-2 Revision of national awareness Metrics contribute toward national cybersecurity strategy revision
raising programme
processes.
312L3-2 Executives'
ability
to Executives are able to alter strategic decision making, and allocate
reallocate resources
specific funding and people to the various elements of cyber risk,
contingent on their company’s prevailing situation.
321L4-3 Cybersecurity
education Prevailing cybersecurity requirements are considered in theadapting to changing needs
redevelopment of all general curricula.
322L4-3 Cybersecurity
education Content in cybersecurity education programmes is aligned withalignedwithpractical practical cybersecurity problems and business challenges, andproblems
provides a mechanism for enhancing curriculum based on the
evolving landscape.
331L3-4 Metrics of effectiveness of Metrics of effectiveness assess the modes and procedures ofcybersecurity training
training.
332L3-1 Review of cybersecurity The uptake of cybersecurity training is used to inform future
training programmes
training programmes.
411L3-1 Regularreviewof The country reviews existing legal and regulatory mechanisms forcybersecurity legal framework ICT security, identifies where gaps and overlaps exist, andamends laws accordingly or enacts new laws.
411L4-1 Balance
between Mechanisms are in place for continuously harmonising ICT legal
cybersecurity legal framework frameworks with national cybersecurity related ICT policies,& best practices
international law, standards and good practices.
412L4-1 Amendment procedures for In order to meet dynamic changes in the application of technology
cybersecurity legal framework to human rights, procedures are in place to amend and update legal
frameworks as needed.
413L4-1 Amendment procedures for In order to meet dynamic changes in the technological
data protection legislation
environment, procedures are in place to amend and update legal
frameworks as needed.
414L4-1 Amendment procedures for In order to meet dynamic changes in the technologicalonlinechild
protection environment, procedures are in place to amend and update legal
legislation
frameworks as needed.
415L4-1 Amendment procedures for In order to meet dynamic changes in the application of technology
consumerprotection to consumer protection, procedures are in place to amend andlegislation
update legal frameworks as needed.
416L4-1 Balance between intellectual Decisions to update legislation are based on the balance between
property & open access policy intellectual property and open access policies, through multistakeholder discussion.
417L4-2 Regular review of substantive Laws, where needed, are amended to reflect changes in the
cybercrime legislationinternational ICT environment.
418L4-2 Regular review of procedural Procedural law, where needed, is amended to adapt to thecybercrime legislation
changing cybercrime landscape and emerging investigative
challenges.
421L4-3 Regularreviewof The institutional capacity of law enforcement is frequently
investigative capabilities for reviewed and revised based on an assessment of effectiveness.
cybercrimes
422L3-3 Exchange of best practices A mechanism exists that enables the exchange of information andbetween prosecutors & judges good practices between prosecutors and judges to ensure efficientand effective prosecution of cybercrime cases.
422L4-3 Specialised and continuous All prosecutors receive specialised and continuous training based
training for prosecutors
on relative responsibilities and new, evolving threat landscapes.
423L4-1 Specialised and continuous Judges receive specialised and continuous training based on
training for judges
relative responsibilities and new, evolving threat landscapes.
423L4-2 Regular review of court The institutional capacity of the court system is frequently
system capabilities to judge reviewed and revised based on an assessment of effectiveness.
cybercrimes
431L4-1 Regularreviewof Formal international cooperation mechanisms are regularlyinternational cooperation
reviewed to determine effectiveness, and are revised accordingly
to reflect the changing cybercrime landscape.
431L4-3 Regularly
adjusted Formal mechanisms that enable the exchange of information
information exchange between between domestic public and private sectors are adapted inpublic & private sectors
accordance with identified needs and changing threat
environment.

(continue…)

60

Chapter 3. Proposal
ID
Keywords
432L4-1 Adapted
cooperationexchange of information

Details& Government and criminal justice actors exchange information
timely and efficiently, and cooperation is adapted to the changing
cybercrime environment and associated requirements.
432L4-2 Adaptedinternational A routinized relationship between law enforcement and ISPs,
cooperation
domestically and across borders, has been established and is
adaptable to emerging forms of cybercrime.
511L4-1 Regular review of adoption of The choice of adopted standards and good practices and theirstandards & best practices
implementation is continuously improved.
511L4-2 Decision making of non- Adoption of standards and non-compliance decisions are made incompliance to standards & response to changing threat environments and resource drivers
best practices
across sectors and CI through collaborative risk management.
511L4-3 Risk-based decision making of Evidence exists of debate within all sectors on compliance tocompliancestandards and good practices, based on continuous needs
assessments.
512L3-2 Regularreviewof Critical aspects of procurement and supply, such as prices andprocurement
costs, quality, timescales and other value adding activities arecontinuously improved,
521L4-1 Controlled acquisition of Acquisition of infrastructure technologies is effectively
infrastructurescontrolled, with flexibility incorporated according to changing
market dynamics.
521L4-2 Optimised cost for internet Costs for infrastructure technologies are continually assessed andinfrastructures
optimised.
531L4-3 Regular review of quality Requirements of software quality are being systematicallyrequirement
reviewed, updated, and adapted to the changing cybersecurity
environment.
541L4-1 Continuous assess of technical All sectors have the capacity to continuously assess the security
security controls
controls deployed for their effectiveness and suitability according
to their changing needs.
551L4-1 Regular review of relevance of The relevance of cryptographic controls deployed for securingcryptographic controls
data at rest and data in transit is continuously assessed throughrisk assessments.
551L4-2 Revision of cryptographic The public and private sector adapt encryption and cryptographic
control policies
control policies based on the evolution of technologicaladvancement and changing threat environment.
571L4-1 Regularreviewof Responsible disclosure policies are continuously reviewed andvulnerability
disclosure updated based on the needs of all affected stakeholders.
policies
571L4-4 Reviewing
processof Processes are in place to review and reduce deadlines.
deadlines

3.3.5 Enhancement over CSCMMN
Although the CSCMMN is supposed to cover the necessary cybersecurity
capacity areas that a nation has to have comprehensively, it was found that some
capacities are not included in the CSCMMN but are supposed to be important fora nation to have, through the verification of the method/tool.
Those capacities are the counter-intelligence capacity and the capacity tosupport the neighbouring nations for establishing legislative frameworks. In fact,
Japan actually works on those capacities. Therefore, it was decided that thecapacities are to be included into the ANC3T, the details of which are introduced
in section 4.3.3.6.

61

Chapter 3. Proposal

3.4 Database
3.4.1 Outline of the Database (ANC3DB)
When the approaches are checked by the ANC3M, the approaches (moreprecisely, action items) are categorised and classified. In other words, each action
item is tagged with category, subcategory, capacity area and level. In addition,some action items are tagged with two or more categories/subcategories/capacity
areas/levels. Through the verification, more than 250 action items of Japan and
140 action items of the United Kingdom were tagged. The total number of therelationship is more than 850.
This is a fairly large data set of the approaches that are aimed at enhancing thenational cybersecurity capacities. If the further examples of the approaches ofother nations are collected and input into the data set, the data set will be supposed
to provide with a platform for the cross-border analyses of the cybersecurity
approaches.

3.4.2 Purposes
This database (ANC3DB) is supposed to be useful in the following occasions.
4) When a nation plans to enhance some particular capacities, the ANC3DB canprovide with the examples of the approaches that are implemented by othernations.
5) When a nation considers another nation as a role model, the ANC3DB canprovide with the examples that are implemented by the model nation.
6) The ANC3DB can provide with the functionality for statistical analysis, forexample;e) What capacity areas are emphasised on a global basis?
f) What levels are intensely aimed at on a global basis?
g) Are the emphasised areas shifting according to the lapse of time?
h) Are the aimed levels rising?
and so on.

3.4.2 Details
The database (ANC3DB) consists of the aggregate of the approaches (action
items) for the national cybersecurity capacity enhancement that are related to therequirements of the ANC3T. A datum consists of a relationship, in other words, acombination of an action item and a requirement.
The images of the ANC3DB tables are shown in the Figure 3.4-1.

62

Chapter 3. Proposal

Ref. #

Relationship
Action item #Requirement ID

Action item #NationRequirement ID

Category

Action items (Approaches)
National #SourceYear

Subcategory

ANC3T
Capacity area

Details

Level

Requirement (keyword)

Figure 3.4-1 Image of the ANC3DB Tables

3.4.4 Data Collection
The examples of the approaches of other nations are not necessarily to becollected as a complete set of the national approaches, as mentioned in thecollection process of the method. Instead, they can be collected one by one. For
example, if nation A announces to increase its budget for research anddevelopment of cybersecurity technology, it can be input into the database. Whennation B decides to have the application of an international standard forcybersecurity mandatory to the listed companies, it can be input into the database.
Thus, the database will gradually grow and will be more useful.
It is almost obvious that the more examples are added to the database, the more
the database will be useful. Therefore, it was decided to add fairly good amountof data as a short-term solution by using the recommendations for cybersecurity
enhancement published by the Commission on Enhancing National Cybersecurityof the United States.
The former President Barack Obama of the United States issued the Executive
Order 13718 in February 2016, ordering to form the Commission on Enhancing
National Cybersecurity and to develop a plan for protecting cyberspace andAmerica's economic reliance on it [28]. The Commission was formed by theeminent experts in April and reported the recommendations in December 2016.
The report made 16 major recommendations with 53 specific action items
broadly grouped under the following six areas [29].
1) Protect, defend, and secure today’s information infrastructure and digital
networks.

63

Chapter 3. Proposal

2) Innovate and accelerate investment for the security and growth of digital
networks and the digital economy.
3) Prepare consumers to thrive in a digital age.
4) Build cybersecurity workforce capabilities.
5) Better equip Government to function effectively and securely in the digitalage.
6) Ensure an open, fair, competitive, and secure global digital economy.
The method (ANC3M) was applied to the 53 action items that are described in
the Commission’s report and 142 relationships were obtained. Thus, 142 data
were added to the database (ANC3DB).
Please note that this does not mean that the approaches of the U.S. are checkedby the ANC3M because of the following reasons.
1) The Commission’s report does not describe all the approaches of the U.S. toenhance its national cybersecurity capacity.
2) The Commission’s report made the recommendations which are notnecessarily adopted by the administration of the President Trump.
Nevertheless, the 53 action items are the cutting-edge approaches which aresupposed to be essential to enhance the national cybersecurity capacity under thelatest cyber threat landscapes and should give the very useful implication to theanalysers who use the database. However, they may be better excluded from thestatistical analyses because they are not the actually implemented approaches.
A part of the database, as a sample, is shown in the Table 3.4-1.
The full set of the data is in the Appendix J. Please note that both Table 3.4-1
and Appendix J show the views that join all three tables, relationships, action
items and ANC3T.

64

Chapter 3. Proposal

Table 3.4-1 Sample of the ANC3DB
Approaches
Ref.

Nation#Source Year

Categorization / Classification
Action Item

0001 Japan 7-111a Cyber 2017 Promoting
security'Security-by2017
Design' in new
businessharnessing IoT
systems.
0002 Japan 7-111a Cyber 2017 Promoting
security'Security-by2017
Design' in new
businessharnessing IoT
systems.
0003 Japan 7-111a Cyber 2017 Promoting
security'Security-by2017
Design' in new
businessharnessing IoT
systems.
0004 Japan 7-112a Cyber 2017 Promoting
security'Security-by2017
Design' in new &large scalebusinessharnessing IoT
systems.
0005 Japan 7-112a Cyber 2017 Promoting
security'Security-by2017
Design' in new &large scalebusinessharnessing IoT
systems.
0006 Japan 7-112a Cyber 2017 Promoting
security'Security-by2017
Design' in new &large scalebusinessharnessing IoT
systems.
0007 Japan
7Cyber 2017 Promoting secure
112a2 security
IoT systems
2017
based on"GeneralFramework for
Secure IoT
Systems".
0008 Japan 7-112b Cyber 2017 Considering
security
measures to2017
exterminate 'botnet'.
0009 Japan 7-112b Cyber 2017 Considering
security
measures to2017
exterminate 'botnet'.
0010 Japan 7-112b Cyber 2017 Considering
security
measures to2017
exterminate 'botnet'.

ID

Category

Subcategory

Requirement(keyword)
2 Promotion of useof standards &best practices

Capacity area Lv

511 Standards,
Adherence toL2-4 Organisations, Standards
andTechnologies

ICT Security
Standards

512 Standards,
Adherence toL1-2 Organisations, Standards
andTechnologies

Standards in
Procurement

1 Promotion of useof standards &best practices for
procurement

513 Standards,
Adherence toL3-1 Organisations, Standards
andTechnologies

Standards in
SoftwareDevelopment

3 Security
consideration in all
stages511 Standards,
Adherence toL2-4 Organisations, Standards
andTechnologies

ICT Security
Standards

2 Promotion of useof standards &best practices

512 Standards,
Adherence toL1-2 Organisations, Standards
andTechnologies

Standards in
Procurement

1 Promotion of useof standards &best practices for
procurement

513 Standards,
Adherence toL3-1 Organisations, Standards
andTechnologies

Standards in
SoftwareDevelopment

3 Security
consideration in all
stages511 Standards,
Adherence toL2-4 Organisations, Standards
andTechnologies

ICT Security
Standards

2 Promotion of useof standards &best practices

221 Cyber Culture Trust andUser Trust andL2-2 and Society
Confidence on Confidence on
the Internet
the Internet

2 Promotion of
online trust
established

521 Standards,
L2-1 Organisations,andTechnologies
541 Standards,
L2-1 Organisations,andTechnologies

Internet
Infrastructure
Resilience

Internet
Infrastructure
Resilience

2 Reliable internet
infrastructures

Technical
Security
Controls

Technical
Security
Controls

2 Latest technicalcontrols & patch
managements
widelyimplemented65

(Blank Page)
66

Chapter 4. Verification

Chapter 4. Verification
4.1 Introduction
Verification was done to see if the method (ANC3M) works well by applying themethod to the approaches for cybersecurity capacity enhancement of Japan and theUnited Kingdom.
The purpose of the ANC3M is to check whether the national approaches are satisfying
the four conditions. Therefore, if the checking process recognises the discrepancies
against the conditions, the ANC3M can be considered workable.
As a result of the verification, the discrepancies were discovered and the ANC3M wasproved to be workable.
On the other hand, with regard to the tool, the CSCMMN was tentatively used as thetool during the verification. It has been proved that the CSCMMN can be used as the tool,
but needs enhancement. The enhancement was applied to the tentative tool to create the
ANC3T.
As mentioned in section 3.2.2, in order to judge if the approaches of a nation aresatisfying the conditions, all related approaches should be collected. Japan and the U.K.
published their cybersecurity strategies where all of their cybersecurity related
approaches are described. Therefore, the collection process of the approaches of the
ANC3M is omissible as far as the approaches of Japan and the U.K. are used forverification.

4.2 Procedures and Criteria of Verification
The procedures of the verification are to apply ANC3M to the approaches of Japan andthe U.K. As stated in section 4.1, the collection process were omitted and thecybersecurity strategy documents that are published by the governments were usedinstead.
The CSCMMN was used as the tentative ANC3T for the verification.
Basically, if the ANC3M discovers the capacity areas where the approaches are notsatisfying the conditions, the verification is successful. However, it is difficult to set thedefinitive threshold, for example, “more than five discrepancies in the condition 2 andmore than three in the condition 3”. That is because of the following reasons.
1) The approaches of Japan and the U.K. may be absolutely satisfying the conditions,
i.e., there may be no discrepancies that the ANC3M should discover.
2) As mentioned in section 3.2.5, the thresholds for judging “few” or “a lot” are decided
by the checker. Therefore, the number of the capacity areas that are discovered by
the ANC3M is subject to the checker.

67Chapter 4. Verification

Therefore, it has been decided not to set the definitive criteria for the verification, but
if the ANC3M discovers the reasonable number of the discrepancies, it should berecognised that the ANC3M should be workable.

68Chapter 4. Verification

4.3 Verification (Japan)
4.3.1 Cybersecurity Strategy of JapanThe Government of Japan established its cybersecurity strategy in 2013 andpublished “Cybersecurity Strategy - Toward a world-leading, resilient andvigorous cyberspace -” [30]. Japan had established its “Information Security
Strategy for Protecting the Nation” in 2010 [31]. However, the extremely quickchanges in the information security environment since then and the emergence ofcyber-attacks against the public sector and the critical infrastructures urged Japanto revise the strategy within three years to emphasise the wide promotion of
cyberspace measures.
However, the changes in cyberspace continued and malicious activities became
more widespread. Threats against national safety and security increased. And the
public sector and the business operators, which provided mission-criticalinfrastructure necessary to the people’s daily lives and economic activities, wereleft exposed to cyber-attacks. Under these circumstances, the Basic Act on
Cybersecurity was enacted in November 2014. This Act prescribes the concept ofcybersecurity and defines the roles and responsibilities of the Government, local
governments and other relevant stakeholders. Additionally, it designates the
Cybersecurity Strategic Headquarters as the command and control body ofnational cybersecurity, and gives strong authorities, such as making
recommendations to national administrative organs, to the Cybersecurity Strategic
Headquarters. Pursuant to the Basic Act that prescribes the responsibility of the
public sector to establish a cybersecurity strategy, the “Cybersecurity Strategy”
was formulated in 2015 [32]. The strategy “outlines the basic directions of Japan’s
cybersecurity policies for the coming three years approximately” and is “looking
towards the Games of the XXXII Olympiad and the Tokyo 2020 Paralympic
Games” [33].
Based on the cybersecurity strategies of 2013 and 2015, the Government ofJapan decides and announces updates, results and achievements every fiscal year
(hereafter abbreviated to “FY”) since FY2013. The results of FY2016 waspublished in July 2017 and the updated strategy for FY2017 was published in thefollowing month [33, 34]. The strategy for FY2017, “Cybersecurity 2017”,
includes awareness raising, cybersecurity countermeasures, education, training,
critical infrastructure protection, cyber defence, anti-cybercrime, research anddevelopment, human resource management, international cooperation andpromotion of cybersecurity-related business [34]. “Cybersecurity 2017”, wherein
220 approaches are described in five categories and 12 sub-categories, appears to
be a prudent and comprehensive cybersecurity capacity building plan [34].

69Chapter 4. Verification

4.3.2 Mapping Result (Japan)
The mapping result (accumulated by the capacity areas) is shown in the Table
4.3-1.
The interim outputs, i.e., the collected cybersecurity approaches (produced
from the Japanese Cybersecurity Strategy), the action items allocated to thetentative ANC3T and the mapping result (accumulated by the requirements) are
shown in the Appendices C, E and F.

70

Chapter 4. Verification

Table 4.3-1 Mapping Result of the Approaches of Japan#

Category

Subcategory

Capacity area

Lv 1 Lv 2 Lv 3 Lv 4 Total

111 Cybersecurity National
Cybersecurity Strategy Development
and Strategy
112 Policy
Organisation
113 Strategy
Content
121
Incident Response
Identification of Incidents
122
Organisation
123
Coordination
124
Mode of Operation
131
Critical Infrastructure (CI) Identification
Protection
132
Organisation
133
Risk Management and Response
141
Crisis Management
Crisis Management
151
Cyber Defence
Strategy152
Organisation
153
Coordination
161
Communications
Communications Redundancy
Redundancy
211 Cyber Culture Cybersecurity Mind-set
Government
212 and Society
Private Sector
213
Users
221
Trust and Confidence on the User Trust and Confidence on theInternet
Internet
222
User Trust in E-government Services
223
User Trust in E-commerce Services
231
User Understanding of User Understanding of Personal
Personal
Information Information Protection Online
Protection Online
241
Reporting Mechanisms
Reporting Mechanisms
251
Media and Social MediaMedia and Social Media
311 Cybersecurity Awareness Raising
Awareness Raising Programmes
312 Education,
Executive Awareness Raising
321 Training and Framework for Education Provision
322 Skills
Administration
331
Framework for Professional Provision
Training
332
Uptake411 Legaland Legal Framework
Legislative Framework for ICT
Regulatory
Security
412 Frameworks
Privacy, Freedom of Speech & Other
Human Rights Online
413
Data Protection Legislation
414
Child Protection Online
415
Consumer Protection Legislation
416
Intellectual Property Legislation
417
Substantive Cybercrime Legislation
418
Procedural Cybercrime Legislation
421
Criminal Justice System
Law Enforcement
422
Prosecution
423
Courts431
FormalandInformal Formal Cooperation
Cooperation Frameworks to Informal Cooperation
432
Combat Cybercrime
511 Standards,
Adherence to Standards
ICT Security Standards
512 Organisations,Standards in Procurement
513 andStandards in Software Development
521 Technologies Internet
Infrastructure Internet Infrastructure Resilience
Resilience
531
Software Quality
Software Quality
541
Technical Security Controls Technical Security Controls
551
Cryptographic Controls
Cryptographic Controls
561
Cybersecurity Marketplace Cybersecurity Technologies
562
Cyber Insurance
571
Responsible Disclosure
Responsible Disclosure

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
6
4
0
20
3
5
0
0
4
0

0
0
0
1
1
24
21
2
4
19
12
1
1
4
6

1
0
1
1
4
8
11
2
1
2
0
2
6
8
1

1
0
1
2
5
38
36
4
25
24
17
3
7
16
7

0
0
0
0

1
0
6
18

4
4
9
9

0
1
2
0

5
5
17
27

0
0
0

0
2
3

3
0
0

0
0
0

3
2
3

0
0
0
0
0
0
1
0
0

1
0
1
0
11
2
7
2
0

0
3
7
8
6
4
13
4
1

0
0
2
0
6
11
6
2
1

1
3
10
8
23
17
27
8
2

0

0

1

1

2

0
0
0
0
0
0
0
0
0
3
3

0
0
0
0
1
1
0
0
0
9
2

0
0
0
0
1
1
8
0
0
12
1

0
0
0
0
3
3
3
1
0
1
0

0
0
0
0
5
5
11
1
0
25
6

0
6
4
0

33
0
4
2

9
8
9
0

2
0
1
3

44
14
18
5

0
1
0
0
0
0

0
21
3
2
1
3

0
15
1
1
0
2

0
2
6
0
0
1

0
39
10
3
1
6

Total

18

178 240 106 542

71

Chapter 4. Verification

4.3.3 Evaluation Results (Japan)
4.3.3.1 Case 1: Autonomous Enhancement Mechanism
The list of the number of relationships with the requirements forautonomous enhancement mechanism is shown in the Table 4.3-2.
Table 4.3-2 Number of Relationships with Requirements forAutonomous Enhancement Mechanism (Japan)
ID
Keywords
Nb of relationships
111L4-1 Continual revision of strategy
1
112L3-1 PDCA processes of cybersecurity programme
0
112L4-1 Reassignment & reallocation of resources for cybersecurity0
programme
113L4-1 Continual revision of strategy
1
121L3-1 Regular revision of incident registry0
124L3-3 Regular review of incident response processes
3
124L4-2 Evaluating effectiveness of CSIRT members training
1
131L4-1 Regular review of CI risk priorities
2
132L4-1 Ability to adjust of CI protection
1
133L3-4 Regular review of resource allocation for CI protection
0
133L4-1 Regular audit of CI
2
141L3-4 Evaluation of national incident exercise informing investment
0
161L3-3 Evaluation of national incident exercise informing investment
0
221L4-1 Users can evaluate risk & adjust behaviour
0
222L4-1 Promotion of e-gov revised
0
223L4-1 Continuous improvement of e-commerce
0
231L4-1 Users can adapt to changing environments
0
231L4-3 Security & privacy balanced in changing environment
0231L4-4 Regular assessment of privacy protection
0
241L4-1 Regular enhancement of incident reporting0
251L4-1 Discussion changing policy & society
0
311L4-1 Awareness raising programmes adapted according to0effectiveness
311L4-2 Revision of national awareness raising programme0
312L3-2 Executives' ability to reallocate resources0
321L4-3 Cybersecurity education adapting to changing needs
2
322L4-3 Cybersecurity education aligned with practical problems
5
331L3-4 Metrics of effectiveness of cybersecurity training
1
332L3-1 Review of cybersecurity training programmes
2
411L3-1 Regular review of cybersecurity legal framework1
411L4-1 Balance between cybersecurity legal framework & best0practices
412L4-1 Amendment procedures for cybersecurity legal framework
0413L4-1 Amendment procedures for data protection legislation
0
414L4-1 Amendment procedures for online child protection legislation
0
415L4-1 Amendment procedures for consumer protection legislation
0
416L4-1 Balance between intellectual property & open access policy
0417L4-2 Regular review of substantive cybercrime legislation
0
418L4-2 Regular review of procedural cybercrime legislation
0
421L4-3 Regular review of investigative capabilities for cybercrimes
0422L3-3 Exchange of best practices between prosecutors & judges
0
422L4-3 Specialised and continuous training for prosecutors
1
423L4-1 Specialised and continuous training for judges
0
423L4-2 Regular review of court system capabilities to judge
0cybercrimes
431L4-1 Regular review of international cooperation
1(continue…)
72

Chapter 4. Verification
ID
Keywords
Nb of relationships
431L4-3 Regularly adjusted information exchange between public &0private sectors
432L4-1 Adapted cooperation & exchange of information
0
432L4-2 Adapted international cooperation
0
511L4-1 Regular review of adoption of standards & best practices
2
511L4-2 Decision making of non-compliance to standards & best0practices
511L4-3 Risk-based decision making of compliance0512L3-2 Regular review of procurement4
521L4-1 Controlled acquisition of infrastructures
0521L4-2 Optimised cost for internet infrastructures
1
531L4-3 Regular review of quality requirement0541L4-1 Continuous assess of technical security controls
2
551L4-1 Regular review of relevance of cryptographic controls
4
551L4-2 Revision of cryptographic control policies
2
571L4-1 Regular review of vulnerability disclosure policies
0571L4-4 Reviewing process of deadlines
0
Total number of relationships
39
Requirements with action items >020
Requirements with action items =038

Among 58 requirements for autonomous enhancement mechanism, 20
requirements are related with one or more action items. 38 requirements
are related with none. This result alone cannot give any judgement about
the condition 1 “velocity”. Further examination is needed to see if theresult is along with the national strategy.

4.3.3.2 Case 2: “Few”
The capacity areas that few action items are related to are shown in
the Table 4.3-3.
Table 4.3-3 Capacity Areas of Case 2 “Few” (Japan)#

Capacity area

Lv 1

Lv 2

Lv 3

Lv 4

Total

111 Strategy Development

0

0

0

1

1

112 Organisation

0

0

0

0

0

113 Content

0

0

0

1

1

413 Data Protection Legislation

0

0

0

0

0

414 Child Protection Online

0

0

0

0

0

415 Consumer Protection Legislation

0

0

0

0

0

416 Intellectual Property Legislation

0

0

0

0

0

422 Prosecution

0

0

0

1

1

423 Courts

0

0

0

0

0

561 Cybersecurity Technologies

0

2

1

0

3

562 Cyber Insurance

0

1

0

0

1

73

Chapter 4. Verification

This may be the case because Japan is already at a high level (level 3
or level 4) and, therefore, does not need many approaches to enhancethese capacity areas.
However, for example, while the “prosecution” area (#422) has only
one related action item and the “courts” area (#423) has none, the “lawenforcement” area (#421) in the same subcategory has 11 related action
items (please refer to the Table 4.3-1). This indicates that Japan stillneeds to work on maturing its capacities of law enforcement. Therefore,
this implies that Japan emphasises the enhancement of cybersecurity
capacity of law enforcement while focusing less on prosecution andjustice.
Another example, the areas, namely, “cybersecurity technologies”(#561) and “cyber insurance” (#562) have three and one related action
items, respectively. These areas do not refer to outright strength withregard to fighting against cyber-attackers and cyber-criminals but rather
relate to the vigorousness of the cybersecurity industries. By consideringthat the first category of the “Cybersecurity 2017” [34] is “improvementof socio-economic vitality and sustainable development”, which
includes 48 action items, and shows the strong intention of Japan topromote cybersecurity industries, it would be more encouraging if moreaction items were related to these areas.

4.3.3.3 Case 3: “Low”
The capacity areas that the action items are related only to the lower
levels are shown in the Table 4.3-4.
Table 4.3-4 Capacity Areas of Case 3 “Low” (Japan)#

Capacity area

223 User Trust in E-commerce Services
231

User Understanding of Personal Information
Protection Online

Lv 1

Lv 2

Lv 3

Lv 4

Total

0

2

0

0

2

0

3

0

0

3

If Japan is at a low level (level 0 or level 1) in the capacity areas,
namely, “user trust in e-commerce services” (#223) and “userunderstanding of personal information protection online” (#231), andworking on enhancement for advancing to the level 2, it isunderstandable that all action items are related to the level 2. However,Japan is apparently one of the most advanced nations with regard to ecommerce. A variety of online services are offered and a considerable
proportion of people are using them on a daily basis. In such
74

Chapter 4. Verification

circumstances, there exist a lot of threats and risks to cheat the users sothat the personal information is exfiltrated and money is stolen.
Moreover, such threat actors are motivated to sophisticate their cheatingskills and use more advanced cheating technology. Therefore, Japan
should enhance its national capacity in these areas to the world leadinglevel (level 3 or level 4). For that reason, the approaches for thesecapacity areas are considered to be possibly dissatisfactory to thecondition 3 “levels” and need further examination.

4.3.3.4 Case 4: “High”
The capacity areas that the action items are related only to the higher
levels are shown in the Table 4.3-5.
Table 4.3-5 Capacity Areas of Case 4 “High” (Japan)#

Capacity area

Lv 1

Lv 2

Lv 3

Lv 4

Total

151 Strategy

0

0

1

2

3

152 Organisation

0

0

1

6

7

153 Coordination

0

4

4

8

16

In the capacity areas, namely, “Strategy” (#151), “Organisation”(#152) and “Coordination” (#153), most of the action items are related
to the level 4, with a few action items to the level 2 and 3. It looks as if
Japan were at the level 3 now and working for the highest level.
However, these capacity areas belong to the “cyber defence”
subcategory, where Japan is hardly considered to be at the world leadinglevel. A highly advanced capacity that is required in the level 4 does notalways substitute for a fundamental capacity that is required in the level
1 or 2. Therefore, even if Japan successfully obtains the level 4
capacities, if it lacks the level 2 capacities, it will not be able tosufficiently defend against cyber threat. The approaches for thesecapacity areas need further examination.

4.3.3.5 Case 5: “A lot”
The capacity areas that a lot of action items are related to are shownin the Table 4.3-6.

75

Chapter 4. Verification

Table 4.3-6 Capacity Areas of Case 5 “A lot” (Japan)#

Capacity area

Lv 1

Lv 2

Lv 3

Lv 4

Total

123 Coordination

0

6

24

8

38

124 Mode of Operation

0

4

21

11

36

511 ICT Security Standards

0

33

9

2

44

541 Technical Security Controls

1

21

15

2

39

The capacity area with the most related action items is the “ICTsecurity standards” area (#511). Here, the number of related action items
is 44. Following with 39 items is the “technical security controls” area(#541). The areas, namely, “coordination” (#123) and “mode ofoperation” (#124) are in the third and fourth place with 38 and 36,
respectively. Cumulatively, these top four areas have 157 related action
items which is approximately 29% of the total 542 relationships. Notethat the average number of related action items per area is 10.2.
Every capacity area in the “top four” is important and emphasising onthese areas is an appropriate approach. However, it may be necessary to
carry out a detailed investigation to determine that all related action
items are not duplicates nor replaceable with fewer and more effective
approaches.
We must bear in mind that the “ICT security standards” area (#511),
which refers to the establishment of standards and best practices, thepromotion and the compliance to these standards and best practices andthe contribution to international standards, etc., is the most basic of all
security activities. Therefore, it requires tremendous effort to develop it
and focusing on this capacity area may mean to demand a large number
of approaches.

4.3.3.6 Case 6: Not AllocatedIt was found during the verification that some action items were notallocated to any requirement. Such action items are shown in the Table
4.3-7.

76

Chapter 4. Verification

Table 4.3-7 Not Allocated Action Items (Japan)#
Category
Subcategory
7-311a Ensuring Peace Ensuring
and Stability of National
the International Security
Community andNational Security
7-331b Ensuring Peace Cooperationand Stability of and
the International Collaboration
Community and with Countries
National Security around theWorld

Strategy
AgencyEnhancingCabinetResponse
Secretariat
Capabilities of
Relevant
Governmental
BodiesAsia Pacific NPA,
MOJ,
MOFA

Action Item
Enhancing counterintelligencecapabilities.

Supporting
countries in Asian
Pacific region toestablish
cybercrime
jurisdiction.

There is no requirement that corresponds to these action items in thetentative ANC3T. However, Japan is actually coping with enhancementof the capacities and such capacities are considered essential to combat
against cyber threats. Therefore, the ANC3T should be enhanced toinclude such requirements corresponding to those action items. The
details of enhancement of the ANC3T are discussed in section 3.3.4.
The action item #7-311a refers to the enhancement of counterintelligence capacities of Japan. Japan is working on it based on the“Basic Strategy for Enhancing Counter-Intelligence Capabilities” [35].
Counter-intelligence in cyberspace essentially consists ofcountermeasures against cyber-attacks aiming to exfiltrate information.
Therefore, it may be classified into the “technical security controls” area(#541), “cryptographic controls” area (#551) or “ICT security standards”
area (#511). However, unlike information leakage prevention at theorganisational level, national level counter-intelligence is a part ofnational incident response or cyber defence.
Therefore, it was decided not to relate this action item to the capacity
areas that were mentioned above, but to add new requirements
corresponding to counter-intelligence capability. Thus, 152L3-2 and152L4-2 were added in the “organisation” area (#152) of the ANC3T.
The action item #7-331b refers to the support provided to nations in
the Asian Pacific region for the establishment of a cybercrime
jurisdiction.
There exist the requirements for international or regional cooperationand coordination in incident response (in the ‘incident response’
subcategory), the requirements for contribution to international
cooperation agreements and international treaties with regard to anti77

Chapter 4. Verification

cybercrime activities (in the ‘legal framework’ subcategory) and therequirements for cooperation in cross-border investigation (in the‘formal and informal cooperation frameworks to combat cybercrime’
subcategory). However, there is no requirement referring to theprovision of support to other nations with regard to the establishment oflegal capacities with objective of tackling cybercrime in these nations.
Therefore, it was decided to add new requirements corresponding tointernational/regional cooperation in supporting establishment oflegislative framework. Thus, 411L4-4 and 432L4-4 were added in the“legislative framework for ICT security” area (#411) and the “informalcooperation” area (#432), respectively.
The details of the added requirements are shown in the Table 4.3-8.
Table 4.3-8 Requirements Added for Enhancement#

Category

Subcategory Capacity area Level

152 Cybersecurity Cyber
Policy and
Defence
Strategy

Organisation

3-do- -do-

-do-

-do

4

411 Legal andRegulatory
Frameworks

Legal
Framework

Legislative
Frameworkfor ICT
Security

4432 Legal andRegulatory
Frameworks

Formal andInformalCooperation
Frameworks
to Combat
Cybercrime

InformalCooperation

4

ID

Keyword

Requirement

152L3-2 Countercyberintelligence
activities

There exist activities
for detecting and/or
defending against
intelligenceassessment throughcyber-space fromother nations.
152L4-2 Established Counter-cybercounter-cyber intelligence activities
intelligence are centrarised andcapability
have capability to
defend effectively.
411L4-4 International The nation cooperates
and/orinternationally and/or
regional
regionally incooperation supporting otherofnations inestablishing establishinglegislative
legislative framework
frameworkfor ICT security.
432L4-4 International The nation cooperates
and/orinternationally and/or
regional
regionally incooperation supporting otherofnations inestablishing establishing
cybercrime
cybercrime
legislation
legislation.

4.3.4 Provisional Assessment of Japanese Cybersecurity Capacity
Although it is not directly informing the verification, the national cybersecurity
capacity of Japan was provisionally assessed using the CSCMMN [13]. The full
result of the assessment is shown in the Appendix I, and the summary is shown in
the Table 4.3-9 and 4.3-10.

78Chapter 4. Verification

The result shows that Japan has achieved approximately half (51.0%) of theindicators. Moreover, there exist six unachieved indicators (two partly achieved
and four not achieved) in the “formative” stage which corresponds to the level 1
in the ANC3T.
As stated in section 4.3.3.2, 11 capacity areas are supposed to be the case 2“few”. Among the 11 areas, six areas (#413, #414, #415, #416, #422 and #423)
belong to the “legal and regulatory frameworks” category, which corresponds tothe “dimension 4” of the CSCMMN. In the “dimension 4”, Japan has achieved
54.3% of the indicators, which is almost the same as the average. It suggests that
it is not the case that Japan does not emphasise on these capacity areas because it
is already at a high level.
Note that the provisional assessment in this research is different from theofficial assessment designated in the CSCMMN in the following points.
1) The indicators that include two or more conditions have been split so that anindicator denotes one single condition (basically the same process as the
ANC3T).
2) The indicators that do not denote conditions but explanations have been
excluded.
3) State of achievement were judged into three grades; “achieved”, “partly
achieved” or “not achieved”.
4) The indicators that are not applied to Japan were assigned “achieved”. For
example, “an outline/draft national cybersecurity strategy has been
articulated” does not seem to exist in Japan but was assigned “achieved”
because Japan does not need a draft strategy anymore.
5) Stages are judged by aspects rather than factors as prescript in the CSCMMN.
These alterations are applied because the purpose of the provisional assessment
is not the measurement of the outright strength of Japan with regard to
cybersecurity but the discovery of the status of the capacity of Japan, i.e., whatindicators are achieved and what are not achieved.
This provisional assessment is based on the knowledge about the current status
of Japan with regard to cybersecurity obtained from the documents published by
the Japanese Government, i.e., “Cybersecurity 2015”, “Cybersecurity 2016”,“Cybersecurity 2017” and “Cybersecurity 2018” [36, 37, 34, 38].

79

Chapter 4. Verification

Table 4.3-9 Summary Result of Provisional Assessment of Capacity of Japan
FormativeypnEstablished

Total y%ypnStrategic

Total y%ypnTotal y%Dimension 1

22

0

2

24

91.7

30

4

6

40

75.0

13

16

17

46

28.3

Dimension 2

19

0

0

19 100.0

19

3

1

23

82.6

9

9

6

24

37.5

Dimension 3

13

1

1

15

86.7

16

1

4

21

76.2

5

7

11

23

21.7

Dimension 4

24

1

1

26

92.3

21

0

9

30

70.0

12

0

19

31

38.7

Dimension 5

27

0

0

27 100.0

24

4

7

35

68.6

8

15

6

29

27.6

Total

105

2

4

111

94.6 110

12

27

149

73.8

47

47

59

153

30.7

Dynamic
y

p

Total

n

Total y%

y

p

n

Total

y%

Dimension 1

2

3

27

32

6.3

67

23

52

142

47.2

Dimension 2

2

4

11

17

11.8

49

16

18

83

59.0

Dimension 3

0

7

9

16

0.0

34

16

25

75

45.3

Dimension 4

6

3

20

29

20.7

63

4

49

116

54.3

Dimension 5

2

10

18

30

6.7

61

29

31

121

50.4

Total

12

27

85

124

9.7

274

88

175

537

51.0

Note y: achieved, p: partly achieved, n: not achieved, y%: ratio of "y"80

Chapter 4. Verification

Table 4.3-10 Stage Judgement of Japan by Aspect
Dimension

FactorCybersecurity Policy National Cybersecurity
and Strategy
Strategy
Incident Response

Critical Infrastructure (CI)
Protection
Crisis Management
Cyber Defence

Cyber Culture andSocietyCommunications
Redundancy
Cybersecurity Mind-set

Aspect

S-u

F

E

S

D

Strategy Development
Organisation
Content
Identification of Incidents
Organisation
Coordination
Mode of Operation
Identification
Organisation
Risk Management and Response
Crisis Management
Strategy
Organisation
Coordination
Communications Redundancy

Government
Private Sector
Users
Trust and Confidence on the User Trust and Confidence on theInternet
Internet
User Trust in E-government Services
User Trust in E-commerce Services
User Understanding ofUser Understanding of Personal
Personal….
Information Protection Online
Reporting Mechanisms
Reporting Mechanisms
Media and Social MediaMedia and Social Media
Cybersecurity
Awareness Raising
Awareness Raising Programmes
Education, Training
Executive Awareness Raisingand Skills
Framework for Education
Provision
Administration
Framework for Professional Provision
Training
UptakeLegal and
Legal Framework
Legislative Framework for ICT
Regulatory
Security
Frameworks
Privacy, Freedom of Speech & Other
Human Rights Online
Data Protection Legislation
Child Protection Online
Consumer Protection Legislation
Intellectual Property Legislation
Substantive Cybercrime Legislation
Procedural Cybercrime Legislation
Criminal Justice System
Law Enforcement
Prosecution
CourtsFormal and Informal….
Formal Cooperation
Informal Cooperation
Standards,
Adherence to Standards
ICT Security Standards
Organisations, andStandards in Procurement
Technologies
Standards in Software Development
Internet InfrastructureInternet Infrastructure Resilience
Resilience
Software Quality
Software Quality
Technical Security Controls Technical Security Controls
Cryptographic Controls
Cryptographic Controls
Cybersecurity Marketplace
Cybersecurity Technologies
Cyber Insurance
Responsible Disclosure
Responsible Disclosure

Note S-u: Start-up, F: Formative, E: Established, S: Strategic, D: Dynamic: Achieved: Not Achieved

81Chapter 4. Verification

4.4 Verification (U.K.)
4.4.1 Cybersecurity Strategy of the U.K.
The United Kingdom released the “National Cyber Security Strategy 20162021” [39] in November 2016 and stated in its “Foreword” that “Much of ourprosperity now depends on our ability to secure our technology, data and networks
from the many threats we face. Yet cyber-attacks are growing more frequent,sophisticated and damaging when they succeed. So, we are taking decisive action
to protect both our economy and the privacy of U.K. citizens”.
The U.K. had formerly announced the “U.K. Cyber Security Strategy 20112016” [40] with £860 million underpinned for the National Cyber Security
Programme. Under the new strategy, the U.K. “will invest £1.9 billion in
defending our systems and infrastructure, deterring our adversaries, anddeveloping a whole-society capability - from the biggest companies to theindividual citizen” [39].
In the new strategy, the cybersecurity policies are described in the categories Defend, Deter, Develop and International Action.
The report of assessment using the CSCMM, “Cybersecurity Capacity Reviewof the United Kingdom” [18], states in its “Introduction” that the evaluation “willcontribute to the development of the UK National Cybersecurity Strategy 2016–2020.”

4.4.2 Mapping Result (U.K.)
The mapping result (accumulated by the capacity areas) is shown in the Table
4.4-1.
The interim outputs, i.e., the collected cybersecurity approaches (produced
from the U.K. Cybersecurity Strategy), the action items allocated to the tentative
ANC3T and the mapping result (accumulated by the requirements) are shown in
the Appendices D, G and H.

82

Chapter 4. Verification

Table 4.4-1 Mapping Result of the Approaches of U.K.
#

Category

Subcategory

Capacity area

Lv 1 Lv 2 Lv 3 Lv 4 Total

111 Cybersecurity National
Cybersecurity Strategy Development
and Strategy
112 Policy
Organisation
113 Strategy
Content
121
Incident Response
Identification of Incidents
122
Organisation
123
Coordination
124
Mode of Operation
131
Critical Infrastructure (CI) Identification
Protection
132
Organisation
133
Risk Management and Response
141
Crisis Management
Crisis Management
151
Cyber Defence
Strategy152
Organisation
153
Coordination
161
Communications
Communications Redundancy
Redundancy
211 Cyber Culture Cybersecurity Mind-set
Government
212 and Society
Private Sector
213
Users
221
Trust and Confidence on the User Trust and Confidence on theInternet
Internet
222
User Trust in E-government Services
223
User Trust in E-commerce Services
231
User Understanding of User Understanding of Personal
Personal
Information Information Protection Online
Protection Online
241
Reporting Mechanisms
Reporting Mechanisms
251
Media and Social MediaMedia and Social Media
311 Cybersecurity Awareness Raising
Awareness Raising Programmes
312 Education,
Executive Awareness Raising
321 Training and Framework for Education Provision
322 Skills
Administration
331
Framework for Professional Provision
Training
332
Uptake411 Legaland Legal Framework
Legislative Framework for ICT
Regulatory
Security
412 Frameworks
Privacy, Freedom of Speech & Other
Human Rights Online
413
Data Protection Legislation
414
Child Protection Online
415
Consumer Protection Legislation
416
Intellectual Property Legislation
417
Substantive Cybercrime Legislation
418
Procedural Cybercrime Legislation
421
Criminal Justice System
Law Enforcement
422
Prosecution
423
Courts431
FormalandInformal Formal Cooperation
Cooperation Frameworks to Informal Cooperation
432
Combat Cybercrime
511 Standards,
Adherence to Standards
ICT Security Standards
512 Organisations,Standards in Procurement
513 andStandards in Software Development
521 Technologies Internet
Infrastructure Internet Infrastructure Resilience
Resilience
531
Software Quality
Software Quality
541
Technical Security Controls Technical Security Controls
551
Cryptographic Controls
Cryptographic Controls
561
Cybersecurity Marketplace Cybersecurity Technologies
562
Cyber Insurance
571
Responsible Disclosure
Responsible Disclosure

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
2
0
0
1
0
1
0
2
0
0
1
0

1
0
0
0
0
7
3
2
1
4
4
4
7
3
4

4
1
1
0
1
3
2
2
3
0
5
0
4
12
3

5
1
1
2
1
10
6
4
5
4
11
4
11
16
7

0
0
0
0

0
0
0
0

0
1
1
0

1
2
1
0

1
3
2
0

0
0
0

4
0
0

1
1
0

5
0
0

10
1
0

0
0
0
0
0
0
0
0
0

2
0
1
0
5
4
1
1
0

0
0
5
2
8
8
7
4
1

0
0
5
1
12
19
6
0
4

2
0
11
3
25
31
14
5
5

0

0

0

2

2

0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
0
0
0
0
0
1
0

0
0
0
0
0
0
10
0
0
1
4

0
0
1
1
3
3
3
3
1
2
3

0
0
1
1
3
3
13
3
1
4
7

0
0
0
0

8
1
1
1

4
2
3
4

0
0
0
0

12
3
4
5

0
0
0
0
0
0

2
5
0
0
0
0

1
3
0
5
0
0

0
13
4
9
2
0

3
21
4
14
2
0

Total

0

44

116 147 307

83

Chapter 4. Verification

4.4.3 Evaluation Results (U.K.)
4.4.3.1 Case 1: Autonomous Enhancement Mechanism
The list of the number of relationships with the requirements forautonomous enhancement mechanism is shown in the Table 4.4-2.
Table 4.4-2 Number of Relationships with Requirements forAutonomous Enhancement Mechanism (U.K.)
ID
Keywords
Nb of relationships
111L4-1 Continual revision of strategy
1
112L3-1 PDCA processes of cybersecurity programme
0
112L4-1 Reassignment & reallocation of resources for cybersecurity
1
programme
113L4-1 Continual revision of strategy
1
121L3-1 Regular revision of incident registry0
124L3-3 Regular review of incident response processes
0
124L4-2 Evaluating effectiveness of CSIRT members training
0
131L4-1 Regular review of CI risk priorities
2
132L4-1 Ability to adjust of CI protection
2
133L3-4 Regular review of resource allocation for CI protection
1
133L4-1 Regular audit of CI
0
141L3-4 Evaluation of national incident exercise informing investment
2
161L3-3 Evaluation of national incident exercise informing investment
2
221L4-1 Users can evaluate risk & adjust behaviour
0
222L4-1 Promotion of e-gov revised
0
223L4-1 Continuous improvement of e-commerce
0
231L4-1 Users can adapt to changing environments
0
231L4-3 Security & privacy balanced in changing environment
0231L4-4 Regular assessment of privacy protection
0
241L4-1 Regular enhancement of incident reporting0
251L4-1 Discussion changing policy & society
0
311L4-1 Awareness raising programmes adapted according to0effectiveness
311L4-2 Revision of national awareness raising programme0
312L3-2 Executives' ability to reallocate resources1
321L4-3 Cybersecurity education adapting to changing needs
5
322L4-3 Cybersecurity education aligned with practical problems
4
331L3-4 Metrics of effectiveness of cybersecurity training
2
332L3-1 Review of cybersecurity training programmes
1
411L3-1 Regular review of cybersecurity legal framework1
411L4-1 Balance between cybersecurity legal framework & best3
practices
412L4-1 Amendment procedures for cybersecurity legal framework
0413L4-1 Amendment procedures for data protection legislation
0
414L4-1 Amendment procedures for online child protection legislation
0
415L4-1 Amendment procedures for consumer protection legislation
1
416L4-1 Balance between intellectual property & open access policy
1
417L4-2 Regular review of substantive cybercrime legislation
1
418L4-2 Regular review of procedural cybercrime legislation
1
421L4-3 Regular review of investigative capabilities for cybercrimes
3
422L3-3 Exchange of best practices between prosecutors & judges
0
422L4-3 Specialised and continuous training for prosecutors
0423L4-1 Specialised and continuous training for judges
0
423L4-2 Regular review of court system capabilities to judge
1cybercrimes
431L4-1 Regular review of international cooperation
2(continue…)
84Chapter 4. Verification
ID
Keywords
Nb of relationships
431L4-3 Regularly adjusted information exchange between public &0private sectors
432L4-1 Adapted cooperation & exchange of information
0
432L4-2 Adapted international cooperation
3
511L4-1 Regular review of adoption of standards & best practices
0
511L4-2 Decision making of non-compliance to standards & best0practices
511L4-3 Risk-based decision making of compliance0512L3-2 Regular review of procurement0521L4-1 Controlled acquisition of infrastructures
0521L4-2 Optimised cost for internet infrastructures
0531L4-3 Regular review of quality requirement0541L4-1 Continuous assess of technical security controls
12
551L4-1 Regular review of relevance of cryptographic controls
2
551L4-2 Revision of cryptographic control policies
2
571L4-1 Regular review of vulnerability disclosure policies
0571L4-4 Reviewing process of deadlines
0
Total number of relationships
58
Requirements with action items >026
Requirements with action items =032

Among 58 requirements for autonomous enhancement mechanism, 26
requirements are related with one or more action items. 32 requirements
are related with none. This result alone cannot give any judgement about
the condition 1 “velocity”. Further examination is needed to see if theresult is along with the national strategy.

4.4.3.2 Case 2: “Few”
The capacity areas that few action items are related to are shown in
the Table 4.4-3.

85

Chapter 4. Verification

Table 4.4-3 Capacity Areas of Case 2 “Few” (U.K.)
#

Lv 1

Lv 2

Lv 3

Lv 4

Total

112 Organisation

0

0

0

1

1

113 Content

0

0

0

1

1

121 Identification of Incidents

0

2

0

0

2

122 Organisation

0

0

0

1

1

211 Government

0

0

0

1

1

221 User Trust and Confidence on the Internet

0

0

0

0

0

223 User Trust in E-commerce Services

0

0

1

0

1

0

0

0

0

0

241 Reporting Mechanisms

0

2

0

0

2

251 Media and Social Media

0

0

0

0

0

0

0

0

2

2

413 Data Protection Legislation

0

0

0

0

0

414 Child Protection Online

0

0

0

0

0

415 Consumer Protection Legislation

0

0

0

1

1

416 Intellectual Property Legislation

0

0

0

1

1

423 Courts

0

0

0

1

1

562 Cyber Insurance

0

0

0

2

2

571 Responsible Disclosure

0

0

0

0

0

231

412

Capacity area

User Understanding of Personal Information
Protection Online

Privacy, Freedom of Speech & Other Human
Rights Online

In 18 capacity areas, the approaches of the U.K. are considered
possibly dissatisfactory to the condition 2 “coverage”. The areas vary
evenly over four categories. Therefore, it is not the case that theapproaches related to some particular categories are excluded from thestrategy.
As mentioned in 4.4.1, the U.K. had carried out an official assessmentof its cybersecurity capacity using the CSCMM (version 1.2, not the
CSCMMN Revised Edition that the tentative AC3T is based on) and theresult of the assessment was informed to the strategy. Therefore, thepublic sector of the U.K. understood all of the necessary capacity areas(or “category” in the terms of the CSCMM) when they developed thestrategy. Nevertheless, they planned a few (or no) approaches for 18
capacity areas. It is needed to examine further.

4.4.3.3 Case 3: “Low”
There is no capacity area that the action items are related only to thelower levels.

86

Chapter 4. Verification

4.4.3.4 Case 4: “High”
There is no capacity area that the action items are related only to thehigher levels.

4.4.3.5 Case 5: “A lot”
The capacity areas that a lot of action items are related to are shownin the Table 4.4-4.
Table 4.4-4 Capacity Areas of Case 5 “A lot” (U.K.)
Lv 1

Lv 2

Lv 3

Lv 4

Total

321 Provision#

Capacity area

0

5

8

12

25

322 Administration

0

4

8

19

31

541 Technical Security Controls

0

5

3

13

21

The “administration” area (#322) is the area that the most action items
are related to with 31 items. Following with 25 items is the “Provision”
area (#321). These two areas are of the same subcategory “framework
for education” and the total number of related items is 56, or 18% of thetotal 307 relationships. It suggests that the cybersecurity education isemphasised very much.
The third place with 21 items is the “technical security control” area(#541), which is the second place with 39 items in the case of Japaneseapproaches.

4.4.3.6 Case 6: Not Allocated
There is no action item that was not allocated to any requirement.

87

Chapter 4. Verification

4.5 Discussion
4.5.1 Four Conditions
As mentioned in 1.4, when a nation enhances its cybersecurity capacities, it
should satisfy the following four conditions.
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, oreven faster than those. (condition 1 “velocity”)
2) National cybersecurity capacities must be enhanced comprehensively overthe various capacity areas that are necessary for nations. (condition 2“coverage”)
3) National cybersecurity capacities must be enhanced up to the levels that canmatch the capacities of the attackers and other hostile nations. (condition 3“levels”)
4) National cybersecurity capacities must be enhanced efficiently so that it can
extract the optimised effects from the limited resources. (condition 4“efficiency”)
There may be questions if the four conditions are really necessary, or if the four
conditions are enough for the appropriate enhancement of the national
cybersecurity capacity.
Firstly, all of the four conditions are supposed to be really necessary. Throughthe verification, the following findings were detected;
1) The number of action items related to each requirement for the autonomousenhancement mechanism is indicated. It does not give a definitive verdict but
provides with information for further examination if the nation satisfies thecondition 1 “velocity”.
2) In some capacity areas, few action items were allocated, which indicates thatthe nation may not satisfy the condition 2 “coverage” in those capacity areas.
3) In some capacity areas, the action items were allocated only to the higher
levels or only to the lower levels, which indicates that the capacity areas may
not satisfy the condition 3 “levels” or the condition 2 “coverage” in thosecapacity areas.
4) Some capacity areas were found to be allocated a lot of action items, whichindicates that the capacity areas may not satisfy the condition 4 “efficiency”.
If any of the four conditions were dismissed, some of the possible
inappropriateness of the approaches would be left undiscovered. Therefore, all of
the four conditions are necessary for appropriate enhancement of the national
cybersecurity capacity.
88Chapter 4. Verification

Secondly, the four conditions are supposed to be enough for the appropriateenhancement of the national cybersecurity capacity. As mentioned above, themethod successfully indicated the possible discrepancies that may appear to bedissatisfactory to the conditions after further examination.
There do not exist any other type of findings through the verification. This does
not immediately mean that there may not be any other conditions to be satisfied
for appropriate enhancement of the national cybersecurity capacity. However,there do not exist any apparent missing conditions. Therefore, it is thought to beadequate for the time being to focus on the four conditions to check the approaches
for the national cybersecurity capacity enhancement. The possibility that there
may be found other conditions during the check of the approaches of the othernations using the ANC3M/ANC3T should not be ruled out.

4.5.2 Reproducibility of Checking
The method (ANC3M) is designed so that the checking result will not be muchinconsistent subject to the person who use it. This is important because thechecking result is intended to inform to consideration of possible alteration of thenational approaches.
The Table 4.5-1 shows a part of the tool (ANC3T). The user of the method(ANC3M) is required to examine if an action item will fulfil or contribute toward
fulfilling any of the requirements shown in the ANC3T. For example, assume thefollowing action item is given;“Ministry A requests all the listed companies to be equipped with thecybersecurity countermeasures according to the Standard X.”
What requirements will the action item fulfil or contribute toward fulfilling?
Probably it will contribute toward fulfilling the L2-2 “Standards & best practices
widely used” and the L2-4 “Promotion of use of standards & best practices.”
Anything else? Possibly the L1-3 “International standards & best practices
implemented.” But the action item is not supposed to fulfil nor contribute toward
fulfilling the L2-5 “Metrics of compliance of standards & best practices”, the L33 “Contributing to international standards”, the L4-3 “Risk-based decision
making of compliance” nor any other requirements.
Thus, inconsistency subject to the users of the method is supposed to be limited
to the small range. In this example, some users may find two relationships
between the action item and the capacity area while other users may find three.
But few users would say they found four or more relationships, nor say foundnone.
Therefore, there may be some inconsistency of the checking results subject tothe checker, but the inconsistency is hardly supposed to become significant. And

89

Chapter 4. Verification

small inconsistency can be absorbed by adjusting the thresholds when evaluating
the mapped results.
Table 4.5-1 Part of ANC3T
Level 1
Capacityarea
ID
Keywords
511 ICT Security L1-1 Standards forStandards
information risk
management#

Level 2
Level 3
Level 4ID
Keywords
ID
Keywords
ID
Keywords
L2-1 EstablishedL3-1 Risk-based
L4-1 Regular review
standards & best
adoption ofof adoption ofpractices
standards & best
standards & bestpractices
practices
L1-2 Standards forL2-2 Standards & best L3-2 Resource
L4-2 Decision making
information risk
practices widely
allocation basedof nonmanagement
usedon standards
compliance topartly used
standards & bestpractices
L1-3 International
L2-3 Metrics of
L3-3 Contributing to L4-3 Risk-based
standards & best
adoption ofinternational
decision making
practices
standards & best
standards
of complianceimplemented
practices
L2-4 Promotion of useof standards &best practices
L2-5 Metrics ofcompliance ofstandards & bestpractices
L2-6 Standards & bestpractices used by
CI supply chains

Additionally, checking the approaches using this method (ANC3M) does not
require the checkers to have very high skills. People with a basic knowledge aboutcybersecurity can do. Therefore, it is possible for two or more checkers to performthe mapping process in parallel and then to consolidate the outputs for a stable
result.

90

Chapter 4. Verification

4.6 Conclusion of Verification
In the verification using Japanese cybersecurity approaches, the proposed method(ANC3M) indicated that 20 capacity areas are any of the case 2 to 5. Please note that thecase 1 or the case 6 is not the findings in the approaches.
That is 38% of the total 53 capacity areas. The breakdown of the number by cases isshown in the Table 4.6-1.
The verification using the approaches of the U.K. indicated 21, or 40%.
The total number of indications, 41, or 39%, is a considerable achievement forverification.
Table 4.6-1 Number of Findings

Verification (Japan)

Case 2“few”
11Case 3“low”
2Case 4“high”
3

Case 5“a lot”
4

Verification (UK.)

18

0

0

3

Total

29

2

3

7

Verification

Total

Ratio

20

38% (20/53)

2140% (21/53)

41

39% (41/106)

On the other hand, the verification also indicated the approaches that are not allocatedto any of the requirements of the tentative ANC3T but are thought to be meaningful forthe vigorousness of the national cybersecurity capacities. In response to the indications,
the ANC3T has been enhanced by adding the requirements related to those approaches.
It is thought that the result proves the followings.
1) It is worth checking the national approaches for cybersecurity capacity enhancement.
Even a public sector who understands all of the necessary capacity areas may
possibly fail to develop a strategy that covers the areas comprehensively.
2) The proposed method (ANC3M) is workable for checking the approaches.
3) The tentative tool must be enhanced to be used as the ANC3T.

91

(Blank Page)
92

Chapter 5. Conclusion and Remaining Issues

Chapter 5. Conclusion and Remaining Issues
5.1 Conclusion
This thesis proposes the method and the tool that are aimed at checking if theapproaches for the national cybersecurity capacity enhancement are appropriate. In otherwords, they can check if the approaches satisfy the following four conditions.
1) National cybersecurity capacities must be enhanced at the same velocity as
technology, skills of attackers and capacities of other nations develop, or even fasterthan those. (condition 1 “velocity”)
2) National cybersecurity capacities must be enhanced comprehensively over thevarious capacity areas that are necessary for nations. (condition 2 “coverage”)
3) National cybersecurity capacities must be enhanced up to the levels that can matchthe capacities of the attackers and other hostile nations. (condition 3 “levels”)
4) National cybersecurity capacities must be enhanced efficiently so that it can extract
the optimised effects from the limited resources. (condition 4 “efficiency”)
The method and the tool were verified by applying them to the actual approaches
implemented by Japan and the U.K. The verification proved that the method works wellwhile the tool that was tentatively derived from the CSCMMN needs enhancement. The
tool has been enhanced by adding four requirements according to the findings obtained
through verification.
In order to provide with the analytical functionality, the database is also proposed. The
database consists of the set of the approaches for the national cybersecurity capacity
enhancement that are categorised and classified according to the proposed method. It is
supposed to be used when one wants to know what kind of approaches are adopted forenhancing a particular capacity, what level is aimed at in a particular capacity, what
capacity areas are emphasised in a particular period of time, and so on.
The method is called “ANC3M” (Approaches for National Cybersecurity Capacity
enhancement Checking Method).
The tool is called “ANC3T” (Approaches for National Cybersecurity Capacity
enhancement Checking Tool).
The database is called “ANC3DB” (Approaches for National Cybersecurity Capacity
enhancement Checked DataBase).
By proposing the method and the tool to check the appropriateness of the approaches
for the national cybersecurity capacity enhancement, this research should contributetoward ensuring the appropriateness of the approaches. And the ANC3M, ANC3T and
ANC3DB will help improving the approaches. Then, they should contribute toward93Chapter 5. Conclusion and Remaining Issues

improvement of the national cybersecurity capacities. Ultimately, this research is aiming
at contribution to the decrease of cyber-attacks world-wide and reduction of the possible
damages caused by cyber-attacks.
In order for the research to contribute toward improvement of the approaches, it isdesirable that the policymakers carry out the check of the approaches using the ANC3M
and ANC3T, and refer to the ANC3DB for consideration of improvement of theapproaches. However, it is not necessarily the policymakers who use them, but anyone
else can do. If anyone other than the policymakers of the nation, or even anyone outsideof the nation carry out the check of the approaches and the result informs to the decisionof the approaches, this research can contribute towards improvement of the approachesof that nation.
In the verification process, the author checked the approaches of Japan and the United
Kingdom. Even if the author continues checking the approaches of other nations, thenumber of the nations whose approaches are check by the method will be limited.
However, if other people join and check the approaches of various nations using the
ANC3M, the approaches of an increased number of nations will be checked and thecontribution of this research will be greater.
The method is designed so that the checking result will not be much inconsistentsubject to the person who use it.
Furthermore, the database that is proposed in this research can be used with or without
the checking method. In other words, while the ANC3DB can be used after checking theapproaches using the ANC3M, it can also be used on its own for consideration of
improvement of the approaches.
Therefore, this research is supposed to contribute widely toward improvement of theapproaches, the national cybersecurity capacities and ultimately cyber threat
environment.

5.2 Remaining Issues
It is desired that the ANC3M/ANC3T are adopted by the public sector to help checking
their cybersecurity capacity enhancement approaches. However, applying the
ANC3M/ANC3T to the approaches will just provide with the information that theapproaches in some capacity areas are possibly inappropriate. The public sector will haveto plan and execute additional approaches and/or streamline the approaches to improvethe capacity enhancement. If the information about the examples of the approaches thatare executed in other nations and/or the statistical data are provided with, the public
sector will be more motivated to check their approaches by applying the
ANC3M/ANC3T. The ANC3DB is supposed to give such information if the sufficient
data are collected.
94

Chapter 5. Conclusion and Remaining Issues

Therefore, it is supposed to be important to continue collecting the approaches that are
aimed at enhancing the national cybersecurity capacity.
Moreover, collecting the data will possibly enhance the ANC3T if the approaches canstrengthen the capacities that are not described in the existing requirements in the ANC3T.
That will increase the attractiveness of the ANC3M/ANC3T.
Furthermore, if the considerable amount of data is collected, the ANC3DB will not
only give information that help determining the alteration of the approaches, but havepossibility to lead to a discovery of the statistical findings.
Therefore, it is planned to continue collecting the data besides promoting the
ANC3M/ANC3T. If any statistical findings are observed, it will be publicised
accordingly.

95

(Blank Page)
96

References

References[1]

Oath Inc. news release on 3 Oct. 2017 “Yahoo provides notice to additional users affectedby previously disclosed 2013 data theft”<https://www.oath.com/press/yahoo-provides-notice-to-additional-users-affected-bypreviously/> (Referred on 12 February 2019)[2]

The New York Times article on 30 Apr. 2016 “Hackers’ $81 Million Sneak Attack on
World Banking”<https://www.nytimes.com/2016/05/01/business/dealbook/hackers-81-million-sneakattack-on-world-banking.html> (Referred on 12 February 2019)[3]

SANS ICS Defense Use Case March 18, 2016 “Analysis of the Cyber Attack on the
Ukrainian Power Grid”<https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf> (Referred on 12
February 2019)[4]

SANS ICS Defense Use Case No.6 August 2, 2017 “Modular ICS Malware”<https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_6.pdf> (Referred on 12
February 2019)[5]

Executive Order 13687 of January 2, 2015 “Imposing Additional Sanctions With Respect
To North Korea”<https://www.federalregister.gov/documents/2015/01/06/2015-00058/imposingadditional-sanctions-with-respect-to-north-korea> (Referred on 12 February 2019)[6]

Y. Tagawa and K. Hayashi, “Information Sharing and the Core Institution for
Cybersecurity”, Bulletin of Institute of Information Security, Vol. 9, PP. 17-44, 2017
(Japanese only)
田川義博，林紘一郎：サイバーセキュリティのための情報共有と中核機関のあり方 －3 つのモデルの相互比較とわが国への教訓－，情報セキュリティ総合科学（情報セキュ リ テ ィ 大 学 院 大 学 紀 要 ） ， Vol. 9 ， pp. 17-44 （ オ ン ラ イ ン ） ， 入 手 先 ＜http://www.iisec.ac.jp/proc/vol0009/tagawa-hayashi17.pdf＞（2017）[7]

The Policy Appraisal and Evaluation Study Group, The Present Conditions and Concernof the Policy Appraisal and Evaluation. Bokutakusha, 1999 (Japanese only)
政策評価研究会：政策評価の現状と課題－新たな行政システムを目指して，木鐸社（1999）[8]

National Institute of Standards and Technology “Framework for Improving Critical
Infrastructure Cybersecurity Version 1.1”

97

References<https://www.nist.gov/publications/framework-improving-critical-infrastructurecybersecurity-version-11> (Referred on 12 February 2019)[9]

HM Treasury of the United Kingdom “The Greenbook; Central Government Guidanceon Appraisal and Evaluation”<https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachme
nt_data/file/685903/The_Green_Book.pdf> (Referred on 12 February 2019)[10] H. Kodama, “Verification of the Policy Appraisal and Evaluation of the United Kingdom
and Suggestion to Japan”, Hakuoh Review of Law and Politics, Vol. 18 No. 1, PP. 269349, 2011 (Japanese only)
児玉博昭：英国における政策評価システムの検証とわが国への示唆：政策達成目標明
示制度導入の是非，白鴎法学（白鴎大学法学部紀要），Vol. 18，No. 1，pp. 269-349（オンライン），入手先＜https://hakuoh.repo.nii.ac.jp/?action=pages_view_main&active_action=repository_view_main_
item_detail&item_id=1940&item_no=1&page_id=13&block_id=21＞（2011）[11] International Telecommunication Union “Global Cybersecurity Index (GCI) 2017”<https://www.itu.int/dms_pub/itu-d/opb/str/D-STR-GCI.01-2017-PDF-E.pdf>(Referred on 12 February 2019)[12] Global Cyber Security Capacity Centre “Cyber Security Capability Maturity Model(CMM) –V1.2”<https://www.sbs.ox.ac.uk/cybersecuritycapacity/system/files/CMM%20Version%201_2_0.pdf> (Referred on 12 February
2019)[13] Global Cyber Security Capacity Centre “Cybersecurity Capacity Maturity Model for
Nations (CMM) Revised Edition”<https://www.sbs.ox.ac.uk/cybersecuritycapacity/system/files/CMM%20revised%20edition_09022017_1.pdf> (Referred on 12
February 2019)[14] Global Cyber Security Capacity Centre “Cybersecurity Capacity Review of the Republicof Uganda”<https://www.sbs.ox.ac.uk/cybersecurity-capacity/system/files/Uganda%20CMM.pdf>(Referred on 12 February 2019)[15] Global Cyber Security Capacity Centre “Cybersecurity Capacity Review of the Republicof Senegal”<https://www.sbs.ox.ac.uk/cybersecurity-capacity/system/files/Senegal-Reportv4%20.pdf> (Referred on 12 February 2019)98

References[16] Global Cyber Security Capacity Centre “Building Cyber-security Capacity in theKingdom of Bhutan”<https://www.sbs.ox.ac.uk/cybersecuritycapacity/system/files/CMM_Review_Report_Bhutan_September_2015.pdf> (Referredon 12 February 2019)[17] Global Cyber Security Capacity Centre “Cybersecurity Capacity Assessment of the
Republic of Kosovo”<https://www.sbs.ox.ac.uk/cybersecuritycapacity/system/files/CMM_Review_Report_Kosovo_June_2015.pdf> (Referred on 12
February 2019)[18] Global Cyber Security Capacity Centre “Cybersecurity Capacity Review of the United
Kingdom”<https://www.sbs.ox.ac.uk/cybersecuritycapacity/system/files/Cybersecurity%20Capacity%20Review%20of%20the%20United%20Kingdom.pdf> (Referred on 12 February 2019)[19] Inter-American Development Bank “Cybersecurity: Are We Ready in Latin America andthe Caribbean?”<https://publications.iadb.org/handle/11319/7449> (Referred on 12 February 2019)[20] Global Cyber Security Capacity Centre “CMM Assessments Around the World”<https://www.sbs.ox.ac.uk/cybersecurity-capacity/content/cmm-assessments-aroundworld> (Referred on 12 February 2019)[21] Australian Strategic Policy Institute “Cyber Maturity in the Asia Pacific Region 2017”< https://www.aspi.org.au/report/cyber-maturity-asia-pacific-region-2017> (Referred on
12 February 2019)[22] The Software Alliance “EU Cybersecurity Dashboard”<http://cybersecurity.bsa.org/index.html> (Referred on 12 February 2019)[23] Federal Financial Institutions Examination Council “Cybersecurity Assessment Tool”<https://www.ffiec.gov/cyberassessmenttool.htm> (Referred on 12 February 2019)[24] International Organization for Standardization “ISO/IEC 27032:2012”<https://www.iso.org/standard/44375.html> (Referred on 12 February 2019)[25] Ministry of Economy, Trade and Industry, Independent Administrative Agency
Information-technology Promotion Agency “Cybersecurity Management Guidelines
Ver.1.1”<http://www.meti.go.jp/policy/netsecurity/downloadfiles/CSM_Guidelines_v1.1_en.pd
f> (Referred on 12 February 2019)99

References[26] CMMI Institute “CMMI Development V2.0”<https://cmmiinstitute.com/products/cmmi/dev> (Referred on 12 February 2019)[27] Mary Beth Chrissis, Mike Konrad and Sandy Shrum, CMMI for Development:
Guidelines for Process Integration and Product Improvement Third Edition. AddisonWesley Professional, 2011[28] Executive Order 13718 of February 9, 2016 “Commission on Enhancing National
Cybersecurity”<https://www.federalregister.gov/documents/2016/02/12/2016-03038/commission-onenhancing-national-cybersecurity> (Referred on 12 February 2019)[29] The Commission on Enhancing National Cybersecurity “Report on Securing and
Growing the Digital Economy”<https://www.nist.gov/sites/default/files/documents/2016/12/02/cybersecuritycommission-report-final-post.pdf> (Referred on 12 February 2019)[30] Information Security Policy Council “Cybersecurity Strategy - Toward a world-leading,resilient and vigorous cyberspace -”<https://www.nisc.go.jp/eng/pdf/cybersecuritystrategy-en.pdf> (Referred on 12
February 2019)[31] Information Security Policy Council “Information Security Strategy for Protecting the
Nation”<https://www.nisc.go.jp/eng/pdf/New_Strategy_English.pdf> (Referred on 12 February
2019)[32] The Government of Japan “Cybersecurity Strategy”<https://www.nisc.go.jp/eng/pdf/cs-strategy-en.pdf> (Referred on 12 February 2019)[33] National center of Incident readiness and Strategy for Cybersecurity “Annual Report ofCybersecurity Policies (Fiscal Year 2016)” (Japanese only)<https://www.nisc.go.jp/active/kihon/pdf/jseval_2016.pdf> (Referred on 12 February
2019)
内閣サイバーセキュリティセンター：サイバーセキュリティ政策に係る年次報告（2016 年度）（オンライン），入手先＜https://www.nisc.go.jp/active/kihon/pdf/jseval_2016.pdf＞（2017）[34] National center of Incident readiness and Strategy for Cybersecurity “Cybersecurity 2017”(Japanese only)<https://www.nisc.go.jp/active/kihon/pdf/cs2017.pdf> (Referred on 12 February 2019)内閣サイバーセキュリティセンター：サイバーセキュリティ 2017（オンライン），入手先＜https://www.nisc.go.jp/active/kihon/pdf/cs2017.pdf＞（2017）100

References[35] Counter-Intelligence Promotion Council “Basic Strategy for Enhancing CounterIntelligence Capabilities” (Japanese only)<http://www.cas.go.jp/jp/seisaku/counterintelligence/pdf/basic_decision_summary.pdf> (Referred on 12 February 2019)
カウンターインテリジェンス推進会議：カウンターインテリジェンス機能の強化に関する基本方針（オンライン），入手先＜http://www.cas.go.jp/jp/seisaku/counterintelligence/pdf/basic_decision_summary.pdf＞（2007）[36] National center of Incident readiness and Strategy for Cybersecurity “Cybersecurity 2015”(Japanese only)<https://www.nisc.go.jp/active/kihon/pdf/cs2015.pdf> (Referred on 12 February 2019)内閣サイバーセキュリティセンター：サイバーセキュリティ 2015（オンライン），入手先＜https://www.nisc.go.jp/active/kihon/pdf/cs2015.pdf＞（2015）[37] National center of Incident readiness and Strategy for Cybersecurity “Cybersecurity 2016”(Japanese only)<https://www.nisc.go.jp/active/kihon/pdf/cs2016.pdf> (Referred on 12 February 2019)内閣サイバーセキュリティセンター：サイバーセキュリティ 2016（オンライン），入手先＜https://www.nisc.go.jp/active/kihon/pdf/cs2016.pdf＞（2016）[38] National center of Incident readiness and Strategy for Cybersecurity “Cybersecurity 2018”(Japanese only)<https://www.nisc.go.jp/active/kihon/pdf/cs2018.pdf> (Referred on 12 February 2019)内閣サイバーセキュリティセンター：サイバーセキュリティ 2018（オンライン），入手先＜https://www.nisc.go.jp/active/kihon/pdf/cs2018.pdf＞（2018）[39] Government of UK “National Cyber Security Strategy 2016-2021”<https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/567242/national_cyber_security_strategy_2016.pdf> (Referred on 12 February 2019)[40] Government of UK “The UK Cyber Security Strategy”<https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/60961/
uk-cyber-security-strategy-final.pdf> (Referred on 12 February 2019)101

Research Achievement

Research Achievement
Journals with Peer Review
J-1)
Name of Journal
Publisher
Published date
Title
Author(s): Journal of Disaster Research (Vol.13 No.5): Fuji Technology Press, Ltd.
: 1 October 2018
: Reviewing National Cybersecurity Strategies: S. Mori & A. Goto

International Conferences with Peer Review
C-1)
Name of Conference : Doctoral Consortium,
Pacific Asia Conference on Information Systems
Organizer(s): Association for Information Systems (AIS),The Japan Society for Management Information (JASMIN)
Conference date: 26-27 June 2018
Title
: Review of National Cybersecurity Strategy – Case Study: UK –Author(s): S. Mori & A. Goto

Other Achievement
O-1)
Name of Journal
Publisher
Published date
Title
Author(s): Administration & Information Systems: Institute of Administrative Information Systems: December 2015
: Cybersecurity and Data Leakage Preventive Measures(in Japanese): S. Mori & A. Goto

O-2)
Name of Conference : 72nd Research Workshop for Electronic Intellectual Property
Organizer(s): SIG Electronic Intellectual Property, IPSJ,Technical Committee on Social Implications of Technology andInformation Ethics, IEICE
Conference date: 2-3 June 2016
Title
: A Study on Web Access Log Utilization for Understanding of
Organizational Climate Changes (in Japanese)
Author(s): E. Kamigauchi, S. Mori & A. Goto

102

Research Achievement

O-3)
Name of Conference : Computer Security Symposium 2016
Organizer(s): SIG Computer Security, IPSJ
Conference date
: 11-13 October 2016
Title
: Analysis on Cyber Incident of Japan Pension Service based on
Cyber Kill Chain (in Japanese)
Author(s): S. Mori et.al
O-4)Name of Conference : Computer Security Symposium 2016
Organizer(s): SIG Computer Security, IPSJ
Conference date
: 11-13 October 2016
Title
: Financial Cyber Kill Chain for Countermeasures of Financial Fraud(in Japanese)
Author(s): S. Okada, S. Mori & A. Goto
O-5)
Name of Conference : 75th Research Workshop for Computer Security
Organizer(s): SIG Computer Security, IPSJ
Conference date: 1-2 December 2016
Title
: Cloud Services for Enterprises on Management of OS Updates
for Smart Phones/Tablets (in Japanese)
Author(s): M. Hasegawa, S. Mori & A. Goto
O-6)
Name of Conference : 170th/76th Joint Research Workshop for Distributed Processing
System and Computer Security
Organizer(s): SIG Distributed Processing System, IPSJ,SIG Computer Security, IPSJ
Conference date: 2-3 March 2017
Title
: Proposal of automated OSINT Acquisition and Tag Generation
System (in Japanese)
Author(s): J. Amano et.al103

Research Achievement

O-7)
Name of Conference : 79th National Convention of IPSJ
Organizer(s): IPSJ
Conference date
: 16-18 March 2017
Title
: Verification of Financial Cyber Kill Chain for Countermeasuresagainst Financial Fraud (in Japanese)
Author(s): S. Okada, S. Mori & A. Goto
O-8)
Name of Conference : IEICE General Conference 2018
Organizer(s): IEICE
Conference date
: 20-23 March 2018
Title
: Semi-Internal Criminals in the Connected Manufacturing(in Japanese)
Author(s): K. Nakashima, S. Mori & A. Goto
O-9)
Name of Conference : Computer Security Symposium 2018
Organizer(s): SIG Computer Security, IPSJ
Conference date: 22-25 October 2018
Title
: Assessment of National Capabilities Using the Modified‘Cybersecurity Capacity Maturity Model’(in Japanese)
Author(s): S. Mori & A. Goto
Note
SIG
: Special Interest GroupIPSJ : Information Processing Society of JapanIEICE : The Institute of Electronics, Information and Communication Engineers

104Appendices105

Appendix A

Appendix A Cybersecurity Capacity Maturity Model for Nations Revised Edition#
Dimension
Factor
111 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

AspectStrategy
Development

Start-Up
No national cybersecurity strategy exists,
although planning processes for strategy
development may have begun.

Formative
An outline/draft national cybersecurity
strategy has been articulated.

Advice may have been sought frominternational partners.

Processes for strategy development havebeen initiated.
Consultation processes have been agreed
for key stakeholder groups, includinginternational partners.

112 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

Organisation

No overarching national cybersecurity
programme has been developed.

A coordinated cybersecurity programme isbeing developed through amultistakeholder consultative process.
However, budgets reside in disparate
public departments without a discrete
cybersecurity budget line.

113 Cybersecurity Policy Nationaland Strategy
Cybersecurity
StrategyContent

Various national policies may exist with areference to cybersecurity, but if so, thecontent is generic, not necessarily alignedwith national goals, and does not provide
actionable directives.

Content includes links established between
cybersecurity, national risk priorities andbusiness development, but these are
generally ad-hoc and lack detail.

121 Cybersecurity Policy Incident Response
and Strategy

Identification of
Incidents

No catalogue of national level incidents
exists, or is in development.

Certain cybersecurity incidents have been
categorised and recorded as national-level
threats.

122 Cybersecurity Policy Incident Response
and Strategy

Organisation

No organisation for national cyber incident Private sector organisations key to national
response exists.
cybersecurity have been identified, but noformal coordination and information
sharing mechanisms exist between public
and private sectors.
Dispersed public and private sector bodies
detect and respond to incidents as theyoccur but a specific mandate for a national
cyber incident response organisation is yet
to be agreed.

123 Cybersecurity Policy Incident Response
and Strategy

Coordination

Coordination of incident response isinformally managed within or between
public and private sectors.

Leads for incident response have been
designated at the operational level, but
national-level coordination has not yet
been established.

124 Cybersecurity Policy Incident Response
and Strategy

Mode of Operation

Key incident response processes
Key incident response processes have been(detection, resolution, prevention, etc.) and identified, but not officially documented or(digital) tools to support them have notoperationalised.
been well defined or documented.
There is limited or no sufficient training or Members of CSIRTs receive training in anunderstanding of the key concepts of
ad-hoc manner.
cybersecurity incident response.
Incident response is reactive and ad-hoc.

106Appendix A(reproduced from original document)
Established
Strategic
A national cybersecurity strategy has been published. Strategy review and renewal processes are
confirmed.

Multi-stakeholder consultation processes have been
followed and observations fed back to the identified
strategy 'owners'.
National cybersecurity strategy is promoted andimplemented by multiple stakeholders acrossgovernment and other sectors.

Dynamic
Continual revision and refinement of cybersecurity
strategy is conducted proactively to adapt tochanging socio-political, threat and technology
environments.

The single agreed cybersecurity programme has adesignated coordinating body with a mandate toconsult across public and private sectors, and civilsociety.

Regular scenario and realtime cyber exercises that
The country is a leader within the international
provide a concurrent picture of national cybercommunity and the debate shaping the development
resilience are considered a strategic priority.
of global cybersecurity strategy.
Relevant metrics, measurement, and monitoringprocesses, data, and historic trends are evaluated andinform decision-making.
Cybersecurity strategic plans, aligned with national
strategic priorities, drive capacity building andinvestments in security.
Evidence exists of iterative application of metrics
A singular national cybersecurity posture exists withand resulting refinements to operations and strategy the ability to reassign tasks and budgets dynamically
across government, including resource allocationaccording to changing risk assessments.
considerations.

The programme is defined according to goals andobjectives, using metrics to measure progress.

A consolidated cybersecurity budget has been
administered in order to allocate resources.

A designated national body disseminates andreceives feedback on the strategy from wider society
to continuously enhance the national cybersecurity
posture.

Metrics and measurements are utilised to update
national cybersecurity strategy content to help
leaders evaluate the success of the various
cybersecurity objectives and guide resource
investment.

New content is periodically incorporated in thestrategy in response to evolving threat landscapes.

Discrete budget for cybersecurity exists, but is not
yet a part of a consolidated budget.
The content of the national cybersecurity strategy islinked explicitly and directly to national risks,priorities and objectives, as well as businessdevelopment.

Content at a minimum should seek to raise public
Content now also seeks to protect criticalawareness, mitigate cybercrime, establish incident
infrastructure internal threats.
response capability and protect critical infrastructurefrom external and internal threats.

Content of the national cybersecurity strategy leads,
promotes and encourages national and international
cooperation to ensure a secure, resilient and trusted
cyberspace.

A central registry of national-level cybersecurity
incidents is operational.

Regular, systematic updates to the national-level
incident registry are made.

Focus on incident identification and analysis is
adapted in response to environmental changes.

A funded national body for incident response has
been established (such as CSIRTs or CERTs), withspecified roles and responsibilities.

Resources are allocated for analysing incidents inorder to prioritise which incidents are most urgent.
Distinct and formal security roles and responsibilities National incident response capability is fully
are allocated across government, criticalfinancially sustainable, from a single or multiple
infrastructure, enterprise, and individual systems.
sources.

Human and financial resources allocated to incident
response are adequate to the cybersecurity threat
environment and enhance effectiveness of theorganisation.

An early warning capacity is incorporated into themission of the incident response organisation, whichseeks to shape and manage the threat landscape
before responding to specific incidents.

Routine and coordinated national incident response
is established and published between public andprivate sectors, with lines of communication
prepared for times of crisis.

The national incident response organisation
coordinates and collaborates with subnational/
sectorial incidentresponse organisations.

Multi-level and inclusive national and international
coordination between all levels and sectors isinternalised as vital for continuous and effective
incident response.

International cooperation for incident response
between organisations exists to resolve incidents asthey occur.

Technical capabilities now go beyond coordinating Regional coordination exists to resolve incidents as
response and include strategically focusing resources they occur.
in coordinating international incident and threat
intelligence analysis/support.

Key incident response processes and tools aredefined, documented and functional.

Members of CSIRTs receive training regularly inorder to understand key concepts of cybersecurity
incident response.
National-level incident response is limited in scopeand still reactive.

A platform for the reporting and sharing of incidents
across sectors is promoted.
Incident response teams have established a training The results of testing key processes through casepolicy for their members; members are being trained scenarios are being analysed and are incorporated
in specialised subjects and accredited byinto the updating of processes.
internationally recognised bodies on a regular basis.
Team members are able to carry out a sophisticatedincident analysis investigation quickly andefficiently.
Key processes (detection, resolution, prevention,etc.) are being monitored and reviewed in regularbasis, and tested with different case scenarios.
Forensics services are offered.

The benefits of training and accreditation are being
evaluated and inform the future training planning.
Tools for early detection, identification, prevention,
response and mitigation of zero-day vulnerabilities
are embedded in incident response organisation(s).
Mechanisms for regional cooperation in incident
response have been established.

National incident response teams coordinate withinternational counterparts.

107Appendix A#
Dimension
FactorAspect131 Cybersecurity Policy Critical Infrastructure Identificationand Strategy(CI) Protection

Start-Up
Formative
Some understanding of what comprises CI A list of general CI assets has beenassets is acknowledged, but no formal
created.
categorisation of assets has been produced.

132 Cybersecurity Policy Critical Infrastructure Organisationand Strategy(CI) Protection

There is little or no interaction between
government ministries and owners of CI
assets.

There is informal and ad-hoc threat andvulnerability disclosure among CI owners
as well as between CI and the government,
but the scope of reporting requirements has
not been specified.

No mechanism for collaboration exists.

133 Cybersecurity Policy Critical Infrastructure Risk Management
and Strategy(CI) Protection
and Response

Risk management skills and understanding Physical and virtual access control is
may be incorporated into business
implemented.
practices, but cybersecurity, if recognised,
is subsumed into IT and data protection
risk and is not recognised as a priority.
Response planning and threat awarenessmay have been broadly discussed, but noformal plan exists.

CI has basic capacity to detect, identify,
respond to and recover from cyber threats,
but such capabilities are uncoordinated andvary in quality.
Protection of CI assets includes basic levelcybersecurity awareness and data security
policies, but no protection processes havebeen agreed.

141 Cybersecurity Policy Crisis Management
and Strategy

Crisis Management

It is understood that general crisis
management is necessary for national
security, but cybersecurity is not yet
considered as a component.

A preliminary cybersecurity needs
assessment of measures and techniquesthat require testing has been undertaken,
but no exercise has been conducted at thispoint.

Crisis management exercise design and
An exercise planning authority has beenplanning authority may have been allocated designated, and has outlined the steps to be
in principle (either directly or via
taken in order to conduct the cybersecurity
consultants), but cybersecurity crisis
exercise.
management planning has not beenthoroughly outlined.
Key stakeholders and other subject matter
experts, such as think tanks, academics,
civil leaders and consultants are includedin the planning process.
Exercise monitors, if designated, areinternal and may lack training.

151 Cybersecurity Policy Cyber Defence
and Strategy

Strategy

National security policy and Defence
Specific threats to national security instrategy may be published and may contain cyberspace have been identified, such asa cybersecurity component.
external threat actors (both state and nonstate), insider threats, supply chain
vulnerabilities, and threats to military
operational capacity, but a coherent
strategy does not yet exist.

152 Cybersecurity Policy Cyber Defence
and Strategy

Organisation

Informal management of cyber Defence
Cyber operations units are incorporated
may be distributed among the armed forces into the different branches of the armed
and/or government organisations, withforces, but no central command and control
occasional reference to signals intelligence. structure exists.

108Appendix A
EstablishedA detailed audit of CI assets as it relates tocybersecurity is performed on a regular basis.

Strategic
Dynamic
CI risks and assets have been prioritised according to Priority listing of CI assets is regularly re-appraised
vulnerability and impact, which guides strategic
to capture changes in the threat environment.
investment.

CI asset audit lists are disseminated to relevant
stakeholders.

Vulnerability/asset management processes are inplace so that incremental security improvements canbe made.
A mechanism is established for regular vulnerability There is a clear understanding of which threats to CI Owners of critical infrastructure and assets are able
disclosure with defined scope for reporting incidents are managed centrally, and which are managed
to rapidly respond to the changing threat landscape.
(either mandatory or voluntary) between CI asset
locally.
owners and the government.
Formal internal and external CI communication
strategies have been defined and are consistentacross sectors, with clear points of contact.

A public awareness campaign to facilitate the CI
Trust has been established between the government
communication strategy is established with a point of and CIs with respect to cybersecurity and exchange
contact for this information.
of threat information, which is fed into the strategic
decision-making process.

Strategic engagement between government and CI is Cybersecurity requirements and vulnerabilities in CI
agreed and promoted.
supply chains are clearly identified, mapped andmanaged.
Best practices in security measures, guidelines, and Cybersecurity is firmly embedded into general risk Audit practices to assess network and systemstandards for CI cybersecurity have been established management practice.
dependencies and vulnerabilities (i.e. unmitigatedand adopted.
dependencies) are implemented on a regular basis
and inform continuous reassessment of CI risk
portfolio, technologies, policies and processes.
Cybersecurity risk management processes have been Assessment of the breadth and severity of harm
established, supported by adequate technical security incurred by CI assets is regularly conducted andsolutions, communication links, and harm mitigation response planning is tailored to that assessment tomeasures.
ensure business continuity.
CI risk management procedures are used to create anational response plan including the participation of
all vital entities.

Resources are allocated in proportion to the assessed
impact of an incident to ensure rapid and effective
incident response.

A cybersecurity exercise, with limited size andgeographic scope has been conducted involving all
relevant stakeholders in all sectors.

Insider threat detection is accounted for.
A realistic high-level scenario informs a plan to test
information flows, decision-making and resource
investment at the national level.

The impact of cybersecurity risk on the business
operations of CI, including direct and opportunity
costs, impact on revenue, and hindrance toinnovation, are understood and incorporated into
future planning and executive decision making.

The exercise involves neutral peer stakeholders to
observe, and, where appropriate, contribute, andaddresses international challenges to produce
scalable results for international policy- anddecision-making.

Appropriate resources have been allocated to theexercises.

Trust is developed well in advance via therecruitment and pre-exercise briefing process andthrough guaranteed confidentiality control.

An evaluation of the crisis management exercise isprovided for the international community, so thatlessons learnt can contribute toward a global
understanding of crisis management.

Planning process includes the engagement ofparticipants, an outline of their role in the exercise,and the articulation of benefits and incentives forparticipation.

Specific, Measurable, Attainable, Relevant, andTime-Bound (SMART) objectives and performance
key indicators (PKI) inform decisions in crisis
management, and evaluation results inform future
investment in national cybersecurity capacity.

Crisis management is embedded in risk analysis,
review and management.

Trained internal or external monitors facilitate theexercise.
The exercise is evaluated and commentary isprovided by participants and stakeholders.

Findings are evaluated against international crisis
management good practice.
Tailored, sector-specific reports are prepared foreach stakeholder, while ensuring sensitive
information is secured.
National cyber Defence policy or strategy exists and Resources dedicated toward Cyber Defence are
outlines the country’s position in its response toallocated based on national strategic objectives.
different types and levels of cyber-attacks (forexample, cyber-enabled conflict producing a kinetic
effect and offensive cyber-attacks aimed to disrupt
infrastructure).

The policy or strategy drives the international
discussion on rules of engagement in cyberspace.

The evolving threat landscape in cybersecurity is
Rules of engagement are clearly defined and thecaptured through repeated review in order to ensure military doctrine that applies to cyberspace is fully
that cyber Defence ways and means continue to meet developed and takes note of significant shifts in thenational security objectives.
cybersecurity environment.
There is a defined organisation within the Defence
Highly specialised expertise with advanced
apparatus responsible for conflict using cyber means. capabilities and full situational awareness areintegrated into the national defence posture.

The Defence apparatus contributes to the debate indeveloping a common international understanding of
the point at which a cyber-attack might trigger across-domain response.

109

Appendix A#
Dimension
Factor
153 Cybersecurity Policy Cyber Defence
and Strategy

AspectCoordination

Start-Up
Formative
No, or limited, capacity for coordinatedCyber Defence capability requirements arecyber Defence exists between domestic
agreed between the public and private
stakeholders (e.g. law enforcement, public, sector in order to minimise the threat toand enterprise, private) or interstatenational and international security.
stakeholders (e.g. allied or neutral states).

161 Cybersecurity Policy Communications
and Strategy
RedundancyCommunications
Redundancy

Digital redundancy measures may beconsidered, but not in a systematic,
comprehensive fashion.

Stakeholders convene to identify gaps andoverlaps in emergency response asset
communications and authority links.

Current emergency response assets may
have been identified, but lack any level ofintegration.

Emergency response assets, priorities andstandard operating procedures are mappedand identified in the event of acommunications disruption along any nodein the emergency response network.

211 Cyber Culture andSociety

Cybersecurity Mind- Government
set

Government has no or minimal recognition Leading agencies have begun to placeof the need to prioritise a cybersecurity
priority on cybersecurity, by identifying
mind-set.
risks and threats.
Leading agencies within government may
have begun to consider cybersecurity.

212 Cyber Culture andSociety

Cybersecurity Mind- Private Sectorset

The private sector has no or minimal
recognition of the need to prioritise acybersecurity mind-set.

213 Cyber Culture andSociety

Cybersecurity Mind- Users
set

221 Cyber Culture andSociety

Trust and Confidence User Trust andon the Internet
Confidence on theInternet

Leading firms have begun to place priority
on a cybersecurity mind-set by identifying
high-risk practices.

Programmes and materials have been madeavailable to train and improvecybersecurity practices.
Users have no or minimal recognition of
A limited proportion of Internet users havethe need to prioritise a cybersecurity mind- begun to place priority on cybersecurity,
set and take no proactive steps to improve by identifying risks and threats.
their cybersecurity.
Most Internet users have blind trust on
websites and regarding what they see or
receive online.

A very limited proportion of Internet users
critically assess what they see or receive
online and believe that they have the ability
to use the Internet and protect themselves
online.

Operators of Internet infrastructure may
consider measures promoting trust in
online services.

A limited proportion of users trust in the
secure use of the Internet based on
indicators of website legitimacy.

Operators of Internet infrastructuredevelop measures to promote trust in
online services but have not established
them.

110

Appendix A
EstablishedThe entity in charge of cyber Defence coordinates
integration regarding cyber events between
government, military and critical infrastructure andidentifies clear roles and responsibilities.

Strategic
Dynamic
Analytical capacity exists to support the coordination The country is leading the international debate onof resource allocation for national cyber Defence;cyber Defence and systematically shares intelligencepossibly including a cyberdefence research centre.
with allies.

Defence organisations and critical infrastructure
providers have established a mechanism to report
threat intelligence.

The understanding of strengths and weaknesses
within the coordination mechanism then feeds into
the re-evaluation of the national security posture of
the nation.

Emergency response assets are hardwired into anational emergency communication network.

Outreach and education of redundant
Optimised efficiency is in place to mediate extended
communications protocols is undertaken for key
outages of systems.
stakeholders and is tailored to their unique roles andresponsibilities.

Communication is distributed across emergency
response functions, geographic areas of
responsibility, public and private responders, andcommand authorities.

Emergency response assets practice interoperability
and function effectively under compromised
communications scenarios.

Appropriate resources are allocated to hardware
integration, technology stress testing, personnel
training and crisis simulations drills.

The results of these scenarios then inform strategic
investment in future emergency response assets.

Most government officials at all levels are aware ofcybersecurity good practices.

Most private sector actors at all levels are aware ofcybersecurity good practices.

National-level assets can act to assist neighbours in
the event of an internationallevel crisis or incident.

Stakeholders contribute to international efforts on
redundancy communication planning.
Agencies across all levels of government haveroutinized a cybersecurity mind-set, employing good(proactive) practices as a matter of habit.
Cybersecurity mind-set informs strategic planning.

The cybersecurity mind-set serves as a foundation
for government official’s operational practices and isevidenced as global good practice.
Cybersecurity mind-set of government officials is
related to a reduction of the overall threat landscapeof the government.
Most private sector actors, including SMEs, have
The cybersecurity mind-set serves as a foundation
routinized a cybersecurity mind-set, employing good for private sector operational practices, informs all(proactive) practices as a matter of habit.
IT related initiatives and is evidenced as global goodpractice.
Cybersecurity mind-set, informs strategic planning.

A growing number of users feel it is a priority forthem to employ good cybersecurity practices andmake conscious efforts to securely use online
systems.
A growing proportion of Internet users criticallyassess what they see or receive online, based on
identifying possible risks.

Cybersecurity mind-set of the private sector isrelated to a reduction of the overall threat landscapeof the sector.
Most users have routinized a cybersecurity mind-set, Cybersecurity mind-set of users is related to aemploying secure practices as a matter of habit.
reduction of the overall threat landscape of thecountry.
Most Internet users critically assess what they see or Individuals assess the risk in using online services,
receive online, based on identifying possible risks.
including changes in the technical and cybersecurity
environment and continuously adjust their behaviour
based on this assessment.

A growing proportion of users trust in the secure use Most Internet users feel confident while using theInternet infrastructure operators assess trustof the Internet based on indicators of website
Internet, have the ability to recognise non-legitimate promotion services and integrate findings into
legitimacy.
websites (including mimicry attempts), and have aprogramme and policy revision.
sense of control over providing personal data online.
Internet infrastructure operators have establishedprogrammes to promote trust in online services.

Programmes to promote trust in the use of online
services are assessed based on measures ofeffectiveness which informs resource allocation.

User-consent policies are in place designed to notify
practices on the collection, use or disclosure ofsensitive personal information.

111

Appendix A#
Dimension
222 Cyber Culture andSociety

FactorAspectStart-Up
Formative
Trust and Confidence User Trust in EGovernment offers no or limited eGovernment continues to increase eon the Internet
government Services services, but has not publicly promoted the service provision, but also recognises thenecessary secure environment.
need for the application of security
measures to establish trust in these
services.
If e-government services are provided,
users are unfamiliar with or lack trust inthem.

The need for security in e-government
services is recognised by stakeholders andusers.
A limited proportion of users trust in the
secure use of e-government services.

Some e-government services are informing
users of the utility of deployed security
solutions.

223 Cyber Culture andSociety

Trust and Confidence User Trust in Eon the Internet
commerce Services

E-commerce services are not offered or are E-commerce services are being provided tooffered in an unsecure environment.
a limited extent.
If e-commerce services are provided, users The private sector recognises the need forare unfamiliar with or lack trust in them.
the application of security measures toestablish trust in e-commerce services.
A limited proportion of users trust in the
secure use of e-commerce services.

Some e-commerce services are informing
users of the utility of deployed security
solutions.

231 Cyber Culture andSocietyUser Understandingof Personal
Information
Protection Online

User Understandingof Personal
Information
Protection Online

Users and stakeholders within the public Users and stakeholders within the public
and private sectors have no or minimaland private sectors may have generalknowledge about how personal information knowledge about how personal informationis handled online, nor do they believe that is handled online; and may employ goodadequate measures are in place to protect (proactive) cybersecurity practices totheir personal information online.
protect their personal information online.
There is no or limited discussion regarding Discussions have begun regarding thethe protection of personal information
protection of personal information andonline.
about the balance between security andprivacy, but this has not resulted inconcrete actions or policies.
Discussions may have begun and involve
multiple stakeholders, but no privacy
standards are in place.

241 Cyber Culture andSociety

Reporting
Mechanisms

Reporting
Mechanisms

There are no reporting mechanisms
available, but discussions might havebegun.

The public and/or private sectors areproviding some channels for reporting
online fraud, cyber-bullying, child abuse
online, identity theft, privacy and security
breaches, and other incidents, but thesechannels are not coordinated and are usedin an ad-hoc manner.
Promotion of the existing reporting
channels has not yet begun or is ad-hoc.

112

Appendix A
EstablishedE-government services have been fully developed.

Strategic
Public authorities are routinely publishing certain
information about their activities.

Dynamic
E-government services and promotion thereof arecontinuously improved and expanded to enhancetransparent/open and secure systems and user trust.

High-level risks affecting egovernment services areprioritised in order to reduce occurrences.

Privacy-by-default is promoted as a tool fortransparency in e-government services.

Impact assessments on data protection in egovernment services are consistently taking placeand feed back into strategic planning.

The public sector promotes use of e-government
The majority of users trust in the secure use of eservices and trust in these services through agovernment services and make use of them.
coordinated programme, including the compliance toweb standards that protect the anonymity of users.
A growing proportion of users trust in the secure use Processes are employed for gathering user feedbackof e-government services.
in order to ensure efficient management of online
content.
Possible breaches in egovernment services are being
identified, acknowledged, and disclosed in an ad-hoc
manner.
E-commerce services are fully established by
E-commerce service providers recognise the need for E-commerce services are continuously improved in
multiple stakeholders in a secure environment.
building trust in order to ensure business continuity, order to promote transparent, trustworthy and secureand resources are allocated accordingly.
systems.
Security solutions are updated and reliable payment The majority of users trust in the secure use of eTerms and conditions provided by e-commerce
systems have been made available.
commerce services and make use of them.
services are clear and easily comprehensible to allusers.
A growing proportion of users trust in the secure use Stakeholders invest in establishing enhanced service User feedback mechanisms are integrated into eof e-commerce services.
functionality of e-commerce services, protection of commerce services in order to enhance trust between
personal information and the provision of feedback users and providers.
mechanisms for users.
The private sector promotes use of e-commerce
services and trust in these services.
Terms and conditions of use of e-commerce services
are easily accessible.
A growing proportion of users have the skills tomanage their privacy online, and protect themselvesfrom intrusion, interference, or unwanted access of
information by others.

All stakeholders have the information, confidence
and the ability to take measures to protect theirpersonal information online and to maintain controlof the distribution of this information.

Users have the knowledge and skills necessary toprotect their personal information online, adapting
their abilities to the changing risk environment.

There is constant public debate regarding theUsers and stakeholders within the public and private There is a wide recognition of the need to ensure
protection of personal information and about thesectors widely recognise the importance of
security and protection of personal information.
balance between security and privacy, which informs protection of personal information online, and are
privacy policies within public and private sectors.
sensitised to their privacy rights.
Mechanisms are in place in private and public
sectors to ensure that privacy and security are notcompeting.

Policies are in place in private and public sectors toensure that privacy and security are not competing ina changing environment and are informed by user
feedback and public debate.

Privacy by default as a tool for transparency is
promoted.

Assessments of personal information protection in
eservices are regularly conducted and feed back into
policy revision.
Reporting mechanisms have been established and are Coordinated reporting mechanisms are widely used. All relevant stakeholders actively collaborate andregularly used.
share good practice to enhance existing reporting
mechanisms and there is a clear distribution of roles
and responsibilities, including regarding the responseto reported incidents.

Programmes to promote the use of these mechanisms Programmes to promote the use of these mechanisms Mechanisms have been developed to coordinate
have been established by public and private sectors. are prioritised by public and private sectors and are response to reported incidents between law
considered as an investment in loss prevention and enforcement and the national incident responserisk control.
capability.
Effectiveness metrics of reporting mechanisms areapplied and findings inform the revision andpromotion of the mechanisms.

113

Appendix A#
Dimension
251 Cyber Culture andSociety

FactorMedia and Social
Media

AspectMedia and Social
Media

Start-UpMedia and social media rarely, if ever,
cover information about cybersecurity orreport on issues such as security breaches
or cybercrime.

Formative
There is ad-hoc media coverage ofcybersecurity, with limited information
provided and reporting on specific issues
that individuals face online, such as online
child protection or cyber-bullying.
There is limited discussion on social media
about cybersecurity.

311 Cybersecurity
Education, Training
and Skills

Awareness Raising

Awareness Raising
Programmes

The need for awareness of cybersecurity
Awareness raising programmes, courses,
threats and vulnerabilities across all sectors seminars and online resources are available
is not recognised, or is only at initial stages for target demographics from public,of discussion.
private, academic, and/or civil society
sources, but no coordination or scaling
efforts have been conducted.
Awareness raising programmes may be
informed by international initiatives but are
not linked to national strategy.

312 Cybersecurity
Education, Training
and Skills

321 Cybersecurity
Education, Training
and Skills

Awareness Raising

Framework for
Education

Executive Awareness Awareness raising on cybersecurity issues Executives are made aware of general
Raising
for executives is limited or nonexistent.
cybersecurity issues, but not how theseissues and threats might affect theirorganisation.

Provision

Executives are not yet aware of their
responsibilities to shareholders, clients,
customers, and employees in relation to
cybersecurity.

Executives of particular sectors, such as
finance and telecommunications, have been
made aware of cybersecurity risk ingeneral and how the organisation deals
with cybersecurity issues, but not ofstrategic implications.

Few or no cybersecurity educators areavailable, and there are no qualification
programmes for educators.

Qualification programmes forcybersecurity educators are being
explored, with a small cadre of existing
professional educators.

Computer science courses are offered that Some educational courses exist in
may have a security component, but nocybersecurityrelated fields, such as
cybersecurity-related courses are offered. information security, network security andcryptography, but cybersecurity-specificcourses are not yet offered.
No accreditation in cybersecurity
education exists.

114

A demand for cybersecurity education isevidenced through course enrolment andfeedback.

Appendix A
Established
Strategic
Dynamic
Cybersecurity is a common subject acrossMedia coverage extends beyond threat reporting and The broad discussion of personal experiences andmainstream media, and information and reports on a can inform the public of proactive and actionable
personal attitudes of individuals across mainstream
wide range of issues, including security breaches and cybersecurity measures, as well economic and social and social media inform policy making and facilitatecybercrime are widely disseminated.
impacts.
societal change.
There is broad discussion on social media aboutcybersecurity.

There is frequent discussion on social media aboutcybersecurity and individuals regularly exchange
experiences online using social media.
A national programme for cybersecurity awareness The national awareness raising programme israising, led by a designated organisation (from any
coordinated and integrated with sector-specific,
sector) is established, which addresses a wide range tailored awareness raising programmes, such asof demographics and issues, but no metrics for
those focusing on government, industry, academia,
effectiveness have been applied.
civil society, and/or children.
Consultation with stakeholders from various sectors
informs the creation and utilisation of programmes
and materials.
A single online portal linking to appropriate
cybersecurity information exists and is disseminated
via that programme.

Awareness raising of executives in the public,
private, academic and civil society sectors address
cybersecurity risks in general, some of the primarymethods of attack, and how the organisation deals
with cyber issues (usually abdicated to the CIO).
Select executive members are made aware of how
cybersecurity risks affect the strategic decision
making of the organisation, particularly those in thefinancial and telecommunications sectors.

Awareness raising programmes are adapted in
response to performance evidenced by monitoring
which results in the redistribution of resources andfuture investments.

Metrics for effectiveness are established andevidence of application and lessons learnt are fed
into future programmes.
The evolution of the programme is supported by theadaptation of existing materials and resources,
involving clear methods for obtaining a measure ofsuitability and quality.

Metrics contribute toward national cybersecurity
strategy revision processes.

Programmes contribute toward expanding andenhancing international awareness raising goodpractice and capacitybuilding efforts.
Executive awareness raising efforts in nearly all
sectors include the identification of strategic assets,
specific measures in place to protect them, and themechanism by which they are protected.

The national awareness raising programme has ameasurable impact on reduction of the overall threat
landscape.
Cybersecurity risks are considered as an agenda item
at every executive meeting, and funding and attention
is reallocated to address those risks.

Executives are able to alter strategic decision
making, and allocate specific funding and people tothe various elements of cyber risk, contingent on
their company’s prevailing situation.

Executives are regarded regionally andinternationally as a source of good practice in
responsible and accountable corporate cybersecurity
governance.

Awareness programme planning gives explicit
consideration to national demand from thestakeholder communication (in the widest sense), sothat campaigns continue to impact the entire society.

Awareness raising efforts of cybersecurity crisis
Executives are made aware of what contingency
management at the executive level is still reactive in plans are in place to address various cyber-based
focus.
attacks and their aftermath.
Executive awareness courses in cybersecurity aremandatory for nearly all sectors.
Qualifications for and supply of educators are readily Cybersecurity educators are not only drawn from the National courses, degrees, and research are at theavailable in cybersecurity.
academic environment, but incentives are in place so forefront of cybersecurity education internationally.
that industry and/or government experts take these
positions as well.
Specialised courses in cybersecurity are offered and Accredited cybersecurity courses are embedded inaccredited at the university level.
all computer science degrees.

Cybersecurity education programmes maintain abalance between preserving core components of thecurriculum and promoting adaptive processes that
respond to rapid changes in the cybersecurity
environment.

Degrees in cybersecurityrelated fields are offered by Degrees are offered in cybersecurity specifically,
Prevailing cybersecurity requirements are considered
universities.
which encompasses courses and models in various
in the redevelopment of all general curricula.
other cybersecurity-related fields, including technicaland nontechnical elements such as policy
implications, and multi-disciplinary education.
Universities and other bodies hold seminars/lectures Cybersecurity educational offerings are weighted andon cybersecurity issues aimed at non-specialists.
focused based on an understanding of current risks
and skills requirements.
Research and development is a leading consideration Cybersecurity education is not limited to universities,
in cybersecurity education.
but ranges from primary to post-graduate levels,
including vocational education.

115

Appendix A#
Dimension
322 Cybersecurity
Education, Training
and Skills

FactorFramework for
Education

AspectAdministration

Start-Up
The need for enhancing national
cybersecurity education is not yet
considered.

Formative
The need for enhancing cybersecurity
education in schools and universities has
been identified by leading government,
industry, and academic stakeholders.

A network of national contact points forgovernmental, regulatory bodies, criticalindustries and education institutions is not
yet established.

Schools, government, and industry
collaborate in an ad-hoc manner to supply
the resources necessary for providing
cybersecurity education.

Discussion of how coordinated
A national budget focused on cybersecurity
management of cybersecurity education
education is not yet established.
and research enhances national knowledge
development has not, or only just begun.

331 Cybersecurity
Education, Training
and Skills

Framework for
Provision
Professional Training

Few or no training programmes incybersecurity exist.

The need for training professionals incybersecurity has been documented at thenational level.
Training for general IT staff is provided on
cybersecurity issues so that they can react
to incidents as they occur, but no training
for dedicated security professionals exists.
ICT professional certification is offered,with some security modules orcomponents.

Ad-hoc training courses, seminars andonline resources are available forcybersecurity professionals through public
or private sources, with limited evidence of
take-up.
332 Cybersecurity
Education, Training
and Skills

Framework for
UptakeProfessional Training

Training uptake by IT personnel
designated to respond to cybersecurity
incidents is limited or nonexistent.

Metrics evaluating take-up of ad-hoc
training courses, seminars, online
resources, and certification offerings exist,
but are limited in scope.
There is no knowledge transfer from
employees trained in cybersecurity tountrained employees.

411 Legal and Regulatory Legal Framework
Frameworks

Legislative
Framework for ICT
Security

Legislation relating to ICT security does
not yet exist.

Experienced stakeholders from all sectors
may have been consulted to support theestablishment of a legal and regulatory
framework.

Efforts to draw attention to the need to
Key priorities for creating cybersecurity
create a legal framework on cybersecurity legal frameworks have been identified
have been made and may have resulted in a through multistakeholder consultation,
gap analysis.
potentially resulting in draft legislation, butlegislation has not yet been adopted.

412 Legal and Regulatory Legal Framework
Frameworks

Privacy, Freedom of Domestic law does not recognise
Speech & Other
fundamental human rights in relation to
Human Rights Online cybercrime.

Domestic legislation partially recognises
privacy, freedom of information, freedomof assembly and association, and freedomof expression online.

Discussions of privacy issues online may Stakeholders from all key sectors have
have begun and include multiple
been consulted for the development of
stakeholders, but no privacy legislation or legislation addressing human rights online.
standards are in place.

116Appendix A
Established
Broad consultation across government, private
sector, academia and civil society stakeholders
informs cybersecurity education priorities and isreflected in national cybersecurity strategy.

Strategic
Metrics are developed to ensure that educational
investments meet the needs of the cybersecurity
environment across all sectors.

Dynamic
International cybersecurity centres of excellence areestablished through twinning programmes led byworld class institutions.

National budget is dedicated to national
cybersecurity research and laboratories atuniversities.

Government budget and spending on cybersecurity Routinized cooperation between all stakeholders ineducation is managed based on the national demand. cybersecurity education can be evidenced.

Competitions and initiatives for students are
Leading national cybersecurity academic institutions Content in cybersecurity education programmes is
promoted by government and/or industry in order to share their lessons learnt with other national andaligned with practical cybersecurity problems andincrease the attractiveness of cybersecurity careers. international counterparts.
business challenges, and provides a mechanism forenhancing curriculum based on the evolving
landscape.

Structured cybersecurity training programmes exist
to develop skills towards building a cadre ofcybersecurity-specific professionals.
Security professional certification is offered acrosssectors within the country.

Government has established academic centres of
excellence in cybersecurity.
A range of cybersecurity training courses is tailored
toward meeting national strategic demand and aligns
with international good practice.
The training programme outlines the priorities in thenational cybersecurity strategy.

The needs of society are well understood and a list of Training programmes are offered to cybersecurity
training requirements is documented.
professionals that focus on the skills necessary tocommunicate technically complex challenges tonontechnical audiences, such as management andgeneral employees.
Training programmes for non-cybersecurity
professionals are recognised and initially offered.

Metrics of effectiveness assess the modes andprocedures of training.

There is an established cadre of certified employees
trained in cybersecurity issues, processes, planningand analytics.

The uptake of cybersecurity training is used to
inform future training programmes.

Knowledge transfer from employees trained incybersecurity to untrained employees is ad hoc.

Coordination of training across all sectors ensures
the national demand for professionals is met.

The public and private sector collaborate to offer
training, constantly adapting and seeking to build
skillsets drawn from both sectors.
Training offerings coordinate with education
programmes so that the foundation established inschools can enable training programmes to build ahighly skilled workforce.
Programmes and incentive structures are in place toensure the retention of trained workforce within the
country.

Cybersecurity professionals not only fulfil national
requirements, but domestic professionals are
consulted internationally to share lessons learnt andgood practice.

Job creation initiatives for cybersecurity withinorganisations are established and encourage
employers to train staff to become cybersecurity
professionals.
Comprehensive ICT legislative and regulatory
frameworks addressing cybersecurity have been
adopted.

The country reviews existing legal and regulatory
mechanisms for ICT security, identifies where gaps
and overlaps exist, and amends laws accordingly orenacts new laws.

Mechanisms are in place for continuously
harmonising ICT legal frameworks with national
cybersecurityrelated ICT policies, international law,standards and good practices.

Laws address the protection of critical information
infrastructure, etransactions, liability of Internet
Service Providers and, potentially, cyber incident
reporting obligations.

Monitoring of enforcement of legislative frameworks Participation in the development of regional orinforms resource allocation and legal reform.
international cybersecurity cooperation agreements
and treaties is a priority.

Efforts are in place to exceed minimal baselines
specified in these treaties where appropriate.
Domestic law recognises fundamental human rights International and regional trends and good practices In order to meet dynamic changes in the applicationon the Internet, including privacy online, freedom of inform the assessment and amendment of domestic of technology to human rights, procedures are inspeech, freedom of information, and freedom of
legal frameworks protecting human rights online and place to amend and update legal frameworks asassembly and association.
associated resource planning.
needed.
Domestic law specifies safeguards to protect the
Research is conducted and measures are in place toindividual’s right to privacy during the collection, use exceed minimal baselines specified in internationaland disclosure of personal information inagreements.
investigations involving electronic evidence.

Access to the Internet is recognised and enshrined asa human right.

All relevant actors from private sector and civilsociety are involved in shaping laws and regulations
on privacy, freedom of speech, and other humanrights online.

The state is an active contributor in the global
discourse on human rights on the Internet.

The country has ratified or acceded to international
agreements.

Domestic actors, policies and practices actively
shape positive international discussions of privacy
online.

117

Appendix A#
Dimension
Factor
413 Legal and Regulatory Legal Framework
Frameworks

414 Legal and Regulatory Legal Framework
Frameworks

415 Legal and Regulatory Legal Framework
Frameworks

416 Legal and Regulatory Legal Framework
Frameworks

417 Legal and Regulatory Legal Framework
Frameworks

AspectData Protection
Legislation

Start-Up
Formative
Data protection legislation is not yet under Data protection legislation is underdevelopment.
development.

Child Protection
OnlinePublic discourse on data protection issues Stakeholders from all key sectors have
may have begun and includes multiple
been consulted to support the development
stakeholders.
of legislation.
Legislation protecting children online is not Legislative provisions protecting children
yet under development.
online are under development.

Public discourse on child protection online Stakeholders from all key sectors have
may have begun and includes multiple
been consulted to support the development
stakeholders.
of legislation.
Consumer Protection Legislation protecting consumers against Legislation protecting consumers online isLegislation
online fraud and other forms of cybercrime under development.
is not yet under development.
Stakeholders from all key sectors havebeen consulted to support the developmentof legislation.
Intellectual Property Intellectual property of online products and Legislation on intellectual property online
Legislation
services might be discussed amongis under development, through consultation
multiple stakeholders, but no specific legal with key stakeholders.
provisions are in place.

Substantive
Cybercrime
Legislation

If general law on intellectual property
exists, it is not applicable to online
products and services yet.
Specific substantive criminal law on
cybercrime does not exist or generalcriminal law exists, but its application to
cybercrime is unclear.

Partial legislation exists that addresses
some aspects of cybercrime or cybercrime
legal provisions are under development.

Specific substantive criminal provisions on
cybercrime might be discussed amonglawmakers, but the development of theprovisions has not yet commenced.
418 Legal and Regulatory Legal Framework
Frameworks

Procedural
Cybercrime
Legislation

Specific procedural criminal law for
Development of specific proceduralcybercrime does not exist and generalcybercrime legislation or amendment ofcriminal procedural law is not applicable to general procedural criminal law to adapt tocybercrime investigations, prosecutions,cybercrime cases has begun.
and electronic evidence.
Procedural criminal legislation forcybercrime might be discussed amonglawmakers, but development of thelegislation has not yet begun.

421 Legal and Regulatory Criminal Justice
Frameworks
SystemLaw Enforcement

Law enforcement does not have sufficient Traditional investigative measures arecapacity to prevent and combat cybercrime applied to cybercrime investigations, withand does not receive specialised training
limited digital forensics capacity.
on cybercrime investigations.
If law enforcement officers receive training
on cybercrime and digital evidence, it isad-hoc and not specialised.

422 Legal and Regulatory Criminal Justice
Frameworks
System

Prosecution

Prosecutors do not receive adequate
A limited number of specialised
training and resources to review electronic cybercrime prosecutors have the capacity
evidence or prosecute cybercrime.
to build a case based on electronic
evidence, but this capacity is largely adhoc and uninstitutionalised.
There are no specialised cybercrime
prosecutors, but consultation may havebegun to consider this capacity within thecriminal justice community.

118

If prosecutors receive training on
cybercrime and digital evidence, it is adhoc and not specialised.

Appendix A
EstablishedComprehensive data protection legislation has been
adopted and enforced, which includes conditions forthe collection of personal data and protection frommisuse.

Comprehensive legislation on the protection ofchildren online has been adopted and enforced, andensures that data protection and privacy rules forlegal minors apply to the online environment.

Comprehensive legislation protecting consumers
from business malpractice online has been adopted
and is enforced.

Strategic
Legal mechanisms are in place that enable strategic
decision making that determines the timeframe inwhich personal data is no longer required as
evidence for investigation and must be deleted.

Dynamic
In order to meet dynamic changes in thetechnological environment, procedures are in place
to amend and update legal frameworks as needed.

International and regional trends and good practices
inform the assessment and amendment of dataprotection laws and associated resource planning.
The country continuously seeks to improve nationalchild protection online legislation to comply with
regional and international law and standards.

In order to meet dynamic changes in thetechnological environment, procedures are in place
to amend and update legal frameworks as needed.

The country continuously seeks to improve national
consumer protection legislation to address national
needs and comply with regional and international
consumer protection standards.

In order to meet dynamic changes in the applicationof technology to consumer protection, procedures arein place to amend and update legal frameworks asneeded.

A lead agency responsible for the protection of
consumers online has been designated.
Comprehensive legislation addressing intellectual
property of online products and services has been
adopted and is enforced.

Legislation on intellectual property online is regularly Decisions to update legislation are based on thereviewed and amended accordingly to reflectbalance between intellectual property and openchanges in national priorities and the international
access policies, through multi-stakeholder
ICT landscape.
discussion.
Legislative amendments are informed bymultistakeholder consultations and public discourse.

Substantive cybercrime legal provisions are
Measures are in place to exceed minimal baselines
The country is an active contributor in the global
contained in specific legislation or a general criminal specified in international treaties where appropriate, discourse on developing and improving internationallaw.
which includes procedures to amend substantive
cybercrime treaties.
legal frameworks as needed.
The country has ratified regional or international
instruments on cybercrime and consistently seeks to
implement these measures into domestic law.

Laws, where needed, are amended to reflect changes
in the international ICT environment.

Comprehensive criminal procedural law containing
provisions on the investigation of cybercrime andevidentiary requirements has been adopted and isenforced.

In the case of cross-border investigation, procedural The country is an active contributor in the global
law stipulates what actions need to be conducteddiscourse on developing and improving international
under particular case characteristics, in order tocybercrime treaties.
successfully investigate cybercrime.

The state has ratified regional or international
Measures are in place to exceed minimal baselines
Procedural law, where needed, is amended to adapt
instruments on cybercrime and consistently seeks to specified in international treaties where appropriate, to the changing cybercrime landscape and emerging
implement these measures into domestic law.
which includes procedures to amend procedural legal investigative challenges.
frameworks as needed.
A comprehensive institutional capacity with
sufficient human, procedural and technologicalresources to investigate cybercrime cases has been
established.

Resources dedicated to fully operational cybercrime All law enforcement officers receive specialised andunits have been allocated based on strategic decision continuous training based on relative responsibilities
making.
and new, evolving threat landscapes.

Digital chain of custody and evidence integrity isestablished including formal processes, roles andresponsibilities.

Advanced investigative capabilities allow theinvestigation of complex cybercrime cases,
supported by regular testing and training ofinvestigators.

Standards for the training of law enforcement
officers on cybercrime exist and are implemented.

Law enforcement agencies have the resources to
The institutional capacity of law enforcement ismaintain the integrity of data to meet internationalfrequently reviewed and revised based on anevidential standards in cross-border investigation.
assessment of effectiveness.
Statistics and trends on cybercrime investigations arecollected and analysed.
Institutional structures are in place, with a clear
There is national capacity to prosecute complex
distribution of tasks and obligations within thedomestic and cross-border cybercrime cases.
prosecution services at all levels of the state.

A comprehensive institutional capacity, including
sufficient human, training and technologicalresources, to prosecute cybercrime cases and cases
involving electronic evidence is established.

Law enforcement can utilise sophisticated digitalforensic tools, and these technologies are
consistently updated.

Statistics and trends on cybercrime prosecutions are A dedicated cybercrime prosecution unit might haveconstantly collected and analysed.
been established.

A mechanism exists that enables the exchange ofAll prosecutors receive specialised and continuous
information and good practices between prosecutors training based on relative responsibilities and new,and judges to ensure efficient and effective
evolving threat landscapes.
prosecution of cybercrime cases.

119Appendix A#
Dimension
Factor423 Legal and Regulatory Criminal Justice
Frameworks
SystemAspectCourtsStart-Up
Formative
A separate court structure or specialized
A limited number of judges have thejudges for cybercrime cases and cases
capacity to preside over a cybercrime case,involving electronic evidence do not exist. but this capacity is largely adhoc and not
systematic.
Consultation may have begun to consider
this capacity in the judicial community.

431 Legal and Regulatory Formal and Informal Formal Cooperation No or minimal forms of international
Frameworks
Cooperationcooperation exist to prevent and combat
Frameworks tocybercrime.
Combat Cybercrime

If judges receive training on cybercrimeand digital evidence, it is ad-hoc and not
specialised.
Formal mechanisms of international
cooperation have been established, but theapplication to cybercrime is ad-hoc or only
possible in some cases.

There is no formal mechanism that
promotes the exchange of information
between domestic public and private
sectors on cybercrime and cooperation islimited.

Exchange of information on cybercrime
between domestic public and private
sectors is ad-hoc and unregulated.

432 Legal and Regulatory Formal and Informal Informal Cooperation There is minimal interaction between
Frameworks
Cooperation
government and criminal justice actors.
Frameworks to
Combat Cybercrime

Exchange of information between
government and criminal justice actors islimited and ad-hoc.

Cooperation between Internet Service
Providers and law enforcement has notbeen established.

Ad-hoc cooperation between Internet
Service Providers and law enforcement
exists, but is not always effective.

Law enforcement cooperation with foreign Law enforcement cooperates with foreigncounterparts is not effective.
counterparts on an ad-hoc basis, but is not
integrated in regional and international
networks.
511 Standards,
Organisations, andTechnologies

Adherence toStandards

ICT Security
Standards

No standards or good practices have been
identified for use in securing data,technology or infrastructure, by the public
and private sectors.

Information risk management standards
have been identified for use and there havebeen some initial signs of promotion andtake-up within public and private sectors.

Or, initial identification of some
There is some evidence of measurable
appropriate standards and good practices implementation and adoption ofhas been made by the public and privateinternational standards and good practices.
sectors, possibly some ad hoc
implementation, but no concerted
endeavour to implement or change existing
practice in a measurable way.

512 Standards,
Organisations, andTechnologies

Adherence toStandards

Standards in
Procurement

No standards or good practices have been Cybersecurity standards and good
identified for use in guiding procurement practices guiding procurement processes
processes by the public and private sector. have been identified for use.

If they are recognised, implementation is
ad hoc and uncoordinated.

120

Evidence of promotion and adoption of
cybersecurity standards and good practices
in defining procurement practices exists
within public sectors and private sectors.

Appendix A
EstablishedSufficient human and technological resources areavailable to ensure effective and efficient legal
proceedings regarding cybercrime cases, and cases
involving electronic evidence.

Strategic
Dynamic
The court system has organised itself to ensure a
Judges receive specialised and continuous training
central management of cybercrime cases, with clear based on relative responsibilities and new, evolving
distribution of tasks and obligations within the court threat landscapes.
system at all levels of the state.

Judges receive specialised training on cybercrimeand electronic evidence.

Statistics and trends on cybercrime convictions arecollected and analysed.

Formal mechanisms of international cooperation
Formal international cooperation mechanisms arehave been established in order to prevent and combat fully functional, with established communication
cybercrime by facilitating their detection,
channels.
investigation, and prosecution.

The institutional capacity of the court system isfrequently reviewed and revised based on anassessment of effectiveness.
Formal international cooperation mechanisms are
regularly reviewed to determine effectiveness, andare revised accordingly to reflect the changing
cybercrime landscape.

Mutual legal assistance and extradition agreements
and mechanisms have been established and areapplied to cybercrime cases.

Strategic decisions are made to expand and enhance Formal and informal international cooperation
formal cooperation mechanisms on cybercrime asmechanisms complement each other and areneeded.
interoperable.

Legislative requirements for the exchange of
information between domestic public and private
sectors have been determined.

Resources are allocated to support the exchange of
information between public and private sectors
domestically and enhance legislative requirements
and communication mechanisms.

Informal relationships between government andcriminal justice actors have been established,resulting in the regular exchange of information on
cybercrime issues.

A strategic relationship between government actors, Government and criminal justice actors exchange
prosecutors, judges and law enforcement agencies
information timely and efficiently, and cooperation ishas been established relating to cybercrime.
adapted to the changing cybercrime environment andassociated requirements.

Effective informal cooperation mechanisms between Law enforcement cooperates with domestic andInternet Service Providers and law enforcement have foreign ISPs in combatting cybercrime.
been established, with clear communication
channels.
Domestic law enforcement agencies are informally
integrated with regional and internationalcounterparts and networks, such as Interpol or 24/7
networks.

Formal mechanisms that enable the exchange of
information between domestic public and private
sectors are adapted in accordance with identified
needs and changing threat environment.

A routinized relationship between law enforcement
and ISPs, domestically and across borders, has been
established and is adaptable to emerging forms ofcybercrime.

Law enforcement agencies work jointly with foreign Formal and informal international cooperation
counterparts, potentially through joint task forces,
mechanisms complement each other and are
resulting in successful crossborder cybercrimeinteroperable.
investigations and prosecutions.

Nationally agreed baseline of cybersecurity related Government and organisations promote adoption ofstandards and good practices has been identified, and standards and good practises according to
adopted widely across public and private sectors.
assessment of national risks and budgetary choices.

The choice of adopted standards and good practices
and their implementation is continuously improved.

Some body within government exists to assess level There is evidence of debate between government and Adoption of standards and non-compliance decisionsof adoption across public and private sectors.
other stakeholders as to how national andare made in response to changing threatorganisational resource decisions should align andenvironments and resource drivers across sectors anddrive standard adoption.
CI through collaborative risk management.

Government schemes exist to promote continued
Evidence of contribution to international standards’
enhancements, and metrics are being applied tobodies exists and contributes to thought leadershipmonitor compliance.
and sharing of experience by organisations.
Consideration is being given to how standards andgood practices can be used to address risk within
supply chains within the CI, by both government andCI.

Evidence exists of debate within all sectors oncompliance to standards and good practices, basedon continuous needs assessments.

Procurement practices meet international IT
guidelines, standards and good practices.

Cybersecurity standards and good practices in
Organisations have the ability to monitor use of
guiding procurement processes are being adhered to standards and good practices in procurement
widely within public and private sectors.
processes and support deviations and noncompliancedecisions in real-time through risk-based decision
making and quality assurance.

Adoption and compliance of standards inprocurement practices within the public and private
sectors, is evidenced through measurement andassessments of process effectiveness.

Critical aspects of procurement and supply, such as
prices and costs, quality, timescales and other value
adding activities are continuously improved, andprocurement process improvements are made in thecontext of wider resource planning.
Organisations are able to benchmark the skills of
their procurement professionals against thecompetencies outlined in procurement standards andidentify any skills and capability gaps.
Internal stakeholders have been trained in the secureuse of E-sourcing or E-tendering systems andpurchase-to-pay systems (P2P) in order to implement
these tools in performing key tasks in procurement
and supply.

121

Appendix A#
Dimension
513 Standards,
Organisations, andTechnologies

FactorAdherence toStandards

AspectStandards in
SoftwareDevelopment

Start-Up
Formative
No standards or good practices forCore activities and methodologies forsoftware development have been identified software development processes focusedfor use relating to integrity and resilience on integrity and resilience are beingin public and private sectors.
discussed within professional communities.
Or, there is some identification, but only
limited evidence of take-up.

Government promotes relevant standards
in software development, but there is nowidespread use of these standards yet.

Some organisations supply or seek toadopt standards in code development.
521 Standards,
Organisations, andTechnologies

Internet
Infrastructure
Resilience

Internet
Infrastructure
Resilience

Affordable and reliable Internet services
Limited Internet services and infrastructure
and infrastructure in the country may have are available, but may not be reliable.
not yet been established; if they have been,
adoption rates of those services are aconcern.
There is little or no national control of
network infrastructure; networks andsystems are outsourced, with potential
adoption from unreliable third-party
markets.

Resilience of Internet infrastructure in
public and private sectors has been
discussed by multiple stakeholders, but has
not been fully addressed.
There may be regional support to secureInternet infrastructure in the country.

531 Standards,
Organisations, andTechnologies

Software Quality

Software Quality

Quality and performance of software used Software quality and functionalin the country is a concern, but functional requirements in public and private sectors
requirements are not yet fully monitored. are recognised and identified, but notnecessarily in a strategic manner.
A catalogue of secure software platforms
and applications within the public andprivate sectors does not exist.
Policies and processes regarding updatesof software applications have not yet beenformulated.

541 Standards,
Organisations, andTechnologies

Technical Security
Controls

Technical Security
Controls

There is minimal or no understanding or
deployment of the technical security
controls offered in the market, by users,
public and private sectors.
Internet Service Providers (ISPs) may notoffer any upstream controls to theircustomers.

A catalogue for secure software platforms
and applications within the public andprivate sectors is under development.
Policies and processes on software updates
and maintenance are now underdevelopment.
Evidence of software quality deficiencies
is being gathered and assessed regarding
its impact on usability and performance.
Technical security controls are deployed
by users, public and private sectors, but
inconsistently.
The deployment of up-todate technicalsecurity controls is promoted in an ad-hoc
manner and all sectors are being
incentivised to their use.
ISPs may be offering antimalware software
as part of their services but possibly in an
ad-hoc manner.

ISPs recognise the need to establish
policies for technical security control
deployment as part of their services.
Network Introduction Detection Systems(NIDS) and Host Intrusion Detection
Systems (HIDS) are deployed but notnecessarily in a consistent manner.

122

Appendix A
Established
Government has an established programme forpromoting and monitoring standard adoption insoftware development – both for public andcommercial systems.

Strategic
Dynamic
Security considerations are incorporated in all stages Software development projects continuously assessof software development.
the value of standards and reduce or enhance levelsof compliance according to risk-based decisions.

Evidence of public and private sector organisations
adopting standards in their software development
processes.

Core development activities, including configurationand documentation management, security
development and lifecycle planning have been
adopted.

Procurement of software includes on-goingassessments of the value of standards in delivering
software quality – throughout the lifetime of thecontract (as opposed to simply initially at
procurement stage).

Evidence that high integrity systems and softwaredevelopment techniques are present within the
educational and training offerings in the country.
Reliable Internet services and infrastructure havebeen established.

Procurement of software developed according torequired standards is considered based on anassessment of risk in investment decisions.
Regular assessment of processes according tointernational standards and guidelines are conducted
together with assessment of national information
infrastructure security and critical services that drive
investment in new technologies.

Requirements are built into contracts with suppliers.

Acquisition of infrastructure technologies iseffectively controlled, with flexibility incorporated
according to changing market dynamics.

Internet is used for ecommerce and electronicbusiness transactions; authentication processes are
established.

Costs for infrastructure technologies are continuallyassessed and optimised.

Technology and processes deployed for Internet
infrastructure meet international IT guidelines,
standards, and good practices.
National infrastructure is formally managed, with
documented processes, roles and responsibilities,
and limited redundancy.

There is effectively controlled acquisition of criticaltechnologies with managed strategic planning andservice continuity processes in place.
Scientific, technical, industrial and humancapabilities are being systematically maintained,enhanced and perpetuated in order to maintain the
country’s independent resilience.

Software quality and functional requirements inpublic and private sectors are recognised andestablished.

Quality of software used in public and private sectors Software applications of high level performance,
is monitored and assessed.
reliability and usability are available, with service
continuity processes fully automated.

Reliable software applications that adhere tointernational standards and good practices are being
used widely in the public and private sectors.
Policies on and processes for software updates are
established.

Policies and processes on software updates andmaintenance are being improved based on risk
assessments and the criticality of services.
Benefits to businesses from additional investment inensuring software quality and maintenance aremeasured and assessed.
Software applications are characterised as to their
Software defects are manageable in a timely mannerreliability, usability and performance in adherence to and service continuity is ensured.
international standards and good practices.
Up-to-date technical security controls, including
Penetration of technical security controls leads topatching and backups, are deployed in all sectors.
effective upstream protection of users andpublic/private sectors.

Requirements of software quality are being
systematically reviewed, updated, and adapted to thechanging cybersecurity environment.

Users have an understanding of the importance ofanti-malware software and network firewalls acrossdevices.

Within the public and private sectors, technicalsecurity controls are being kept up-to-date,monitored for effectiveness and reviewed on aregular basis.

The understanding of the technical security controls
being deployed extends to its impact onorganisational operations and budget allocation.

Physical security controls are employed to prevent
unauthorized personnel from entering computing
facilities.

The public and private sector have the capacity tocritically assess and upgrade cybersecurity controls
according to their appropriateness and suitability foruse.

ISPs supplement technical security controls withmulti factor authentication, digital certificates andwhitelisting to ensure prevention of access of nontrusted sites or web addresses and maintain a safe
Internet environment.

All sectors have the capacity to continuously assess
the security controls deployed for their effectivenessand suitability according to their changing needs.

ISPs establish policies for technical security control
deployment as part of their services.
The technical cybersecurity control set is based on
established cybersecurity frameworks, such as the
SANS top 20 cybersecurity controls, the CESG 10
steps to cybersecurity, or PAS 55.

123

Appendix A#
Dimension
551 Standards,
Organisations, andTechnologies

FactorCryptographic
Controls

AspectCryptographic
Controls

Start-Up
Formative
Cryptographic techniques (e.g. encryption Cryptographic controls for protecting data
and digital signatures) for protection ofat rest and in transit are recognised anddata at rest and data in transit may be a
deployed ad-hoc by multiple stakeholders
concern but are not yet deployed within the and within various sectors.
government, private sector or the generalpublic.
State of the art tools, such as SSL or TLS,
are deployed ad-hoc by web service
providers to secure all communications
between servers and web browsers.

561 Standards,
Organisations, andTechnologies

Cybersecurity
Marketplace

Cybersecurity
Technologies

Few or no cybersecurity technologies areproduced domestically; but international
offerings may be available.

The domestic market may provide nonspecialised cybersecurity products, butthese are not marketdriven.
Cybersecurity is considered in softwareand infrastructure development.

562 Standards,
Organisations, andTechnologies

Cybersecurity
Marketplace

Cyber Insurance

The need for a cyber insurance market may The need for a market in cyber insurance
have been identified, but no products and has been identified through the assessment
services are available.
of financial risks for public and private
sectors, and development of products isnow being discussed.

571 Standards,
Organisations, andTechnologies

Responsible
Disclosure

Responsible
Disclosure

The need for a responsible disclosure
policy in public and private sector
organisations is not yet acknowledged.

Technical details of vulnerabilities areshared informally with other stakeholders
who can distribute the information more
broadly.
Software and service providers are able toaddress bug and vulnerability reports.

124

Appendix A
Established
Strategic
Cryptographic techniques are available for all sectors The public and private sectors critically assess theand users for protection of data at rest or in transit. deployment of cryptographic controls, according totheir objectives and priorities.

There is a broad understanding of securecommunication services, such as encrypted/signed
email.

Dynamic
The relevance of cryptographic controls deployed for
securing data at rest and data in transit iscontinuously assessed through risk assessments.

The public and private sectors have developed
The public and private sector adapt encryption andencryption and cryptographic control policies based cryptographic control policies based on the evolution
on the previous assessment, and regularly review the of technological advancement and changing threat
policies for effectiveness.
environment.

The cryptographic controls deployed meetinternational standards and guidelines accordingly foreach sector and are kept up-to-date.
State of the art tools, such as SSL or TLS, aredeployed routinely by web service providers tosecure all communications between servers and webbrowsers.
Cybersecurity products are now being produced by Cybersecurity technology development abides bydomestic providers in accordance with market needs. secure coding guidelines, good practices and adhere
to internationally accepted standards.
National dependence on foreign cybersecurity
Risk assessments and market incentives inform thetechnologies is increasingly mitigated throughprioritisation of product development to mitigate
enhanced domestic capacity.
identified risks.
A market for cyber insurance is established andCyber insurance specifies a variety of coverages toencourages information sharing among participants mitigate consequential losses.
of the market.

Security functions in software and computer system
configurations are automated in the development anddeployment of technologies.
Domestic cybersecurity products are exported toother nations and are considered superior products.

First-party insurance typically covers damage to
These coverages are selected based on strategic
digital assets, business interruptions and, potentially, planning needs and identified risk.
reputational harm.
Third-party insurance covers liability and the costs of Products suitable for SMEs are also on offer.
forensic investigations, customer notification, credit
monitoring, public relations, legal defence,compensation and regulatory fines.

Insurance premiums are offered for consistentcybersecure behaviour.

A vulnerability disclosure framework is in place,which includes a disclosure deadline, scheduled
resolution, and an acknowledgement report.

Responsible disclosure processes for all involved
stakeholders (product vendors, customers, security
vendors and public) are set.

Responsible disclosure policies are continuously
reviewed and updated based on the needs of all
affected stakeholders.

Organisations have established processes to receiveand disseminate vulnerability information.

An analysis of the technical details of vulnerabilities Responsible disclosure frameworks are sharedis published and advisory information isinternationally, so that best practice in this area candisseminated according to individual roles andbe created.
responsibilities.

Software and service providers commit to refrainfrom legal action against a party disclosing
information responsibly.

The large majority of products and services are
updated within predetermined deadlines.

The cyber insurance market is innovative and adapts
to emerging risks, standards and practices, while
addressing the full scope of cyber harm.

All affected products and services are routinely
updated within deadline.
Processes are in place to review and reduce
deadlines.

125Appendix B

Appendix B ANC3T#

Category

Subcategory

111 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

112 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

Capacity area
Strategy
Development

Organisation

Level 1
ID
Keywords
Details
111L1-1 Outline of strategy An outline/draft national
cybersecurity strategy has
been articulated.

Level
ID
Keywords
111L2-1 Strategy
established

111L1-2 Development
process ofstrategy

Processes for strategy
development have been
initiated.

111L2-2 Stakeholders'consultation in
strategy

111L1-3 Stakeholders
involved instrategydevelopment

Consultation processes
have been agreed for key
stakeholder groups,
including international
partners.

111L2-3 Implementation ofstrategy

112L1-1 Cybersecurity
A coordinated112L2-1 Cybersecurity
programme under cybersecurity programme isprogrammedevelopment
being developed through aagreedmultistakeholder
consultative process.
112L2-2 Coordinating
body ofcybersecurity
programme
112L2-3 Goals &measurement ofcybersecurity
programme

113 Cybersecurity Policy Nationaland Strategy
Cybersecurity
StrategyContent

112L2-4 Discrete budget
for cybersecurity
113L1-1 Risk priorities of Content includes links
113L2-1 National
cybersecurity
established between
objectives ofdefined in strategy cybersecurity, national risk
cybersecurity
priorities and business
defined in strategy
development,

113L2-2 Minimum
coverage ofstrategy contents

121 Cybersecurity Policy Incident Response
and Strategy

126

Identification of
Incidents

121L1-1 Recording
incidents

Certain cybersecurity
121L2-1 Central registry ofincidents have been
incidents
categorised and recorded asnational-level threats.

Appendix B

Level 3

2
Details
A national cybersecurity
strategy has been
published.

ID
Keywords
111L3-1 Reviewing
process ofstrategy

Multi-stakeholder
111L3-2 Cyber exercises
consultation processes haveconsidered inbeen followed andstrategyobservations fed back to
the identified strategy'owners'.
National cybersecurity
strategy is promoted andimplemented by multiple
stakeholders acrossgovernment and othersectors.

Details
Strategy review and renewal
processes are confirmed.

Level 4ID
Keywords
Details
111L4-1 Continual revision Continual revision and refinementof strategy
of cybersecurity strategy isconducted proactively to adapt tochanging socio-political, threat andtechnology environments.

Regular scenario and realtime cyber 111L4-2 Contributing to
The country is a leader within theexercises that provide a concurrent
international
international community and thepicture of national cyber resilience
debate of strategy debate shaping the development ofare considered a strategic priority.
global cybersecurity strategy.

111L3-3 Measurement of Relevant metrics, measurement, andcybersecurity
monitoring processes, data, anddefined in strategy historic trends are evaluated andinform decision-making.

111L3-4 Capacity building& investment
considered instrategy

Cybersecurity strategic plans,aligned with national strategic
priorities, drive capacity building
and investments in security.

The single agreed
cybersecurity programme

112L3-1 PDCA processes Evidence exists of iterative
112L4-1 Reassignment &of cybersecurity application of metrics and resulting
reallocation ofprogramme
refinements to operations andresources forstrategy across government,
cybersecurity
including resource allocation
programmeconsiderations.

A singular national cybersecurity
posture exists with the ability toreassign tasks and budgets
dynamically according to changing
risk assessments.

has a designatedcoordinating body with amandate to consult acrosspublic and private sectors,
and civil society.

112L3-2 Consolidated
budget forcybersecurity

A designated national body
disseminates and receives feedbackon the strategy from wider society
to continuously enhance the national
cybersecurity posture.

A consolidated cybersecurity
budget has been administered inorder to allocate resources.

112L4-2 Dissemination &feedbacks aboutcybersecurity
programme

The programme is definedaccording to goals andobjectives, using metrics tomeasure progress.
Discrete budget forcybersecurity exists,
The content of the national 113L3-1 Measurement of Metrics and measurements are
113L4-1 Continual revision New content is periodicallycybersecurity strategy iscybersecurity
utilised to update nationalof strategy
incorporated in the strategy inlinked explicitly anddefined in strategy cybersecurity strategy content to
response to evolving threat
directly to national risks,
help leaders evaluate the success oflandscapes.
priorities and objectives, as
the various cybersecurity objectives
well as businessand guide resource investment.
development.
Content at a minimum
113L3-2 Protection ofContent now also seeks to protect
should seek to raise public
criticalcritical infrastructure internal
awareness, mitigate
infrastructures
threats.
cybercrime, establish
defined in strategy
incident response capability
and protect criticalinfrastructure from external
and internal threats.

113L4-2 Contributing tointernational
cooperation

Content of the national
cybersecurity strategy leads,
promotes and encourages national
and international cooperation toensure a secure, resilient and trusted
cyberspace.

A central registry of
121L3-1 Regular revisionnational-level cybersecurityof incident
incidents is operational.
registry

Regular, systematic updates to thenational-level incident registry are
made.

121L4-1 Adapted analysis Focus on incident identification andof incidents
analysis is adapted in response toenvironmental changes.

121L3-2 Incident analysis

Resources are allocated foranalysing incidents in order toprioritise which incidents are mosturgent.

127

Appendix B#

Category

Subcategory

122 Cybersecurity Policy Incident Response
and Strategy

Capacity area
Organisation

Level 1
Level
ID
Keywords
Details
ID
Keywords
122L1-1 Key incident
Private sector organisations 122L2-1 National CSIRT
response
key to nationalorganisations in cybersecurity have been
private sector
identified,
identified
122L1-2 N/A

but no formal coordination 122L2-2 Roles &and information sharing
responsibilities ofmechanisms exist between
national CSIRT
public and private sectors.

122L1-3 Ad-hoc responses Dispersed public andprivate sector bodies detect
and respond to incidents asthey occur
123 Cybersecurity Policy Incident Response
and Strategy

Coordination

123L1-1 Leading incident
responseorganisation
designatedLeads for incident response 123L2-1 Coordination
have been designated at theestablishedoperational level,

123L2-2 Communicationlines for crisis

123L2-3 International
cooperation inincident response

124 Cybersecurity Policy Incident Response
and Strategy

Mode of Operation

124L1-1 Key incident
response
processes

Key incident response
processes have been
identified,

124L2-1 Incident response
processes & tools
established

124L1-2 CSIRT member
training

Members of CSIRTs
receive training in an adhoc manner.

124L2-2 Regular training
for CSIRT
members

124L2-3 Limited response
to national level
incidents

131 Cybersecurity Policy Critical Infrastructure Identificationand Strategy(CI) Protection

131L1-1 List of CI assets

A list of general CI assets
has been created.

131L2-1 Audit of CI assets

131L2-2 CI assets audit list

128

Appendix B
2

Level 3

Details
ID
Keywords
A funded national body for 122L3-1 Formal roles &incident response has been
responsibilities
established (such as
allocated
CSIRTs or CERTs),

Details
Distinct and formal security roles
and responsibilities are allocatedacross government, criticalinfrastructure, enterprise, andindividual systems.

with specified roles andresponsibilities.

Level 4ID
Keywords
Details
122L4-1 Sustainability of National incident response
incident response capability is fully financiallycapability
sustainable, from a single ormultiple sources.

122L3-2 Adequate
Human and financial resources
122L4-2 Early warning
resources forallocated to incident response arecapability
incident response adequate to the cybersecurity threat
environment and enhance
effectiveness of the organisation.

An early warning capacity isincorporated into the mission of theincident response organisation,

122L4-3 Capability to
manage threat
landscapewhich seeks to shape and manage
the threat landscape before
responding to specific incidents.

Routine and coordinated
123L3-1 Subnational /national incident response
sectorial incident
is established and publishedresponse
between public and privateorganisations
sectors,

The national incident responseorganisation coordinates andcollaborates with subnational/
sectorial incident responseorganisations.

123L4-1 Coordinating alllevels / sectors

Multi-level and inclusive national
and international coordination
between all levels and sectors isinternalised as vital for continuousand effective incident response.

with lines ofcommunication prepared
for times of crisis.

123L3-2 International
coordination

Technical capabilities now go
beyond coordinating response andinclude strategically focusing
resources in coordinatinginternational incident and threat
intelligence analysis/support.

123L4-2 Regional
coordination

Regional coordination exists toresolve incidents as they occur.

International cooperation
for incident response
between organisations
exists to resolve incidents
as they occur.

123L3-3 Information
sharing acrosssectors

A platform for the reporting andsharing of incidents across sectors
is promoted.

Key incident response
processes and tools aredefined, documented andfunctional.

124L3-1 Training &accreditation for
CSIRT members
established

Incident response teams haveestablished a training policy for
their members; members are being
trained in specialised subjects andaccredited by internationallyrecognised bodies on a regularbasis.

124L4-1 Scenario testingof incident
response
processes

The results of testing key processes
through case scenarios are being
analysed and are incorporated into
the updating of processes.

Members of CSIRTs
124L3-2 Sophisticatedreceive training regularly inincident analysis
order to understand key
concepts of cybersecurity
incident response.

Team members are able to carry out 124L4-2 Evaluatinga sophisticated incident analysis
effectiveness ofinvestigation quickly and efficiently.
CSIRT members
training

National-level incident
124L3-3 Regular review of Key processes (detection,
response is limited in scope
incident response resolution, prevention, etc.) areand still reactive.
processes
being monitored and reviewed inregular basis, and tested withdifferent case scenarios.

124L4-3 Tools againstzero-dayvulnerabilities

Tools for early detection,
identification, prevention, response
and mitigation of zero-day
vulnerabilities are embedded inincident response organisation(s).

124L4-4 Regional
coordination

Mechanisms for regional
cooperation in incident response
have been established.

124L3-4 Forensics

Forensics services are offered.

124L3-5 International
coordination

National incident response teams
coordinate with internationalcounterparts.
CI risks and assets have been
131L4-1 Regular review of Priority listing of CI assets isprioritised according to vulnerability
CI risk priorities regularly re-appraised to capture
and impact, which guides strategicchanges in the threat environment.
investment.

A detailed audit of CI
131L3-1 Priority of CI
assets as it relates torisks
cybersecurity is performed
on a regular basis.
CI asset audit lists are
disseminated to relevant
stakeholders.

The benefits of training andaccreditation are being evaluatedand inform the future training
planning.

131L3-2 Vulnerability &Vulnerability/asset management
asset management processes are in place so thatof CI assets
incremental security improvements
can be made.

129

Appendix B#

Category

Subcategory

Capacity area

132 Cybersecurity Policy Critical Infrastructure Organisationand Strategy(CI) Protection

Level 1
Level
ID
Keywords
Details
ID
Keywords
132L1-1 Informal
There is informal and ad132L2-1 Information
information
hoc threat and vulnerability
sharing
sharing between disclosure among CI
establishedCI & government owners as well as between
between CI &CI and the government,
government

132L2-2 Formal &consistent
information
sharing between
CI & government
132L2-3 Point of contact

133 Cybersecurity Policy Critical Infrastructure Risk Management
and Strategy(CI) Protection
and Response

130

132L2-4 Government
engagement in CI
protection
133L1-1 Access control
Physical and virtual access 133L2-1 Standards & best
implemented in CI control is implemented.
practices in CI

133L1-2 Basic capacity
against cyberthreat in CI

CI has basic capacity to
133L2-2 Risk management
detect, identify, respond toprocesses in CI
and recover from cyberthreats,

133L1-3 Data security
policy in CI

Protection of CI assets
includes basic levelcybersecurity awarenessand data security policies,

133L2-3 National CI
incident response
planAppendix B
Level 3
Details
ID
Keywords
Details
A mechanism is established 132L3-1 Centralised
There is a clear understanding offor regular vulnerability
management of CI which threats to CI are managed
disclosure with definedprotection
centrally, and which are managed
scope for reporting
locally.
incidents (either mandatory
or voluntary) between CI
asset owners and thegovernment.

Level 42

Formal internal and
132L3-2 Public awarenessexternal CI communication
campaign of CI
strategies have beenprotection
defined and are consistentacross sectors,

A public awareness campaign tofacilitate the CI communication
strategy is established with a pointof contact for this information.

ID
Keywords
132L4-1 Ability to adjustof CI protection

Details
Owners of critical infrastructure andassets are able to rapidly respond tothe changing threat landscape.

132L4-2 Trust between CI Trust has been established between& government
the government and CIs withrespect to cybersecurity andexchange of threat information,
which is fed into the strategic
decision-making process.

with clear points of contact. 132L3-3 Supply chain
Cybersecurity requirements andmanagement of CI vulnerabilities in CI supply chainsare clearly identified, mapped andmanaged.
Strategic engagement
between government andCI is agreed and promoted.
Best practices in security
133L3-1 Cybersecurity
Cybersecurity is firmly embedded
measures, guidelines, andoriented risk
into general risk management
standards for CI
management in CI practice.
cybersecurity have been
established and adopted.

Cybersecurity risk
133L3-2 Regular review of Assessment of the breadth andmanagement processes
impact analysis of severity of harm incurred by CI
have been established,CIassets is regularly conductedsupported by adequate
technical security solutions,communication links, andharm mitigation measures.
CI risk management
procedures are used tocreate a national response
plan including theparticipation of all vital
entities.

133L4-1 Regular audit ofCI

Audit practices to assess networkand system dependencies andvulnerabilities (i.e. unmitigateddependencies) are implemented on aregular basis and inform continuous
reassessment of CI risk portfolio,
technologies, policies andprocesses.

133L4-2 Indirect costs
The impact of cybersecurity risk on
inclusive inthe business operations of CI,
impact analysis of including direct and opportunity
CI incidents
costs, impact on revenue, andhindrance to innovation, areunderstood and incorporated into
future planning and executive
decision making.

133L3-3 Regular review of and response planning is tailored to
CI incident
that assessment to ensure business
response plans
continuity.

133L3-4 Regular review of Resources are allocated inresource
proportion to the assessed impact ofallocation for CI an incident to ensure rapid andprotection
effective incident response.
133L3-5 Insider threat
detection in CI

Insider threat detection is accounted
for.

131

Appendix B#

Category

Subcategory

141 Cybersecurity Policy Crisis Management
and Strategy

Capacity area
Crisis Management

Level 1
Level
ID
Keywords
Details
ID
Keywords
141L1-1 Assessment ofA preliminary cybersecurity 141L2-1 National incident
exercise ofneeds assessment of
exercise done
national incident measures and techniquesthat require testing has
been undertaken,
141L1-2 Exercise planning An exercise planning
organisation
authority has been
designated fordesignated, and has
national incident outlined the steps to betaken in order to conduct
the cybersecurity exercise.
141L1-3 Stakeholders'
participation innational incident
exercise

141L2-2 Appropriate
resources fornational incident
exerciseKey stakeholders and other 141L2-3 Roles in national
subject matter experts, such
incident exercise
as think tanks, academics,
definedcivil leaders andconsultants are included in
the planning process.
141L2-4 Incentives toparticipate innational incident
exercise
141L2-5 Trained monitorsof national
incident exercise

141L2-6 Evaluation ofnational incident
exercise
151 Cybersecurity Policy Cyber Defence
and Strategy

Strategy

151L1-1 National-level
threats identified

Specific threats to national 151L2-1 Cyber defence
security in cyberspace havestrategy exists
been identified, such asexternal threat actors (bothstate and non-state), insider
threats, supply chain
vulnerabilities, and threats
to military operational
capacity,

152 Cybersecurity Policy Cyber Defence
and Strategy

Organisation

152L1-1 Dispersed cyber
operations

Cyber operations units areincorporated into thedifferent branches of thearmed forces, but nocentral command andcontrol structure exists.

132

152L2-1 Defined
responsibility ofcyber defence
organisation

Appendix B
2

Level 3

Details
ID
Keywords
A cybersecurity exercise,
141L3-1 High-levelwith limited size andscenario ofgeographic scope has beennational incident
conducted involving all
exerciserelevant stakeholders in all
sectors.

Details
A realistic high-level scenario
informs a plan to test information
flows, decision-making andresource investment at the national
level.

ID
Keywords
141L4-1 Peer observanceof national
incident exercise

Level 4
Details
The exercise involves neutral peer
stakeholders to observe,

Appropriate resources have 141L3-2 Trust between
been allocated to theparticipants ofexercises.
national incident
exercise

Trust is developed well in advance 141L4-2 National incident
via the recruitment and pre-exercise
exercisebriefing process and throughcontributing toguaranteed confidentiality control.
international
challenges

and, where appropriate, contribute,and addresses international
challenges to produce scalable
results for international policy- anddecision-making.

Planning process includes
the engagement ofparticipants, an outline of
their role in the exercise,

141L3-3 SMART
objectives & KPI
of national
incident exercise

Specific, Measurable, Attainable,
Relevant, and Time-Bound(SMART) objectives andperformance key indicators (PKI)
inform decisions in crisis
management,

An evaluation of the crisis
management exercise is provided
for the international community, sothat lessons learnt can contributetoward a global understanding ofcrisis management.

and the articulation of
benefits and incentives forparticipation.

141L3-4 Evaluation ofand evaluation results inform future 141L4-4 National crisis
national incident investment in national cybersecurity
management
exercise informing capacity.
establishedinvestment

141L4-3 Internationallyshared result of
national incident
exercise

Crisis management is embedded inrisk analysis, review andmanagement.

Trained internal or external 141L3-5 National crisis
Findings are evaluated against
monitors facilitate themanagement
international crisis management
exercise.
aligned withgood practice.
international bestpractices
The exercise is evaluatedand commentary isprovided by participants
and stakeholders.

141L3-6 Tailored reportsof national
incident exercise

Tailored, sector-specific reports areprepared for each stakeholder,
while ensuring sensitive informationis secured.

National cyber Defence
151L3-1 Dedicatedpolicy or strategy exists
resources forand outlines the country’s
cyber defence
position in its response todifferent types and levels ofcyber-attacks (for example,
cyber-enabled conflictproducing a kinetic effectand offensive cyber-attacks
aimed to disrupt
infrastructure).

Resources dedicated toward Cyber
Defence are allocated based onnational strategic objectives.

151L4-1 Rules ofengagement incyberspace

The policy or strategy drives theinternational discussion on rules ofengagement in cyberspace.

151L3-2 Capturinglandscape ofnational-level
threat

The evolving threat landscape incybersecurity is captured throughrepeated review

151L4-2 Military doctrine
in cyberspace

Rules of engagement are clearly
defined and the military doctrinethat applies to cyberspace is fully
developed and takes note ofsignificant shifts in the
cybersecurity environment.

151L3-3 Cyber defence
strategy meets
objectives

in order to ensure that cyberDefence ways and means continue
to meet national security objectives.

152L3-1 Advanced
capabilities &situationalawareness

Highly specialised expertise with
152L4-1 Cross-borderadvanced capabilities and full
response ability
situational awareness are integrated
into the national defence posture.

The Defence apparatus contributes
to the debate in developing acommon international understandingof the point at which a cyber-attack
might trigger a cross-domain
response.

152L3-2 Counter-cyberintelligence
activities

There exist activities for detecting
and/or defending against
intelligence assessment throughcyber-space from other nations.

152L4-2 Establishedcounter-cyberintelligencecapability

Counter-cyber intelligence
activities are centrarised and havecapability to defend effectively.

There is a definedorganisation within the
Defence apparatus
responsible for conflictusing cyber means.

Enhancement

133Appendix B#

Category

Subcategory

153 Cybersecurity Policy Cyber Defence
and Strategy

Level 1

Capacity area
Coordination

ID
Keywords
153L1-1 Cyber defence
capability
requirements
agreedDetails
Cyber Defence capability
requirements are agreed
between the public andprivate sector in order tominimise the threat tonational and international
security.

Level
ID
Keywords
153L2-1 Coordination
between CI &defence

153L2-2 Intelligencesharing between
CI & defence

161 Cybersecurity Policy Communications
and Strategy
RedundancyCommunications
Redundancy

161L1-1 Gaps inemergency
communication
identified

Stakeholders convene toidentify gaps and overlaps
in emergency response
asset communications andauthority links.

161L2-1 Emergency
response assets
hardwired

161L1-2 Emergency
procedures
established

Emergency response assets, 161L2-2 Communication
priorities and standard
betweenoperating procedures are
emergency
mapped and identified in
response functions
the event of a
distributed
communications disruption
along any node in theemergency response
network.
161L2-3 Testing, training,
drills of
emergency
response

211 Cyber Culture andSociety

Cybersecurity Mind- Government
set

211L1-1 Leading agencies Leading agencies have
only have mind- begun to place priority on
setcybersecurity, byidentifying risks andthreats.

211L2-1 Most officials
have mind-set

212 Cyber Culture andSociety

Cybersecurity Mind- Private Sector
set

212L1-1 Leading firms
only have mindset

212L2-1 Most private
sector actors havemind-set

Leading firms have begun
to place priority on acybersecurity mind-set by
identifying high-riskpractices.

212L1-2 Materials for best Programmes and materials
practices available have been made available
to train and improvecybersecurity practices.
213 Cyber Culture andSociety134

Cybersecurity Mind- Users
set

213L1-1 Limited users only A limited proportion ofhave mind-set
Internet users have begun
to place priority on
cybersecurity, byidentifying risks andthreats.

213L2-1 Growing numberof users havemind-setAppendix B
Level 3
Details
ID
Keywords
Details
ID
Keywords
The entity in charge of
153L3-1 Analytical
Analytical capacity exists to support 153L4-1 Leading
cyber Defence coordinates
capability in cyber the coordination of resource
international
integration regarding cyberdefenceallocation for national cyberdebate about
events between
Defence; possibly including acyber defence
government, military andcyberdefence research centre.
critical infrastructure andidentifies clear roles andresponsibilities.
2

Defence organisations andcritical infrastructure
providers have establisheda mechanism to report
threat intelligence.

153L3-2 Strengths &weaknesses ofcyber defence
understoodEmergency response assets 161L3-1 Redundant
are hardwired into acommunications
national emergency
for key
communication network.
stakeholders

Most government officials
at all levels are aware ofcybersecurity goodpractices.

Most private sector actors
at all levels are aware ofcybersecurity goodpractices.

Details
The country is leading theinternational debate on cyberDefence

The understanding of strengths and 153L4-2 Intelligenceand systematically shares
weaknesses within the coordination
shared with allies intelligence with allies.
mechanism then feeds into the reevaluation of the national security
posture of the nation.
Outreach and education of
redundant communications
protocols is undertaken for key
stakeholders and is tailored to theirunique roles and responsibilities.

161L4-1 Optimised for
Optimised efficiency is in place toextended outages mediate extended outages ofsystems.

Communication is
161L3-2 Interoperability & Emergency response assets practice 161L4-2 Assisting
distributed acrossfunctionality
interoperability and function
neighbours
emergency response
undereffectively under compromisedfunctions, geographic areas
compromised
communications scenarios.
of responsibility, public andsituation
private responders, andcommand authorities.

Appropriate resources areallocated to hardware
integration, technology
stress testing, personnel
training and crisis
simulations drills.

Level 4

National-level assets can act toassist neighbours in the event of aninternational level crisis or incident.

161L3-3 Evaluation of
The results of these scenarios thennational incident inform strategic investment in future
exercise informing emergency response assets.
investment

161L3-4 Contribution tointernational
communications'
redundancy

Stakeholders contribute tointernational efforts on redundancy
communication planning.

211L3-1 Mind-set spreadin public sector

Agencies across all levels ofgovernment have routinized acybersecurity mind-set, employing
good (proactive) practices as amatter of habit.

211L3-2 Mind-set based
strategy in public
sector212L3-1 Mind-set spreadin private sector

Cybersecurity mind-set informs
strategic planning.
Most private sector actors,
including SMEs, have routinized acybersecurity mind-set, employing
good (proactive) practices as amatter of habit.

211L4-1 Mind-set
commonplace inpublic sector

The cybersecurity mind-set serves
as a foundation for government
official’s operational practices andis evidenced as global goodpractice.

212L4-1 Mind-set
commonplace inprivate sector

The cybersecurity mind-set serves
as a foundation for private sector
operational practices, informs all IT
related initiatives and is evidenced
as global good practice.

213L4-1 Users' mind-set
reducing threat

Cybersecurity mind-set of users is
related to a reduction of the overall
threat landscape of the country.

212L3-2 Mind-set based
Cybersecurity mind-set, informs
strategy in private strategic planning.
sector
A growing number of users 213L3-1 Most users havefeel it is a priority for themmind-setto employ good
cybersecurity practices andmake conscious efforts tosecurely use online
systems.

Most users have routinized acybersecurity mind-set, employing
secure practices as a matter of
habit.

135

Appendix B#

Category

221 Cyber Culture andSociety

Subcategory

Capacity area

Trust and Confidence User Trust andon the Internet
Confidence on theInternet

Level 1
Level
ID
Keywords
Details
ID
Keywords
221L1-1 A few users can A very limited proportion 221L2-1 Growing number
use internetof Internet users criticallyof users can use
securelyassess what they see orinternet securely
receive online and believethat they have the ability to
use the Internet and protect
themselves online.
221L1-2 Promotion of
Operators of Internet
online trust exists infrastructure develop
measures to promote trust
in online services but havenot established them.

221L2-2 Promotion of
online trust
established

221L2-3 User assistanceavailable

222 Cyber Culture andSociety

Trust and Confidence User Trust in E222L1-1 Government's
Government continues to
222L2-1 E-gov establishedon the Internet
government Services
recognition ofincrease e-service
needs for security provision, but also
in e-gov
recognises the need for theapplication of security
measures to establish trustin these services.
222L1-2 Stakeholders'
The need for security in e- 222L2-2 Risk reduction inrecognition of
government services is
e-gov
needs for security recognised by stakeholders
in e-gov
and users.
222L1-3 A few users can A limited proportion of
222L2-3 Promotion of euse e-gov securely users trust in the secure use
gov
of e-government services.

222L1-4 Security measures Some e-government
222L2-4 Growing number
in e-gov
services are informing users
of users can use eof the utility of deployed
gov securely
security solutions.
222L2-5 Incident
disclosure in egov

136

Appendix B
Level 3

Level 4

Details
A growing proportion ofInternet users criticallyassess what they see or
receive online, based on
identifying possible risks.

ID
Keywords
221L3-1 Most users canuse internet
securely

Details
ID
Keywords
Most Internet users critically assess 221L4-1 Users canwhat they see or receive online,
evaluate risk &based on identifying possible risks.
adjust behaviour

Details
Individuals assess the risk in using
online services, including changes
in the technical and cybersecurity
environment and continuously
adjust their behaviour based on thisassessment.

Internet infrastructure
operators have establishedprogrammes to promotetrust in online services.

221L3-2 Users' ability tocontrol providing
personal
information

Most Internet users feel confident
221L4-2 Promotion ofwhile using the Internet, have theonline trust
ability to recognise non-legitimate
revisedwebsites (including mimicryattempts), and have a sense ofcontrol over providing personal data
online.

Internet infrastructure operators
assess trust promotion services andintegrate findings into programme
and policy revision.

2

User-consent policies are in 221L3-3 Promotion ofplace designed to notify
online trust
practices on the collection,
evaluated
use or disclosure ofsensitive personal
information.

Programmes to promote trust in theuse of online services are assessed
based on measures of effectiveness
which informs resource allocation.

E-government services
222L3-1 Disclosures ofhave been fully developed.
activities ofgovernment
agencies

Public authorities are routinely
222L4-1 Promotion of epublishing certain information about
gov revised
their activities.

High-level risks affecting
egovernment services areprioritised in order toreduce occurrences.

E-government services andpromotion thereof are continuously
improved and expanded to enhancetransparent/open and securesystems and user trust.

222L3-2 Privacy-by-default Privacy-by-default is promoted as a 222L4-2 Data protection
Impact assessments on datain e-gov
tool for transparency in emeasures of e-gov protection in e-government services
government services.
are consistently taking place andfeed back into strategic planning.

The public sector promotes 222L3-3 Most users can
The majority of users trust in theuse of e-government
use e-gov securely secure use of e-government services
services and trust in theseand make use of them.
services through acoordinated programme,
including the compliance toweb standards that protect
the anonymity of users.
A growing proportion of
222L3-4 User feedbacks
users trust in the secure usefor e-govof e-government services.

Processes are employed forgathering user feedback in order toensure efficient management of
online content.

Possible breaches in
egovernment services arebeing identified,acknowledged, anddisclosed in an ad-hoc
manner.

137

Appendix B#

Category

223 Cyber Culture andSociety

Subcategory

Level 1

Capacity area

Trust and Confidence User Trust in Eon the Internet
commerce Services

ID
Keywords
223L1-1 Limited ecommerce
provided

Level
Details
ID
Keywords
E-commerce services are
223L2-1 E-commerce
being provided to a limited
establishedextent.

223L1-2 Private sectors'
recognition ofneed for security
in e-commerce

The private sector
223L2-2 Secure payment
recognises the need for theapplication of security
measures to establish trustin e-commerce services.

223L1-3 A few users canuse e-commerce
securely

A limited proportion of
223L2-3 Growing number
users trust in the secure useof users can use eof e-commerce services.
commerce
securely

223L1-4 Security measures Some e-commerce services 223L2-4 Promotion of trustin e-commerce
are informing users of theof e-commerce
utility of deployed security
solutions.
223L2-5 Terms &conditions of ecommerce
accessible
231 Cyber Culture andSociety

241 Cyber Culture andSocietyUser Understandingof Personal
Information
Protection Online

Reporting
Mechanisms

User Understandingof Personal
Information
Protection Online

Reporting
Mechanisms

231L1-1 Users have only
generalknowledge about
personal
information
protection

Users and stakeholders
231L2-1 Growing number
within the public andof users canprivate sectors may havesecure personal
general knowledge about
information online
how personal information ishandled online; and may
employ good (proactive)
cybersecurity practices toprotect their personal
information online.

231L1-2 Discussions onprotecting
personal
information

Discussions have begun
regarding the protection of
personal information andabout the balance between
security and privacy,

241L1-1 Reporting
channels of
incidents

The public and/or private
241L2-1 Incident reporting
sectors are providing somemechanisms
channels for reporting
established
online fraud, cyberbullying, child abuse
online, identity theft,
privacy and security
breaches, and otherincidents,

231L2-2 Discussions onbalance between
security & privacy

241L2-2 Promotion ofincident reporting
channels138

Appendix B
Level 3

2
Details
E-commerce services are
fully established bymultiple stakeholders in asecure environment.

ID
Keywords
223L3-1 Resource
allocation for ecommerce

Security solutions are
223L3-2 Most users canupdated and reliable
use e-commerce
payment systems have been
securely
made available.

Level 4
Details
ID
Keywords
Details
E-commerce service providers
223L4-1 Continuous
E-commerce services arerecognise the need for building trust
improvement of e- continuously improved in order toin order to ensure business
commerce
promote transparent, trustworthy
continuity, and resources areand secure systems.
allocated accordingly.
The majority of users trust in the
secure use of e-commerce services
and make use of them.

223L4-2 Clear terms &conditions of ecommerce

Terms and conditions provided by
e-commerce services are clear andeasily comprehensible to all users.

A growing proportion of
223L3-3 Investment for e- Stakeholders invest in establishing 223L4-3 User feedbacks
users trust in the secure use
commerceenhanced service functionality of efor e-commerceof e-commerce services.
commerce services, protection of
personal information and theprovision of feedback mechanisms
for users.

User feedback mechanisms areintegrated into e-commerce services
in order to enhance trust between
users and providers.

The private sector
promotes use of ecommerce services andtrust in these services.
Terms and conditions ofuse of e-commerce services
are easily accessible.
A growing proportion ofusers have the skills tomanage their privacy
online, and protect
themselves from intrusion,interference, or unwanted
access of information byothers.

231L3-1 Measures to
All stakeholders have theprotect personal information, confidence and theinformation online ability to take measures to protect
their personal information online
and to maintain control of the
distribution of this information.

There is constant public
231L3-2 Privacy rights
debate regarding theprotection of personal
information and about thebalance between security
and privacy, which informs
privacy policies withinpublic and private sectors.
231L3-3 Security &privacy balanced

Reporting mechanisms
have been established andare regularly used.

231L4-1 Users can adapt to Users have the knowledge andchangingskills necessary to protect theirenvironments
personal information online,
adapting their abilities to thechanging risk environment.

Users and stakeholders within the
public and private sectors widely
recognise the importance ofprotection of personal information
online, and are sensitised to theirprivacy rights.

231L4-2 Wide recognition There is a wide recognition of theabout personalneed to ensure security andinformation
protection of personal information.
protection

Mechanisms are in place in private
and public sectors to ensure thatprivacy and security are notcompeting.

231L4-3 Security &privacy balanced
in changing
environment

Policies are in place in private andpublic sectors to ensure that privacy
and security are not competing in achanging environment and are
informed by user feedback andpublic debate.

231L3-4 Privacy-by-default Privacy by default as a tool fortransparency is promoted.

231L4-4 Regular
Assessments of personalassessment of
information protection in eservices
privacy protection are regularly conducted and feedback into policy revision.

241L3-1 Coordination of Coordinated reporting mechanisms
incident reporting are widely used.
channels

241L4-1 Regular
All relevant stakeholders actively
enhancement of collaborate and share good practiceincident reporting to enhance existing reporting
mechanisms and there is a clear
distribution of roles andresponsibilities, including regarding
the response to reported incidents.

Programmes to promote the 241L3-2 Promotion ofuse of these mechanisms
incident reporting
have been established bychannelspublic and private sectors.
prioritised

Programmes to promote the use of 241L4-2 Coordination of Mechanisms have been developed
these mechanisms are prioritised byresponse toto coordinate response to reported
public and private sectors and arereported incidents incidents between law enforcement
considered as an investment in loss
and the national incident response
prevention and risk control.
capability.

241L3-3 Metrics ofEffectiveness metrics of reporting
incident reporting mechanisms are applied andfindings inform the revision andpromotion of the mechanisms.

139Appendix B#

Category

251 Cyber Culture andSociety

Subcategory

Capacity area

Media and Social
Media

Media and Social
Media

Level 1
ID
Keywords
Details
251L1-1 Media coverage There is ad-hoc media
of cybersecurity coverage of cybersecurity,with limited information
provided and reporting on
specific issues that
individuals face online,
such as online childprotection or cyberbullying.
251L1-2 Discussion onsocial media
security

311 Cybersecurity
Education, Training
and Skills

Awareness Raising

Awareness Raising
Programmes

Level
ID
Keywords
251L2-1 Cybersecurity as
common subject
in media

There is limited discussion 251L2-2 Wide range ofon social media about
issues ofcybersecurity.
cybersecurity inmedia

311L1-1 Awareness raising Awareness raisingprogrammes
programmes, courses,
seminars and online
resources are available fortarget demographics frompublic, private, academic,
and/or civil society sources,

251L2-3 Broad discussion
on social media
security
311L2-1 National
programme ofawareness raising

311L1-2 Awareness raising Awareness raising
311L2-2 Consultation with
programmes
programmes may be
stakeholders inaffected byinformed by international
national
international
initiatives but are not linked
programme ofinitiatives
to national strategy.
awareness raising
311L2-3 Cybersecurity
information portal

140

Appendix B
2

Level 3

Details
ID
Keywords
Cybersecurity is a common 251L3-1 Media coverage
subject across mainstreamof information
media, and informationabout
cybersecurity
measures

Details
Media coverage extends beyond
threat reporting and can inform thepublic of proactive and actionablecybersecurity measures, as welleconomic and social impacts.

and reports on a wide range 251L3-2 Frequentof issues, including security
discussion onbreaches and cybercrimesocial media
are widely disseminated.
security

There is frequent discussion onsocial media about cybersecurity
and individuals regularly exchange
experiences online using social
media.

There is broad discussion
on social media aboutcybersecurity.
A national programme for 311L3-1 Sector specificcybersecurity awarenessprogrammes ofraising, led by a designatedawareness raisingorganisation (from any
sector) is established,which addresses a wide
range of demographics andissues,Consultation with
311L3-2 Metrics forstakeholders from various
effectiveness ofsectors informs the creation
awareness raisingand utilisation ofprogrammes
programmes and materials.
A single online portal
linking to appropriate
cybersecurity information
exists and is disseminated
via that programme.

Level 4ID
Keywords
Details
251L4-1 Discussion
The broad discussion of personalchanging policy & experiences and personal attitudes
societyof individuals across mainstream
and social media inform policy
making and facilitate societal
change.

The national awareness raising
311L4-1 Awareness raising Awareness raising programmes areprogramme is coordinated andprogrammes
adapted in response to performance
integrated with sector-specific,
adapted according evidenced by monitoring which
tailored awareness raising
to effectivenessresults in the redistribution ofprogrammes, such as those focusing
resources and future investments.
on government, industry, academia,
civil society, and/or children.
Metrics for effectiveness are
established and evidence of
application and lessons learnt are
fed into future programmes.

311L4-2 Revision of
Metrics contribute toward national
national
cybersecurity strategy revisionawareness raising processes.
programme

311L3-3 Evolution of
The evolution of the programme isawareness raising supported by the adaptation ofprogrammes
existing materials and resources,
involving clear methods for
obtaining a measure of suitability
and quality.

311L4-3 Entire society
Awareness programme planning
involved ingives explicit consideration toawareness raising national demand from thestakeholder communication (in thewidest sense), so that campaigns
continue to impact the entire
society.

311L3-4 Contribution to
Programmes contribute toward
311L4-4 Overall threatinternational
expanding and enhancing
reduced byawareness raising international awareness raising goodawareness raising
practice and capacitybuilding
efforts.

The national awareness raisingprogramme has a measurable
impact on reduction of the overall
threat landscape.

141

Appendix B#

Category

312 Cybersecurity
Education, Training
and Skills

Subcategory
Awareness Raising

Level 1
Level
ID
Keywords
Details
ID
Keywords
Executive Awareness 312L1-1 Executives'
Executives are made aware 312L2-1 Executives' basic
Raisingawareness about of general cybersecurity
understandings ofgeneralissues, but not how thesecybersecurity
cybersecurity
issues and threats might
issuesaffect their organisation.
Capacity area

312L1-2 Executives of
Executives of particular
312L2-2 Limited
particular sectors sectors, such as finance andexecutives'
have awarenesstelecommunications, haveunderstandings ofbeen made aware ofcybersecurity's
cybersecurity risk inaffectgeneral and how theorganisation deals withcybersecurity issues, but
not of strategic
implications.
312L2-3 Raisingprogrammes forawareness ofcrisis management

321 Cybersecurity
Education, Training
and Skills

Framework for
Education

Provision

321L1-1 Qualification
programme forcybersecurity
educators

Qualification programmes 321L2-1 Qualification forfor cybersecurity educators
cybersecurity
are being explored,
educators
established

321L1-2 Professional
cybersecurity
educators

with a small cadre ofexisting professional
educators.

321L2-2 University levelcourses forcybersecurity

321L1-3 Educationalcourses forcybersecurity

Some educational courses
exist in cybersecurity
related fields, such as
information security,
network security andcryptography,

321L2-3 Degrees incybersecurity

321L1-4 Demand exists for A demand for cybersecurity 321L2-4 Seminars for noncybersecurity
education is evidenced
specialist
education
through course enrolment
and feedback.
321L2-5 Research &development incybersecurity
promoted

142

Appendix B
Level 3
Level 4
Details
ID
Keywords
Details
ID
Keywords
Details
Awareness raising of
312L3-1 Executives'
Executive awareness raising efforts 312L4-1 Cybersecurity as Cybersecurity risks are considered
executives in the public,
understandings of in nearly all sectors include thecommon agenda as an agenda item at every
private, academic and civil
cybersecurity
identification of strategic assets,
in board meetings executive meeting, and funding andsociety sectors address
measuresspecific measures in place to protect
attention is reallocated to address
cybersecurity risks inthem, and the mechanism by whichthose risks.
general, some of thethey are protected.
primary methods of attack,and how the organisation
deals with cyber issues(usually abdicated to theCIO).
2

Select executive members 312L3-2 Executives' ability Executives are able to alter strategic 312L4-2 Executives'
are made aware of how
to reallocate
decision making, and allocate
attitude as
cybersecurity risks affectresources
specific funding and people to theinternational role
the strategic decisionvarious elements of cyber risk,
modelmaking of the organisation,
contingent on their company’s
particularly those in theprevailing situation.
financial andtelecommunications
sectors.
Awareness raising efforts
of cybersecurity crisis
management at theexecutive level is stillreactive in focus.

Executives are regarded regionallyand internationally as a source ofgood practice in responsible andaccountable corporate cybersecurity
governance.

312L3-3 Executives'
Executives are made aware of what
understanding of contingency plans are in place tocrisis management address various cyber-based attacks
plans
and their aftermath.
312L3-4 Mandatory
cybersecurity
education for
executives

Executive awareness courses incybersecurity are mandatory fornearly all sectors.

Qualifications for andsupply of educators arereadily available incybersecurity.

321L3-1 Business experts'
participation incybersecurity
education

Cybersecurity educators are not
only drawn from the academic
environment, but incentives are inplace so that industry and/or
government experts take these
positions as well.

Specialised courses incybersecurity are offered
and accredited at theuniversity level.

321L3-2 Mandatory
Accredited cybersecurity courses
cybersecutity
are embedded in all computer
courses forscience degrees.
computer science
degrees

321L4-1 Internationallyforerunning incybersecurity
education

National courses, degrees, andresearch are at the forefront ofcybersecurity educationinternationally.

321L4-2 Balance between
core components& adaptive
processes

Cybersecurity education
programmes maintain a balance
between preserving corecomponents of the curriculum andpromoting adaptive processes that
respond to rapid changes in the
cybersecurity environment.

Degrees in cybersecurity
321L3-3 Cybersecurity
related fields are offered by
specific degree
universities.

Degrees are offered in cybersecurity 321L4-3 Cybersecurity
specifically, which encompasses
education
courses and models in various otheradapting tocybersecurity-related fields,changing needs
including technical and nontechnicalelements such as policy
implications, and multi-disciplinary
education.

Prevailing cybersecurity
requirements are considered in theredevelopment of all generalcurricula.

Universities and other
321L3-4 Cybersecurity as
bodies holdfocusing area
seminars/lectures oncybersecurity issues aimed
at non-specialists.

Cybersecurity educational offerings
are weighted and focused based onan understanding of current risks
and skills requirements.

Research and development 321L3-5 Cybersecurity
is a leading consideration in
education fromcybersecurity education.
primary to postgraduate

Cybersecurity education is not
limited to universities, but ranges
from primary to post-graduatelevels, including vocational
education.

143

Appendix B#

Category

322 Cybersecurity
Education, Training
and Skills

Subcategory
Framework for
Education

Capacity area
Administration

Level 1
Level
ID
Keywords
Details
ID
Keywords
322L1-1 Cybersecurity
The need for enhancing
322L2-1 Broad discussion
education needs cybersecurity education infor enhancing
recognised
schools and universities has
cybersecurity
been identified by leading
education
government, industry, andacademic stakeholders.

322L1-2 Ad-hoc supply of
resources forcybersecurity
education

Schools, government, and 322L2-2 Budget forindustry collaborate in an
research &ad-hoc manner to supply
education for
the resources necessary forcybersecurity
providing cybersecurity
education.
322L2-3 Attractiveness ofcybersecurity
career

331 Cybersecurity
Education, Training
and Skills

332 Cybersecurity
Education, Training
and Skills

Framework for
Provision
Professional Training

Framework for
UptakeProfessional Training

331L1-1 Cybersecurity
training needs
recognised

The need for training
331L2-1 Structured
professionals incybersecurity
cybersecurity has been
training
documented at the national
programmes
level.

331L1-2 Cybersecurity
training for
general IT staff

Training for general IT staff 331L2-2 Security
is provided on
professional
cybersecurity issues so thatcertification
they can react to incidents
as they occur, but notraining for dedicatedsecurity professionals
exists.

331L1-3 ICT certification
with somecybersecurity
issuesICT professional
331L2-3 Cybersecurity
certification is offered, withtraining
some security modules or
requirementscomponents.
listed331L1-4 Training courses
for cybersecurity

Ad-hoc training courses,
331L2-4 Cybersecurity
seminars and online
training
resources are available forprogrammes forcybersecurity professionals
non-professionals
through public or private
sources, with limited
evidence of take-up.

332L1-1 Metrics of uptake Metrics evaluating take-up 332L2-1 Cybersecurityof cybersecurity of ad-hoc training courses,
trained & certified
trainings
seminars, online resources,
employees
and certification offerings
exist, but are limited inscope.
332L2-2 Knowledgetransfer incybersecurity
332L2-3 Job creation incybersecurity

144

Appendix B
2

Level 3

Details
ID
Keywords
Broad consultation across 322L3-1 Cybersecurity
government, private sector,
education
academia and civil society
demand/supply
stakeholders informs
monitoredcybersecurity education
priorities and is reflected innational cybersecurity
strategy.

Details
Metrics are developed to ensurethat educational investments meetthe needs of the cybersecurity
environment across all sectors.

Level 4ID
Keywords
Details
322L4-1 International CoE International cybersecurity centres
in cybersecurity of excellence are establishedthrough twinning programmes led
by world class institutions.

National budget is322L3-2 Adapted budget
dedicated to national
for cybersecurity
cybersecurity research andeducation
laboratories at universities.

Government budget and spendingon cybersecurity education is
managed based on the national
demand.

322L4-2 Cooperation
between all
stakeholders incybersecurity
education

Routinized cooperation between all
stakeholders in cybersecurity
education can be evidenced.

Competitions and initiatives 322L3-3 International
for students are promotedcooperation in
by government and/or
cybersecurity
industry in order toeducation
increase the attractivenessof cybersecurity careers.

Leading national cybersecurity
academic institutions share theirlessons learnt with other national
and international counterparts.

322L4-3 Cybersecurity
education alignedwith practicalproblems

Content in cybersecurity education
programmes is aligned withpractical cybersecurity problems
and business challenges, andprovides a mechanism forenhancing curriculum based on the
evolving landscape.

322L3-4 CoE incybersecurity
Structured cybersecurity
training programmes exist
to develop skills towards
building a cadre ofcybersecurity-specificprofessionals.

Government has establishedacademic centres of excellence incybersecurity.
331L3-1 Cybersecurity
A range of cybersecurity training
331L4-1 Collaboration
The public and private sector
training aligned
courses is tailored toward meeting
between public & collaborate to offer training,with international national strategic demand and aligns
private inconstantly adapting and seeking tobest practices
with international good practice.
cybersecurity
build skillsets drawn from bothtraining
sectors.

Security professional
certification is offeredacross sectors within the
country.

331L3-2 Cybersecurity
training alignedwith national
strategy

The training programme outlines the 331L4-2 Coordination
priorities in the national
betweencybersecurity strategy.
cybersecurity
training &education

Training offerings coordinate witheducation programmes so that thefoundation established in schools
can enable training programmes tobuild a highly skilled workforce.

The needs of society are
well understood and a listof training requirements is
documented.

331L3-3 Communication
skills incybersecurity
training

Training programmes are offered to 331L4-3 Incentives for
Programmes and incentive
cybersecurity professionals thatcybersecurity
structures are in place to ensure thefocus on the skills necessary to
trained workforce retention of trained workforce
communicate technically complex
within the country.
challenges to nontechnicalaudiences, such as management andgeneral employees.

Training programmes for
non-cybersecurity
professionals arerecognised and initiallyoffered.

331L3-4 Metrics ofeffectiveness ofcybersecurity
training

Metrics of effectiveness assess themodes and procedures of training.

There is an establishedcadre of certified
employees trained incybersecurity issues,
processes, planning andanalytics.

332L3-1 Review ofcybersecurity
training
programmes

The uptake of cybersecurity training 332L4-1 Cybersecurity
is used to inform future training
trainedprogrammes.
professionals
internationallycontributing

Knowledge transfer from
employees trained incybersecurity to untrained
employees is ad hoc.

332L3-2 Coordination of
cybersecurity
training acrosssectors

Coordination of training across all
sectors ensures the national demandfor professionals is met.

Cybersecurity professionals not
only fulfil national requirements, butdomestic professionals are
consulted internationally to sharelessons learnt and good practice.

Job creation initiatives forcybersecurity withinorganisations are
established and encourage
employers to train staff tobecome cybersecurity
professionals.

145

Appendix B#

Category

Subcategory

411 Legal and Regulatory Legal Framework
Frameworks

Capacity area
Legislative
Framework for ICT
Security

Level 1
Level
ID
Keywords
Details
ID
Keywords
411L1-1 Discussion ofExperienced stakeholders 411L2-1 Cybersecurity
establishingfrom all sectors may havelegal framework
cybersecurity
been consulted to support
establishedlegal framework the establishment of a legal
and regulatory framework.
411L1-2 Priorities
identified incybersecurity
legal framework

412 Legal and Regulatory Legal Framework
Frameworks

Privacy, Freedom of 412L1-1 Partial privacy
Speech & Other
protection
Human Rights Online
legislation

Key priorities for creating
cybersecurity legal
frameworks have been
identified throughmultistakeholder
consultation, potentiallyresulting in draft
legislation,

411L2-2 Coverages ofcybersecurity
legal framework

Domestic legislation
partially recognises
privacy,

412L2-1 Online privacy
protected

412L1-2 Freedom of
expression

freedom of information,
412L2-2 Freedom of
freedom of assembly andexpression
association, and freedom ofprotected
expression online.

412L1-3 Discussion of
establishingdigital humanrights legislation

Stakeholders from all key 412L2-3 Privacy protected
sectors have been consulted
duringfor the development ofinvestigation
legislation addressing
human rights online.

412L2-4 Stakeholders'
participation to
discuss digital
human rights
legislation

413 Legal and Regulatory Legal Framework
Frameworks

146

Data Protection
Legislation

412L2-5 Participation tointernational
agreements
413L2-1 Data protection
legislation
established

413L1-1 Partial dataprotection
legislation

Data protection legislationis under development.

413L1-2 Stakeholders'
participation indata protection
legislation

Stakeholders from all key 413L2-2 Personal data
sectors have been consulted
protected
to support the developmentof legislation.

Appendix B
2
Details
Comprehensive ICT
legislative and regulatory
frameworks addressing
cybersecurity have been
adopted.

Level 3ID
Keywords
Details
ID
Keywords
411L3-1 Regular review of The country reviews existing legal 411L4-1 Balance between
cybersecurity
and regulatory mechanisms for ICT
cybersecurity
legal framework security, identifies where gaps andlegal framework
overlaps exist, and amends laws
& best practices
accordingly or enacts new laws.

Laws address theprotection of criticalinformation infrastructure,
e-transactions, liability ofInternet Service Providers
and, potentially, cyberincident reporting
obligations.

Enhancement

Level 4
Details
Mechanisms are in place forcontinuously harmonising ICT legal
frameworks with national
cybersecurity related ICT policies,
international law, standards andgood practices.

411L4-2 Participation tointernational
cooperationagreements

Participation in the development ofregional or international
cybersecurity cooperationagreements and treaties is a priority.

411L4-3 Exceeding
minimum
requirement ofinternational
cooperationagreement

Efforts are in place to exceed
minimal baselines specified in thesetreaties where appropriate.

411L4-4 International
and/or regional
cooperation of
establishinglegislative
framework

The nation cooperates
internationally and/or regionallyin supporting other nations inestablishing legislative framework
for ICT security.
In order to meet dynamic changes in
the application of technology tohuman rights, procedures are inplace to amend and update legal
frameworks as needed.

Domestic law recognises
fundamental human rights
on the Internet, including
privacy online,

412L3-1 Cybersecurity
legal frameworkaligned withinternational bestpractices

International and regional trends
and good practices inform theassessment and amendment ofdomestic legal frameworks
protecting human rights online andassociated resource planning.

412L4-1 Amendment
procedures forcybersecurity
legal framework

freedom of speech,
freedom of information,and freedom of assembly
and association.

412L3-2 Exceeding
minimum
requirement ofinternational
agreement

Research is conducted andmeasures are in place to exceed
minimal baselines specified ininternational agreements.

412L4-2 Internet access as Access to the Internet is recognised
human rightand enshrined as a human right.

Domestic law specifies
safeguards to protect theindividual’s right to privacy
during the collection, use
and disclosure of personal
information in
investigations involving
electronic evidence.

412L4-3 Contributing tointernational
digital humanrightsAll relevant actors fromprivate sector and civilsociety are involved in
shaping laws andregulations on privacy,
freedom of speech, andother human rights online.

412L4-4 Contributing toDomestic actors, policies andinternational
practices actively shape positive
privacy protection international discussions of privacy
onlineonline.

The country has ratified or
acceded to international
agreements.
Comprehensive data
413L3-1 Timeframe ofprotection legislation has
storing personal
been adopted and enforced,
data during
investigation

which includes conditions
for the collection of
personal data andprotection from misuse.

Legal mechanisms are in place thatenable strategic decision making
that determines the timeframe inwhich personal data is no longer
required as evidence forinvestigation and must be deleted.

413L4-1 Amendment
procedures fordata protection
legislation

The state is an active contributor in
the global discourse on humanrights on the Internet.

In order to meet dynamic changes inthe technological environment,
procedures are in place to amend
and update legal frameworks asneeded.

413L3-2 Data protection
International and regional trends
legislation aligned and good practices inform thewith international assessment and amendment of data
best practices
protection laws and associatedresource planning.

147

Appendix B#

Category

Subcategory

Capacity area

414 Legal and Regulatory Legal Framework
Frameworks

Child Protection
OnlineLevel 1
ID
Keywords
Details
414L1-1 Partial online
Legislative provisions
child protection
protecting children online
legislation
are under development.

414L1-2 Stakeholders'
participation in
online childprotection
legislation
415 Legal and Regulatory Legal Framework
Frameworks

Consumer Protection 415L1-1 Partial consumer
Legislation
protection
legislation

415L1-2 Stakeholders'
participation in
consumerprotection
legislation
416 Legal and Regulatory Legal Framework
Frameworks

Intellectual Property
Legislation

417 Legal and Regulatory Legal Framework
Frameworks

Substantive
Cybercrime
Legislation

Stakeholders from all key 414L2-2 Legal minors
sectors have been consulted
protected
to support the developmentof legislation.
Legislation protecting
consumers online is underdevelopment.

415L2-1 Consumer
protection
legislation
established

Stakeholders from all key 415L2-2 Responsible
sectors have been consulted
agency designatedto support the development
for consumerof legislation.
protection

416L1-1 Partial intellectual Legislation on intellectual
property
property online is underlegislation
development,

416L1-2 Stakeholders'
participation in
intellectual
property
legislation

Level
ID
Keywords
414L2-1 Online childprotection
legislation
established

416L2-1 Intellectual
property
legislation
establishedthrough consultation withkey stakeholders.

417L1-1 Partial substantive Partial legislation exists
417L2-1 Substantive
cybercrimethat addresses somecybercrime
legislation
aspects of cybercrime orlegislation exists
cybercrime legal provisions
are under development.
417L2-2 Participation tointernational
agreements on
cybercrime

418 Legal and Regulatory Legal Framework
Frameworks

Procedural
Cybercrime
Legislation

418L1-1 Partial procedural Development of specific
418L2-1 Proceduralcybercrime
procedural cybercrime
cybercrime
legislation
legislation or amendment oflegislation exists
general procedural criminal
law to adapt to cybercrime
cases has begun.
418L2-2 Participation tointernational
agreements on
cybercrime148

Appendix B
2
Details
Comprehensive legislationon the protection ofchildren online has been
adopted and enforced,

Level 3ID
Keywords
Details
414L3-1 Online child
The country continuously seeks toprotection
improve national child protection
legislation aligned online legislation to comply with
with international regional and international law andbest practices
standards.

Level 4ID
Keywords
414L4-1 Amendment
procedures foronline childprotection
legislation

Details
In order to meet dynamic changes inthe technological environment,
procedures are in place to amend
and update legal frameworks asneeded.

Comprehensive legislation 415L3-1 Consumer
The country continuously seeks to 415L4-1 Amendment
protecting consumers fromprotection
improve national consumer
procedures forbusiness malpractice online
legislation aligned protection legislation to address
consumerhas been adopted and iswith international national needs and comply withprotection
enforced.
best practices
regional and international consumer
legislation
protection standards.

In order to meet dynamic changes in
the application of technology toconsumer protection, procedures arein place to amend and update legal
frameworks as needed.

and ensures that dataprotection and privacy rules
for legal minors apply tothe online environment.

A lead agency responsible
for the protection of
consumers online has been
designated.
Comprehensive legislation 416L3-1 Intellectual
Legislation on intellectual property
addressing intellectual
property
online is regularly reviewed andproperty of online products
legislation aligned amended accordingly to reflectand services has beenwith international changes in national priorities andadopted and is enforced.
best practices
the international ICT landscape.

416L4-1 Balance between
intellectual
property & open
access policy

Decisions to update legislation are
based on the balance between
intellectual property and open
access policies, through multistakeholder discussion.

417L4-1 Contributing tointernational
cybercrime
treaties

The country is an active contributor
in the global discourse on
developing and improving
international cybercrime treaties.

416L3-2 Stakeholders'
participation in
amendment ofintellectual
property
legislation

Legislative amendments are
informed by multistakeholder
consultations and public discourse.

Substantive cybercrime
legal provisions arecontained in specificlegislation or a generalcriminal law.

417L3-1 Exceeding
minimum
requirement ininternational
agreements on
cybercrime

Measures are in place to exceed
minimal baselines specified ininternational treaties whereappropriate,

The country has ratified
regional or international
instruments on cybercrimeand consistently seeks to
implement these measures
into domestic law.

417L3-2 Amendment
procedures for
substantive
cybercrime
legislation

which includes procedures to amend 417L4-2 Regular review of Laws, where needed, are amended
substantive legal frameworks as
substantive
to reflect changes in theneeded.
cybercrimeinternational ICT environment.
legislation

Comprehensive criminal
418L3-1 Procedural
In the case of cross-border
418L4-1 Contributing toprocedural law containing
cybercrime
investigation, procedural law
international
provisions on thelegislation enables stipulates what actions need to be
cybercrime
investigation of cybercrime
cross-borderconducted under particular casetreatiesand evidentiary
investigation
characteristics, in order torequirements has beensuccessfully investigate cybercrime.
adopted and is enforced.
The state has ratified
regional or international
instruments on cybercrimeand consistently seeks to
implement these measures
into domestic law.

418L3-2 Exceeding
minimum
requirement ininternational
agreements on
cybercrime

Measures are in place to exceed
minimal baselines specified ininternational treaties whereappropriate,

418L3-3 Amendment
procedures forproceduralcybercrime
legislation

which includes procedures to amend
procedural legal frameworks asneeded.

The country is an active contributor
in the global discourse on
developing and improving
international cybercrime treaties.

418L4-2 Regular review of Procedural law, where needed, isprocedural
amended to adapt to the changing
cybercrime
cybercrime landscape and emerging
legislation
investigative challenges.

149

Appendix B#

Category

Subcategory

Capacity area

421 Legal and Regulatory Criminal Justice
Frameworks
SystemLaw Enforcement

Level 1
ID
Keywords
Details
421L1-1 Limited digital
Traditional investigative
forensics
measures are applied tocapabilities in law cybercrime investigations,enforcementwith limited digitalforensics capacity.

421L1-2 Training for law
enforcement
officers

Level
ID
Keywords
421L2-1 Comprehensive
investigative
capabilities forcybercrimes

If law enforcement officers 421L2-2 Established chain
receive training onof custody ofcybercrime and digital
digital evidence
evidence, it is ad-hoc andnot specialised.
421L2-3 Standards fortraining for law
enforcement
officers

422 Legal and Regulatory Criminal Justice
Frameworks
System

423 Legal and Regulatory Criminal Justice
Frameworks
System

Prosecution

Courts422L1-1 Limited
capabilities toprosecutecybercrimes

A limited number of
specialised cybercrime
prosecutors have thecapacity to build a case
based on electronic
evidence,

422L1-2 Training forprosecutors

If prosecutors receive
training on cybercrime anddigital evidence, it is adhoc and not specialised.

423L1-1 Limited
A limited number of judges 423L2-1 Sufficientcapabilities tohave the capacity to presidejurisdictional
judge cybercrimes over a cybercrime case,capabilities forcybercrimes

423L1-2 Training forjudges150

422L2-1 Comprehensive
prosecutorial
capabilities forcybercrimes

If judges receive training
on cybercrime and digital
evidence, it is ad-hoc andnot specialised.

423L2-2 Specialised
training for judges

Appendix B
2

Level 3

Details
ID
Keywords
A comprehensive
421L3-1 Dedicatedinstitutional capacity withinvestigative
sufficient human,
resources forprocedural andcybercrimes
technological resources toinvestigate cybercrime
cases has been established.

Details
Resources dedicated to fully
operational cybercrime units havebeen allocated based on strategic
decision making.

ID
Keywords
421L4-1 Specialised andcontinuous
training for law
enforcement
officers

Details
All law enforcement officers receive
specialised and continuous training
based on relative responsibilities
and new, evolving threat
landscapes.

Digital chain of custody
421L3-2 Advanced
and evidence integrity isinvestigative
established including
capabilities forformal processes, roles andcybercrimes
responsibilities.

Advanced investigative capabilities 421L4-2 Sophisticatedallow the investigation of complex
digital forensic
cybercrime cases,
tools

Law enforcement can utilise
sophisticated digital forensic tools,
and these technologies are
consistently updated.

Standards for the training
421L3-3 Regular trainingof law enforcement officers
for law
on cybercrime exist and are
enforcement
implemented.
officers

supported by regular testing andtraining of investigators.

421L3-4 Cross-borderinvestigation of
cybercrimes

Law enforcement agencies have theresources to maintain the integrityof data to meet international
evidential standards in cross-borderinvestigation.

421L3-5 Statistics &analysis ofcybercrime
investigations

Statistics and trends on cybercrime
investigations are collected andanalysed.

A comprehensive
422L3-1 Institutional
institutional capacity,
structures inincluding sufficient human,prosecution
training and technologicalservicesresources, to prosecutecybercrime cases and cases
involving electronic
evidence is established.
422L3-2 Statistics &analysis ofcybercrime
prosecutions

Level 4

421L4-3 Regular review of The institutional capacity of law
investigative
enforcement is frequently reviewed
capabilities forand revised based on an assessment
cybercrimesof effectiveness.

Institutional structures are in place, 422L4-1 Prosecution ofwith a clear distribution of tasks andcross-borderobligations within the prosecution
cybercrimes
services at all levels of the state.

There is national capacity toprosecute complex domestic andcross-border cybercrime cases.

Statistics and trends on cybercrime
prosecutions are constantly
collected and analysed.

A dedicated cybercrime prosecution
unit might have been established.

422L4-2 Dedicatedprosecutorial
resources forcybercrimes

422L3-3 Exchange of best A mechanism exists that enables the 422L4-3 Specialised andpractices between exchange of information and goodcontinuous
prosecutors &practices between prosecutors andtraining forjudgesjudges to ensure efficient andprosecutors
effective prosecution of cybercrime
cases.

All prosecutors receive specialised
and continuous training based onrelative responsibilities and new,evolving threat landscapes.

Sufficient human and423L3-1 Centralised judges The court system has organised
technological resources arefor cybercrimes
itself to ensure a central
available to ensure
management of cybercrime cases,
effective and efficient legal
proceedings regarding
cybercrime cases, andcases involving electronic
evidence.

423L4-1 Specialised andJudges receive specialised andcontinuous
continuous training based on
training for judges relative responsibilities and new,evolving threat landscapes.

Judges receive specialised 423L3-2 Institutional
training on cybercrime andstructures ofelectronic evidence.
courtswith clear distribution of tasks andobligations within the court system
at all levels of the state.

423L4-2 Regular review of The institutional capacity of thecourt system
court system is frequently reviewed
capabilities toand revised based on an assessment
judge cybercrimes of effectiveness.

423L3-3 Statistics &analysis ofcybercrimeconvictions

Statistics and trends on cybercrimeconvictions are collected andanalysed.

151

Appendix B#

Category

Subcategory

Level 1

Capacity area

431 Legal and Regulatory Formal and Informal Formal Cooperation
Frameworks
Cooperation
Frameworks to
Combat Cybercrime

ID
Keywords
431L1-1 Formalinternational
cooperation
againstcybercrimes

Details
Formal mechanisms ofinternational cooperation
have been established,

Level
ID
Keywords
431L2-1 Establishedformalinternational
cooperation

431L1-2 Exchange of
Exchange of information on 431L2-2 Mutual legal
information
cybercrime between
assistance &between public & domestic public and private
extradition
private sectors
sectors is ad-hoc andabout cybercrimes unregulated.
431L2-3 Legislativerequirements on
informationexchange between
public & private
sectors
432 Legal and Regulatory Formal and Informal Informal Cooperation 432L1-1 Exchange ofFrameworks
Cooperation
information
Frameworks to
betweenCombat Cybercrime
government &justice aboutcybercrimes
432L1-2 Cooperation
between ISPs &law enforcement

Exchange of information
between government andcriminal justice actors islimited and ad-hoc.

432L2-1 Establishedinformalcooperation
betweengovernment &justice

Ad-hoc cooperation
between Internet Service
Providers and law
enforcement exists, but is
not always effective.

432L2-2 Establishedinformalcooperation
between ISPs &law enforcement

432L1-3 Informal
Law enforcement
432L2-3 Informalinternational
cooperates with foreigninternational
cooperation in law counterparts on an ad-hoc
integration in law
enforcement
basis, but is not integrated
enforcement
in regional and international
networks.

152

Appendix B
Level 3

2
Details
Formal mechanisms ofinternational cooperation
have been established inorder to prevent andcombat cybercrime byfacilitating their detection,
investigation, andprosecution.

ID
Keywords
431L3-1 Communication
channels forinternational
cooperation

Mutual legal assistance and 431L3-2 Strategicallyextradition agreements andexpandingmechanisms have beeninternational
established and are applied
cooperation
to cybercrime cases.

Details
Formal international cooperation
mechanisms are fully functional,
with established communication
channels.

Level 4ID
Keywords
Details
431L4-1 Regular review of Formal international cooperationinternational
mechanisms are regularly reviewed
cooperation
to determine effectiveness, and arerevised accordingly to reflect thechanging cybercrime landscape.

Strategic decisions are made to
expand and enhance formalcooperation mechanisms on
cybercrime as needed.

431L4-2 Interoperability of Formal and informal international
formal & informal cooperation mechanisms
international
complement each other and arecooperationinteroperable.

Legislative requirements
431L3-3 Resources for
Resources are allocated to support 431L4-3 Regularly
Formal mechanisms that enable thefor the exchange of
information
the exchange of information
adjustedexchange of information between
information between
exchange between between public and private sectors
information
domestic public and private sectors
domestic public and private
public & private domestically and enhance legislative
exchange between are adapted in accordance withsectors have been
sectors
requirements and communication
public & private identified needs and changing threat
determined.
mechanisms.
sectors
environment.
Informal relationships
432L3-1 Establishedbetween government andrelationshipcriminal justice actors have
among
been established, resulting
government,in the regular exchange ofprosecutors,
information on cybercrime
judges & law
issues.
enforcement

A strategic relationship between
government actors, prosecutors,
judges and law enforcement
agencies has been establishedrelating to cybercrime.

432L4-1 Adapted
cooperation &exchange of
information

Government and criminal justiceactors exchange information timely
and efficiently, and cooperation isadapted to the changing cybercrime
environment and associatedrequirements.

Effective informalcooperation mechanisms
between Internet Service
Providers and law
enforcement have been
established, with clear
communication channels.

Law enforcement cooperates withdomestic and foreign ISPs in
combatting cybercrime.

432L4-2 Adaptedinternational
cooperation

A routinized relationship between
law enforcement and ISPs,
domestically and across borders,has been established and is
adaptable to emerging forms ofcybercrime.

432L3-2 Cooperation
between foreign
ISPs & law
enforcement

Domestic law enforcement 432L3-3 Joint international Law enforcement agencies work
432L4-3 Interoperability of Formal and informal international
agencies are informallyinvestigation &jointly with foreign counterparts,
formal & informal cooperation mechanisms
integrated with regional andprosecution
potentially through joint task forces,international
complement each other and areinternational counterparts
resulting in successful crossbordercooperationinteroperable.
and networks, such as
cybercrime investigations andInterpol or 24/7 networks.
prosecutions.

Enhancement

432L4-4 International
and/or regional
cooperation of
establishing
cybercrime
legislation

The nation cooperates
internationally and/or regionallyin supporting other nations inestablishing cybercrime
legislation.

153

Appendix B#

Category

511 Standards,
Organisations, andTechnologies

Subcategory
Adherence toStandards

Capacity area
ICT Security
Standards

Level 1
Level
ID
Keywords
Details
ID
Keywords
511L1-1 Standards for
Information risk
511L2-1 Establishedinformation risk management standards
standards & best
management
have been identified for use
practices

511L1-2 Standards for
information risk
management
partly used

and there have been some
initial signs of promotion
and take-up within public
and private sectors.

511L2-2 Standards & bestpractices widelyused

511L1-3 International
standards & bestpractices
implemented

There is some evidence of 511L2-3 Metrics ofmeasurable implementation
adoption ofand adoption ofstandards & bestinternational standards andpractices
good practices.
511L2-4 Promotion of useof standards &best practices
511L2-5 Metrics ofcompliance ofstandards & bestpractices
511L2-6 Standards & bestpractices used by
CI supply chains

512 Standards,
Organisations, andTechnologies

Adherence toStandards

Standards in
Procurement

512L1-1 Standards & best Cybersecurity standards
512L2-1 International
practices forand good practices guiding
standards & bestprocurement
procurement processes
practices forhave been identified for
procurementuse.
implemented
512L1-2 Promotion of useof standards &best practices for
procurement

Evidence of promotion and 512L2-2 Metrics ofadoption of cybersecurity
adoption ofstandards and goodstandards & bestpractices in defining
practices for
procurement practices
procurement
exists within public sectors
and private sectors.
512L2-3 Metrics ofcompliance ofstandards & bestpractices for
procurement154

Appendix B
Level 3

2

Level 4ID
Keywords
Details
511L4-1 Regular review of The choice of adopted standards
adoption ofand good practices and theirstandards & best implementation is continuously
practices
improved.

DetailsNationally agreed baselineof cybersecurity related
standards and goodpractices has been
identified,ID
Keywords
511L3-1 Risk-based
adoption ofstandards & bestpractices

Details
Government and organisations
promote adoption of standards andgood practises according toassessment of national risks andbudgetary choices.

and adopted widely acrosspublic and private sectors.

511L3-2 Resource
allocation basedon standards

There is evidence of debate
511L4-2 Decision making Adoption of standards and nonbetween government and otherof non-compliance compliance decisions are made in
stakeholders as to how national andto standards &response to changing threatorganisational resource decisions
best practices
environments and resource drivers
should align and drive standard
across sectors and CI throughadoption.
collaborative risk management.

Some body within
511L3-3 Contributing togovernment exists to assessinternational
level of adoption acrossstandards
public and private sectors.

Evidence of contribution tointernational standards’ bodies
exists and contributes to thought
leadership and sharing ofexperience by organisations.

511L4-3 Risk-based
decision makingof compliance

Evidence exists of debate within all
sectors on compliance to standards
and good practices, based oncontinuous needs assessments.

Cybersecurity standards and goodpractices in guiding procurement
processes are being adhered towidely within public and private
sectors.

512L4-1 Realtime
Organisations have the ability tomonitoring ofmonitor use of standards and good
non-compliance to practices in procurement processes
standards & best and support deviations andpractices fornoncompliance decisions in realprocurement
time

Government schemes exist
to promote continued
enhancements,and metrics are being
applied to monitor
compliance.
Consideration is being
given to how standards andgood practices can be used
to address risk within
supply chains within theCI, by both government
and CI.
Procurement practices meet 512L3-1 Standards & bestinternational IT guidelines,
practices forstandards and good
procurement
practices.
widely used &complied
Adoption

512L3-2 Regular review of Critical aspects of procurement and 512L4-2 Risk-based
through risk-based decision making
procurement
supply, such as prices and costs,
decision making and quality assurance.
quality, timescales and other valueof non-complianceadding activities are continuously
improved,

and compliance ofstandards in procurement
practices within the public
and private sectors, isevidenced throughmeasurement andassessments of processeffectiveness.

512L3-3 Wider resource
planning inprocurement

and procurement process
improvements are made in thecontext of wider resource planning.

512L3-4 Procurement skills Organisations are able tobenchmarkbenchmark the skills of theirprocurement professionals against
the competencies outlined in
procurement standards and identify
any skills and capability gaps.
512L3-5 E-sourcing / etendering

Internal stakeholders have been
trained in the secure use of Esourcing or E-tendering systems andpurchase-to-pay systems (P2P) in
order to implement these tools in
performing key tasks inprocurement and supply.

155

Appendix B#

Category

513 Standards,
Organisations, andTechnologies

Subcategory
Adherence toStandards

Capacity area
Standards in
SoftwareDevelopment

Level 1
Level
ID
Keywords
Details
ID
Keywords
513L1-1 Standards & best Core activities and513L2-1 Metrics ofpractices formethodologies for software
adoption ofdevelopment
development processes
standards & best
focused on integrity andpractices forresilience are being
development
discussed withinprofessional communities.
513L1-2 Promotion of useof standards &best practices fordevelopment

Government promotes
relevant standards insoftware development, butthere is no widespread useof these standards yet.

513L2-2 Education &training fordevelopment

513L1-3 Coding standards Some organisations supply
or seek to adopt standards
in code development.
521 Standards,
Organisations, andTechnologies

Internet
Infrastructure
Resilience

Internet
Infrastructure
Resilience

521L1-1 Limited internet
infrastructures

Limited Internet services
and infrastructure areavailable, but may not be
reliable.

521L2-1 Reliable internet
infrastructures

521L1-2 Discussion onresilience ofinternet
infrastructures

Resilience of Internet
521L2-2 Established einfrastructure in public andcommerce &private sectors has been
electronic
discussed by multiple
authentication
stakeholders, but has notbeen fully addressed.
521L2-3 Internet
infrastructurescompliant tointernational
standards & bestpractices
521L2-4 Internet
infrastructures
formally managed

531 Standards,
Organisations, andTechnologies

156

Software Quality

Software Quality

531L1-1 Quality &functional
requirement ofsoftware

Software quality andfunctional requirements inpublic and private sectors
are recognised andidentified, but notnecessarily in a strategicmanner.

531L2-1 Establishedquality &functional
requirement ofsoftware531L1-2 Catalogue of
secure softwares

A catalogue for secure
531L2-2 Softwares
software platforms andcomplying withapplications within theinternational
public and private sectors is
standards
under development.

531L1-3 Software update
policies underdevelopment

Policies and processes on 531L2-3 Establishedsoftware updates andsoftware update
maintenance are now underprocesses
development.

531L1-4 Software
deficiencies
information

Evidence of software
531L2-4 Software
quality deficiencies is beingclassification
gathered and assessed
regarding its impact on
usability and performance.

Appendix B
Level 3

2
Details
Government has anestablished programme forpromoting and monitoringstandard adoption insoftware development –both for public andcommercial systems.

ID
Keywords
513L3-1 Security
consideration inall stages

Details
Security considerations areincorporated in all stages ofsoftware development.

Evidence that high integrity 513L3-2 Core development Core development activities,
systems and software
activities
including configuration anddevelopment techniques are
documentation management,
present within the
security development and lifecycle
educational and training
planning have been adopted.
offerings in the country.

Level 4ID
Keywords
Details
513L4-1 Risk-based
Software development projects
decision making continuously assess the value ofof non-compliance standards and reduce or enhancelevels of compliance according torisk-based decisions.

513L4-2 Adopting
standards
throughout lifetime

Procurement of software includes
on-going assessments of the valueof standards in delivering software
quality – throughout the lifetime of
the contract (as opposed to simply
initially at procurement stage).

513L3-3 Risk-based
adoption ofstandards

Procurement of software developed 513L4-3 Explicit
according to required standards isrequirements byconsidered based on an assessment
contractof risk in investment decisions.

Requirements are built into
contracts with suppliers.

Reliable Internet services
and infrastructure havebeen established.

521L3-1 Metrics ofcompliance tointernational
standards ofinternet
infrastructures

Regular assessment of processes
521L4-1 Controlledaccording to international standards
acquisition ofand guidelines are conducted
infrastructures
together with assessment of national
information infrastructure security
and critical services

Acquisition of infrastructuretechnologies is effectively
controlled, with flexibility
incorporated according to changing
market dynamics.

Internet is used forecommerce and electronicbusiness transactions;authentication processes
are established.

521L3-2 Investment to new that drive investment in newtechnologies intechnologies.
internet
infrastructures

521L4-2 Optimised cost for Costs for infrastructure technologies
internetare continually assessed andinfrastructures
optimised.

Technology and processes
deployed for Internet
infrastructure meetinternational IT guidelines,
standards, and goodpractices.

521L4-3 Controlled
acquisition ofcriticaltechnologies

There is effectively controlled
acquisition of critical technologies
with managed strategic planningand service continuity processes inplace.

National infrastructure isformally managed, with
documented processes,roles and responsibilities,
and limited redundancy.

521L4-4 Independency &persistence ofinternet
infrastructuretechnologies

Scientific, technical, industrial andhuman capabilities are being
systematically maintained, enhanced
and perpetuated in order to maintainthe country’s independent
resilience.

Software quality andfunctional requirements inpublic and private sectors
are recognised andestablished.

531L3-1 Monitoring
software quality

Quality of software used in public 531L4-1 Highand private sectors is monitored andperformance,
assessed.
reliability &usability
softwares

Software applications of high level
performance, reliability andusability are available,

Reliable software
531L3-2 Review ofapplications that adhere tosoftware update
international standards andpolicies &good practices are being
processes
used widely in the public
and private sectors.

Policies and processes on software 531L4-2 Automatedwith service continuity processes
updates and maintenance are being
service continuity fully automated.
improved based on risk assessments
and the criticality of services.

Policies on and processes
for software updates are
established.

531L3-3 Business benefit
from improving
software quality

Benefits to businesses fromadditional investment in ensuringsoftware quality and maintenanceare measured and assessed.

Software applications arecharacterised as to theirreliability, usability andperformance in adherence
to international standards
and good practices.

531L3-4 Software
deficiency
handling

Software defects are manageable ina timely manner and service
continuity is ensured.

531L4-3 Regular review of Requirements of software quality
quality
are being systematically reviewed,
requirement
updated, and adapted to thechanging cybersecurity
environment.

157

Appendix B#

Category

541 Standards,
Organisations, andTechnologies

Subcategory

Capacity area

Technical Security
Controls

Technical Security
Controls

Level 1
Level
ID
Keywords
Details
ID
Keywords
541L1-1 Technical security Technical security controls 541L2-1 Latest technicalcontrols deployed are deployed by users,
controls & patch
public and private sectors,
managements
but inconsistently.
widelyimplemented
541L1-2 Latest technicalsecurity controls
promoted

The deployment of up-todate technical security
controls is promoted in an
ad-hoc manner and all
sectors are being
incentivised to their use.

541L2-2 Anti-malware
softwares &network firewalls

541L1-3 Anti-malware
services by ISPs

ISPs may be offering
antimalware software aspart of their services but
possibly in an ad-hoc
manner.

541L2-3 Physical security
controls

541L1-4 ISPs' policies of ISPs recognise the need to 541L2-4 Established ISPs'
technical security establish policies forpolicies ofcontrol
technical security control
technical security
deployment as part of theircontrol
services.
541L1-5 IDS/IPS deployed Network Intrusion
541L2-5 Technical security
Detection Systems (NIDS)
controls based on
and Host Intrusioninternational
Detection Systems (HIDS)
frameworks
are deployed but notnecessarily in a consistentmanner.
551 Standards,
Organisations, andTechnologies

Cryptographic
Controls

Cryptographic
Controls

551L1-1 Cryptographic
Cryptographic controls forcontrols deployed protecting data at rest andin transit are recognised
and deployed ad-hoc bymultiple stakeholders andwithin various sectors.
551L1-2 TLS deployed

551L2-1 Cryptographic
controls widelyusedState of the art tools, such 551L2-2 Secure
as SSL or TLS, arecommunication
deployed ad-hoc by webservices
service providers to secure
all communications
between servers and webbrowsers.
551L2-3 Cryptographic
controls complied
to international
standards

551L2-4 TLS widespread

561 Standards,
Organisations, andTechnologies

Cybersecurity
Marketplace

Cybersecurity
Technologies

561L1-1 Domestic security The domestic market may 561L2-1 Domestic
products market provide non-specialised
providers ofcybersecurity products, but
security products
these are not marketdriven.
561L1-2 Cybersecurity
consideration indevelopment

158

Cybersecurity is considered 561L2-2 Loweringin software anddependency on
infrastructure development.
foreigncybersecurity
technologies

Appendix B
Level 3
Level 4
Details
ID
Keywords
Details
ID
Keywords
Details
Up-to-date technical
541L3-1 User side security Penetration of technical security
541L4-1 Continuous assess All sectors have the capacity tosecurity controls, including
controls
controls leads to effective upstreamof technicalcontinuously assess the security
patching and backups, areprotection of users andsecurity controls controls deployed for theirdeployed in all sectors.
public/private sectors.
effectiveness and suitability
according to their changing needs.
2

Users have an
541L3-2 Regular review of Within the public and private
understanding of thetechnical security sectors, technical security controls
importance of anti-malware
controls
are being kept up-to-date,
software and network
monitored for effectiveness andfirewalls across devices.
reviewed on a regular basis.

541L4-2 Business impact
by technicalsecurity controls
understood

The understanding of the technicalsecurity controls being deployedextends to its impact onorganisational operations andbudget allocation.

Physical security controls
are employed to prevent
unauthorized personnel
from entering computing
facilities.

541L4-3 Supplemental
security services
by ISPs

ISPs supplement technical security
controls with multi factor
authentication, digital certificatesand whitelisting to ensure
prevention of access of non-trusted
sites or web addresses and maintaina safe internet environment.

ISPs establish policies fortechnical security control
deployment as part of theirservices.
The technical cybersecurity
control set is based on
established cybersecurity
frameworks, such as the
SANS top 20 cybersecurity
controls, the CESG 10
steps to cybersecurity, orPAS 55.
Cryptographic techniques 551L3-1 Risk-based use of The public and private sectors
551L4-1 Regular review of The relevance of cryptographic
are available for all sectors
cryptographic
critically assess the deployment ofrelevance ofcontrols deployed for securing data
and users for protection ofcontrols
cryptographic controls, according tocryptographic
at rest and data in transit isdata at rest or in transit.
their objectives and priorities.
controls
continuously assessed through risk
assessments.
There is a broad
understanding of securecommunication services,such as encrypted/signed
email.

551L3-2 Regular review of The public and private sectors have 551L4-2 Revision of
cryptographic
developed encryption andcryptographic
control policies
cryptographic control policies based
control policies
on the previous assessment, andregularly review the policies for
effectiveness.

The public and private sector adapt
encryption and cryptographic
control policies based on theevolution of technologicaladvancement and changing threat
environment.

The cryptographic controls
deployed meet international
standards and guidelines
accordingly for each sector
and are kept up-to-date.
State of the art tools, such
as SSL or TLS, aredeployed routinely by webservice providers to secure
all communications
between servers and webbrowsers.
Cybersecurity products are 561L3-1 Security products
now being produced bycomplied todomestic providers inInternational
accordance with market
standards
needs.

Cybersecurity technology
development abides by secure
coding guidelines, good practices
and adhere to internationallyaccepted standards.

561L4-1 Automated
Security functions in software andsecurity functions computer system configurations areautomated in the development anddeployment of technologies.

National dependence on
561L3-2 Risk-based
foreign cybersecurity
producttechnologies is increasingly
development
mitigated through enhanced
domestic capacity.

Risk assessments and market
incentives inform the prioritisationof product development to mitigate
identified risks.

561L4-2 Exporting
superior security
products

Domestic cybersecurity products
are exported to other nations andare considered superior products.

159

Appendix B#

Category

562 Standards,
Organisations, andTechnologies

571 Standards,
Organisations, andTechnologies

Subcategory
Cybersecurity
Marketplace

Responsible
Disclosure

Level 1

Capacity area
Cyber Insurance

Responsible
Disclosure

ID
Keywords
562L1-1 Needs forcybersecurity
insurance
understoodLevel
Details
ID
Keywords
The need for a market in
562L2-1 Establishedcyber insurance has been
cybersecurity
identified through theinsurance market
assessment of financial
risks for public and private
sectors,

562L1-2 Development ofcybersecurity
insuranceand development of
products is now being
discussed.

562L2-2 Covering
additional costs(ex. Forensic
investigation etc.)

571L1-1 Information
sharing ofvulnerabilities

Technical details ofvulnerabilities are shared
informally with otherstakeholders who candistribute the information
more broadly.

571L2-1 Establishedvulnerability
disclosure
framework

571L1-2 Ability to address Software and service
vulnerability
providers are able toreports
address bug andvulnerability reports.

571L2-2 Establishedprocesses against
vulnerability
information

571L2-3 Non legal action

160

Appendix B
Level 3
Details
ID
Keywords
Details
A market for cyber
562L3-1 Covering various Cyber insurance specifies a variety
insurance is established andcosts
of coverages to mitigate
encourages informationconsequential losses.
sharing among participantsof the market.
2

Third-party insurance
covers liability and thecosts of forensic
investigations, customer
notification, credit
monitoring, public
relations, legal defence,compensation andregulatory fines.

Level 4ID
Keywords
Details
562L4-1 Innovative
The cyber insurance market iscybersecurity
innovative
insurance market

562L3-2 Choice ofcoverages

These coverages are selected based 562L4-2 Emerging risks & and adapts to emerging risks,
on strategic planning needs andvarious cyberstandards and practices, while
identified risk.
harmaddressing the full scope of cyberharm.

562L3-3 Cybersecurity
insurance
products for
SMEs

Products suitable for SMEs are also 562L4-3 Premium discount Insurance premiums are offered foron offer.
for secure
consistent cybersecure behaviour.
behaviour

A vulnerability disclosure 571L3-1 Establishedframework is in place,
responsible
which includes a disclosure
disclosure
deadline, scheduled
processes
resolution, and an
acknowledgement report.

Responsible disclosure processes
571L4-1 Regular review of Responsible disclosure policies arefor all involved stakeholders
vulnerability
continuously reviewed and updated(product vendors, customers,
disclosure policies based on the needs of all affected
security vendors and public) are set.
stakeholders.

Organisations haveestablished processes toreceive and disseminate
vulnerability information.

An analysis of the technical details 571L4-2 Internationallyof vulnerabilities is published andcontributing toadvisory information is
responsible
disseminated according todisclosure
individual roles and responsibilities.

Responsible disclosure frameworks
are shared internationally, so thatbest practice in this area can becreated.

The large majority of products andservices are updated withinpredetermined deadlines.

571L4-3 Deadlines of
update complied

All affected products and services
are routinely updated within
deadline.

571L4-4 Reviewing
process ofdeadlines

Processes are in place to review andreduce deadlines.

571L3-2 Analysis &dissemination
processes

Software and service
571L3-3 Deadlines ofproviders commit to refrain
updatefrom legal action against a
party disclosing
information responsibly.

161

Appendix C

Appendix C Japanese Cybersecurity Strategy【原文】サイバーセキュリティ2017
小項目

項番

大項目

中項目

7-111ア

経済社会の活力の向上及び持続的発展

安全なIoTシステムの 安全なIoTシステムを 内閣官房において、IoTシステムに係る新規事業がセキュリティ・バイ・デザインの考え方に創出活用した新規事業の 基づき取り組まれるよう、経費の見積もりの方針にこうした考え方を盛り込むとともに、各府振興
省庁等において、こうした考え方に基づく取組が行われるよう働きかけを引き続き行う。さらに着実にこの考え方に基づく取組が行われているか適時確認をする。

7-112ア

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 内閣官房において、IoTシステムに係る大規模な事業のサイバーセキュリティ確保のための創出
リティに係る体系及 取組について、サイバーセキュリティ戦略本部の下で検討を進めるとともに、IT総合戦略本び体制の整備部等においても現在検討が進められているIoTシステムに係る大規模な事業について、関係省庁が適切に協働し、セキュリティ・バイ・デザインの考え方に基づいて必要な対策が整合的かつ遺漏なく実施されていくよう働きかけを行う。さらに、その確認を適時確認していく。また、「安全なIoTシステムのためのセキュリティに関する一般的枠組」を踏まえつつ、官民の連携の下、安全なIoTシステムの創出に向けた取組を推進する。
↑

施策

7-112ア2 ↑↑7-112イ

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 内閣官房及び関係省庁において、サイバー環境をよりクリーンなものに保つため、官民が創出リティに係る体系及 連携して「ボット撲滅」に向けた体制を構築し対策を推進するための検討を行う。
び体制の整備

7-113ア

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 総務省及び経済産業省において、IoT推進コンソーシアムを通じて、IPA及びNICTと連携し創出
リティに係る制度整 つつ、IoTセキュリティガイドラインを様々な産業分野の標準仕様等に反映させるべく、普及
備展開に努めるとともに、IoTセキュリティに関する研究開発、実証実験、IoTセキュリティの確保に向けた総合的な対策及びIoT製品やシステムにおける「セキュリティ・バイ・デザイン」の国際的展開に向けた活動を行う。

7-113ア2 ↑↑7-113イ

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、IoTシステムの構成要素であるM2M機器等の制御システム向けのセ創出
リティに係る制度整 キュリティに係る認証制度であるEDSA認証（2014年４月開始）について、普及・啓発を行う
備とともに、制御システム全体のセキュリティ評価・認証の仕組みを検討する。

7-113ウ

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、JPCERT/CCを通じて、インターネット上の公開情報を分析し、国内創出
リティに係る制度整 の制御システム等で外部から悪用されてしまう危険性のあるシステムの脆弱性や設定の状
備況について、その保有組織に対して情報を提供する。

7-113エ 経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、IPA（受付機関）とJPCERT/CC（調整機関）により運用されている脆創出
リティに係る制度整 弱性情報公表に係る制度により、ソフトウェアに係る脆弱性について、「JVN」をはじめ、
備「JVNiPedia」（脆弱性対策情報データベース）や「MyJVN」などを通じて利用者に提供する。さらに、能動的な脆弱性の検出とその調整に関わる取組を行う。また、海外の調整機関や研究者とも連携し、国外で発見された脆弱性について、国内開発者との調整、啓発活動
をJPCERT/CCにおいて実施する。

7-114ア

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、AIST等を通じ、IoTシステムに付随する脅威に対応するため、ソフト創出
リティに係る技術開 ウェア工学、暗号技術などを用いてシステムのセキュリティ、品質、安全性、効率の向上、な発・実証
どを両立させるための革新的、先端的技術の基礎研究に取り組む。

7-114イ

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、IoTのセキュリティ対策等に関する研究開発を行う。
創出
リティに係る技術開発・実証

7-114ウ

経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 経済産業省において、制御システムのテスト環境を用いシステム全体の脅威分析、リスク評
創出
リティに係る技術開 価を行う技術開発を行う。
発・実証

7-114エ 経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 内閣府SIP（戦略的イノベーション創造プログラム）を中心に、経済産業省、総務省をはじめ創出
リティに係る技術開 とする関係省庁と連携し、自動車のセキュリティ上の課題について、車両レベル・コンポー
発・実証
ネントレベル、制御システム等の研究開発を推進する。

7-114オ 経済社会の活力の向上及び持続的発展

安全なIoTシステムの IoTシステムのセキュ 総務省において、「IoTセキュリティ対策の取組方針ver1.0」を踏まえ、既に流通している脆創出
リティに係る技術開 弱性を有するIoT機器のセキュリティ対策に取り組むとともに、今後製造するIoT機器のセ発・実証
キュリティ対策について検討を行う。

7-121ア

経済社会の活力の向上及び持続的発展

セキュリティマインド 経営層の意識改革を持った企業経営の推進

内閣官房において、関係府省庁と協力して、2016年に決定した「企業経営のためのサイ
バーセキュリティの考え方」を踏まえ、企業のサイバーセキュリティに係る取組について、現状の把握を行い、さらなるサイバーセキュリティ対策の推進に関する検討を行う。

7-121イ

経済社会の活力の向上及び持続的発展

セキュリティマインド 経営層の意識改革を持った企業経営の推進

経済産業省において、経営層がサイバーリスクを経営上の重要課題として把握し、設備投資、体制整備、人材育成等経営資源に係る投資判断を行い、組織能力の向上を図るために、説明会等を通じて、サイバーセキュリティ経営ガイドラインの普及を図る。

7-121ウ

経済社会の活力の向上及び持続的発展

セキュリティマインド 経営層の意識改革を持った企業経営の推進

経済産業省において、企業のサイバーセキュリティ対策を推進するため、サイバーセキュリ
ティ保険など、情報の保護が必要となる政府の補助事業や研究開発事業等の採択に際して、上記のサイバーセキュリティ経営ガイドラインや第三者認証取得など企業のサイバーセ
キュリティ対策への取組を、加点要素等として考慮する仕組みなどのインセンティブ策を検
討する。

162

↑

↑

↑

Appendix C("Cybersecurity 2017" itemised to action items)
Itemised
Strategy
Promoting New Business
Harnessing Secured IoT
Systems#
Category
7-111a Improvement of SocioEconomic Vitality andSustainable Development

Sub-category
Creation of Secured IoT
Systems

7-112a Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

7-112a2 Improvement of SocioEconomic Vitality andSustainable Development
7-112b Improvement of SocioEconomic Vitality andSustainable Development
7-113a Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

7-113a2 Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Considering Approaches
MIC,
for Enhanced IoT Systems METI,
Security
NICT,
IPA

Promoting "IoT Security Guidelines" asinternational standard.

7-113b Improvement of SocioEconomic Vitality andSustainable Development
7-113c Improvement of SocioEconomic Vitality andSustainable Development
7-113d Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Considering Approaches
for Enhanced IoT Systems
Security
Considering Approaches
for Enhanced IoT Systems
Security
Considering Approaches
for Enhanced IoT Systems
Security

METI

Promoting "EDSA certification" (security
certification for control systems).

METI,
JPCERT/CC

Analysing open source information & warningorganisations of vulnerable systems.

METI,
IPA,
JPCERT/CC

Continuing operation of reporting &
dissemination system for vulnerability
information.

7-114a Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Implementing
Technological
Development and
Demonstration Related to
IoT Systems Security

METI,
AIST

Researching innovative & advanced
technologies.

7-114b Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Implementing
Technological
Development and
Demonstration Related to
IoT Systems Security

METI

Researching technologies for security
countermeasures for IoTs.

7-114c Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Implementing
Technological
Development and
Demonstration Related to
IoT Systems Security

METI

Developing technologies of threat analysis & risk
evaluation for control systems.

7-114d Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Implementing
Technological
Development and
Demonstration Related to
IoT Systems Security

CabinetSecretariat,
METI,
MIC

Researching & developing technologies forautomotive security in "SIP: Cross-ministerial
Strategic Innovation Promotion Program".

7-114e Improvement of SocioEconomic Vitality andSustainable Development
7-121a Improvement of SocioEconomic Vitality andSustainable Development
7-121b Improvement of SocioEconomic Vitality andSustainable Development
7-121c Improvement of SocioEconomic Vitality andSustainable Development

Creation of Secured IoT
Systems

Considering Approaches
for Enhanced IoT Systems
Security
Changing the Thinking ofSenior Executive
Management
Changing the Thinking ofSenior Executive
Management
Changing the Thinking ofSenior Executive
Management

MIC

Promoting countermeasures against vulnerable
IoT products in the market based on "Policy for
IoT Security Countermeasures ver.1.0".
Surveying & promoting cybersecurity measuresof enterprises based on "Guidelines ofCybersecurity for Corporate Management".
Promoting "Cybersecurity Management
Guidelines".

Creation of Secured IoT
Systems
Creation of Secured IoT
Systems

Creation of Secured IoT
Systems
Creation of Secured IoT
Systems

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset

AgencyCabinetSecretariat

Action Item
Promoting 'Security-by-Design' in new businessharnessing IoT systems.

Improving Structural
Frameworks for IoT
Systems Security

CabinetSecretariat

Promoting 'Security-by-Design' in new & large
scale business harnessing IoT systems.

Improving Structural
Frameworks for IoT
Systems Security
Improving Structural
Frameworks for IoT
Systems Security
Considering Approaches
for Enhanced IoT Systems
Security

CabinetSecretariat

Promoting secure IoT systems based on "General
Framework for Secure IoT Systems".

CabinetSecretariat

Considering measures to exterminate 'bot-net'.

MIC,
METI,
NICT,
IPA

Promoting "IoT Security Guidelines".

CabinetSecretariat
METI

METI

Promoting cybersecurity insurance &"Cybersecurity Management Guidelines" byrequiring them in national tenders.

163Appendix C【原文】サイバーセキュリティ2017
小項目

項番

大項目

7-122ア

経済社会の活力の向上及び持続的発展

セキュリティマインド 経営能力を高めるサ 内閣官房において、サイバーセキュリティ人材育成プログラムを踏まえ、経営層、橋渡し人を持った企業経営の イバーセキュリティ人 材層、実務者層など、それぞれの人材層向けのさまざまな施策について連携を強化するこ推進材の育成とにより、より効果的かつ効率的に施策が進められるよう、施策間連携を図るためのワーキ
ンググループを通じ、モデルとなる具体的な人材育成のカリキュラムの策定等を行う。

7-123ア

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、JPCERT/CCを通じて、ソフトウェア製品や情報システムの開発段階において、製品開発者が情報セキュリティ上の観点から配慮すべき事項を、解説資料やセ
ミナーの形で公開し、普及を図る。

7-123イ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、営業秘密保護や事業継続性の観点からも経営層がサイバーリスク
を重要課題として把握し、人材育成等経営資源に係る投資判断を行い、組織能力の向上を図るために、説明会等を通じて、サイバーセキュリティ経営ガイドラインの普及を図る。またIPAを通じて、中小企業における情報セキュリティ対策の実施を促すため、説明会等において中小企業の情報セキュリティ対策ガイドラインの普及を図る。

7-123イ2 ↑↑↑7-123ウ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、情報システム開発・運用に係るサプライチェーン全体のセキュリティ向上のため、リスクの高い丸投げ下請や多様化するセキュリティ対策費用の増加に応じた
適切な価格設定に向け、セミナー等を通した下請ガイドラインの更なる浸透を図るとともに、業界団体と連携したフォローアップなどを実施し、情報システム開発・運用に係る取引の適正化を図る。

7-123エ 経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、JPCERT/CCを通じ、企業へのサイバー攻撃等への対応能力向上に向けて、国内における組織内CSIRT設立を促進・支援する。また、CSIRTの構築・運用に関するマテリアルや、インシデント対策・対応に資する脅威情報や攻撃に関する情報、所要の分析を加えた具体的な対策情報等を適切な者の間で共有することにより、CSIRTの普及や、国内外の組織内CSIRTとの間における緊急時及び平常時の連携の強化を図るとともに、巧妙かつ執拗に行われる標的型攻撃への対処を念頭においた運用の普及、連携を進める。

7-123オ 経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

総務省において、NICTに組織した「ナショナルサイバートレーニングセンター」を通じ、サイバー攻撃への対処能力の向上に向けた実践的サイバー防御演習（CYDER）を実施する。
また、2020東京オリンピック・パラリンピック競技大会に向けた大規模演習環境「サイバーコ
ロッセオ」を活用し、同大会のサイバーセキュリティを守る高度な人材の育成を推進する。

7-123オ2 ↑↑↑7-123カ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、重要インフラ企業等に対するサイバー攻撃への対処能力向上のた
め、模擬システム等を用いた実践的なサイバー演習を行う。

7-123キ経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、IPAを通じ、我が国経済社会に被害をもたらすおそれが強く、一組織で対処が困難なサイバー攻撃を受けた組織等を支援するため、「サイバーレスキュー隊（J-CRAT）」の活動を増強し、被害組織における迅速な対応・復旧に向けた計画作りを支援する。

7-123ク

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

金融庁において、参加金融機関および金融業界全体のセキュリティレベルの底上げを図る
ため、攻撃の実例分析を踏まえた金融業界横断的なサイバーセキュリティ演習を引き続き実施する。

7-123ケ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、IPAを通じ、ウェブアプリケーションの脆弱性を早期に発見し、対処に役立てるため、ログを解析し外部からの攻撃の痕跡を検査する「ウェブサイトの攻撃兆候
検出ツール」（iLogScanner）を企業のウェブサイト運営者等に提供する。

7-123コ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

経済産業省において、最新の脅威情報やインシデント情報等の共有のためIPAを通じ実施している「サイバー情報共有イニシアティブ」（J-CSIP）の運用を着実に継続し、より有効な活動に発展させるよう参加組織の拡大、共有情報の充実等、民民、官民における一層の情報共有網の拡充を進める。

7-123サ 経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

総務省において、ISP事業者やICTベンダー等を中心に構成されている「ICT-ISAC」を核として、国際連携を含めてサイバー攻撃に関する情報共有網の拡充を推進する。

7-123シ

経済社会の活力の向上及び持続的発展

セキュリティマインド 組織能力の向上を持った企業経営の推進

金融庁において、金融機関に対し、「金融ISAC」を含む情報共有機関等を通じた情報共有網の拡充を進める。

7-131ア

経済社会の活力の向上及び持続的発展

セキュリティに係るビ サイバーセキュリティ 経済産業省において、一定のセキュリティ品質を有するセキュリティサービスを認定する体
ジネス環境整備
関連産業の振興制を整備することにより競争力強化や活用促進を図るなど、サイバーセキュリティの成長産業化に取り組む。

7-131イ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ サイバーセキュリティ 総務省及び経済産業省において、クラウドセキュリティガイドライン、クラウドセキュリティ監
ジネス環境整備
関連産業の振興
査制度等の普及促進を行う。

7-131ウ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ サイバーセキュリティ 経済産業省において、中小企業における情報セキュリティ投資を促進するための施策を推
ジネス環境整備
関連産業の振興進する。

7-131エ 経済社会の活力の向上及び持続的発展

セキュリティに係るビ サイバーセキュリティ 文部科学省において、著作権法におけるセキュリティ目的のリバースエンジニアリングに関ジネス環境整備
関連産業の振興する適法性の明確化に関する措置を速やかに講ずる。

7-132アセキュリティに係るビ 公正なビジネス環境 経済産業省において、産業界及び関係省庁と連携し、企業情報の漏えいに関して、サイジネス環境整備の整備
バー攻撃など今後ますます高度化・複雑化が予想される最新の手口や被害実態などの情報の共有を行う場として、「営業秘密官民フォーラム」を開催する。

164

経済社会の活力の向上及び持続的発
展

中項目

↑

↑

施策

Appendix C
Itemised
Strategy
Fostering Cybersecurity
Workforce for Advanced
Business Management#
Category
7-122a Improvement of SocioEconomic Vitality andSustainable Development

Sub-category
Promotion of EnterpriseManagement with a
Security Mindset

AgencyCabinetSecretariat

7-123a Improvement of SocioEconomic Vitality andSustainable Development
7-123b Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
METI,
Organizational Capabilities JPCERT/CC

Promoting 'Security-by-Design'.

Strengthening
same as 7Organizational Capabilities 121c2

same as 7-121c2

7-123b2 Improvement of SocioEconomic Vitality andSustainable Development
7-123c Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
METI,
Organizational Capabilities IPA

Promoting "Cybersecurity Management
Guidelines" to SMEs (small-to medium-sizedenterprises).
Reviewing rules & regulations so as to improvesecurity of whole supply chains of IT
development & operation.

7-123d Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
METI,
Organizational Capabilities JPCERT/CC

Encouraging corporates to establish CSIRT.

7-123e Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
MIC,
Organizational Capabilities NICT

Performing practical cyber defence exercise"CYDER" at "National Cyber Training Center".

7-123e2 Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
MIC,
Organizational Capabilities NICT

Performing cyber exercises assuming attacks
against Tokyo Olympics/Paralympics in 2020,
employing large scale exercise environment"Cyber Colosseo".

7-123f Improvement of SocioEconomic Vitality andSustainable Development
7-123g Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
METI
Organizational Capabilities

Performing practical APT exercises.

Strengthening
METI,
Organizational Capabilities IPA

Enhancing "J-CRAT: Cyber Rescue Team"(activity to assist organisational incident
responses).

7-123h Improvement of SocioEconomic Vitality andSustainable Development
7-123i Improvement of SocioEconomic Vitality andSustainable Development
7-123j Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset

Strengthening
FSA
Organizational Capabilities

Performing financial industry-wide cyber
exercises.

Strengthening
METI,
Organizational Capabilities IPA

Promoting "iLogScanner: Attack Indication
Detecting Tool for Websites".

Strengthening
METI
Organizational Capabilities

Continuing & enhancing operation of "J-CSIP:
Cyber Intelligence Sharing Initiative".

7-123k Improvement of SocioEconomic Vitality andSustainable Development
7-123l Improvement of SocioEconomic Vitality andSustainable Development
7-131a Improvement of SocioEconomic Vitality andSustainable Development
7-131b Improvement of SocioEconomic Vitality andSustainable Development
7-131c Improvement of SocioEconomic Vitality andSustainable Development
7-131d Improvement of SocioEconomic Vitality andSustainable Development
7-132a Improvement of SocioEconomic Vitality andSustainable Development

Promotion of EnterpriseManagement with a
Security Mindset
Promotion of EnterpriseManagement with a
Security Mindset
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment

Strengthening
MIC
Organizational Capabilities

Continuing & enhancing operation of "ICTISAC" (expanded & reorganised from TelecomISAC).
Enhancing "Financial ISAC Japan".

Strengthening
METI
Organizational Capabilities

Strengthening
FSA
Organizational Capabilities

Action Item
Promoting human resources development foreach category - board members, bridge personnel& working-level - based on "Cybersecurity
Human Resources Development Program".

Promoting Cybersecurityrelated Businesses

METI

Cultivating cybersecurity-related business to a
growth industry by establishing certification for
security services.
Promoting "Cloud Security Guidelines" &"Cloud Audit System".

Promoting Cybersecurityrelated Businesses

MIC,
METI

Promoting Cybersecurityrelated Businesses

METI

Promoting security investment of SMEs (small-to
medium-sized enterprises).

Promoting Cybersecurityrelated Businesses

MEXT

Reconsidering "Copyright Act" about reverse
engineering for security purposes.

Developing Fair Business
Environment

METI

Continuing "Public & Private Sectors Forum for
Trade Secret" to share information about
information exfiltration.

165

Appendix C【原文】サイバーセキュリティ2017
小項目

項番

大項目

7-132イ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 公正なビジネス環境 経済産業省において、企業の情報漏えいの防止に資するため、「秘密情報の保護ハンド
ジネス環境整備の整備
ブック～企業の価値向上に向けて～」及び「秘密情報の保護ハンドブックのてびき～情報管理も企業力～」についての普及啓発を図る。

7-132ウ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 公正なビジネス環境 経済産業省において、IPAを通じ、営業秘密保護に関する対策等を推進するため、組織に
ジネス環境整備の整備
おける内部不正防止のためのガイドラインの普及促進を図る。

7-132エ 経済社会の活力の向上及び持続的発展

セキュリティに係るビ 公正なビジネス環境 経済産業省及び外務省において、情報セキュリティなどを理由にしたローカルコンテント要
ジネス環境整備の整備
求、国際標準から逸脱した過度な国内製品安全基準、データローカライゼーション規則
等、我が国企業が経済活動を行うに当たって貿易障壁となるおそれのある国内規制（「Forced Localization Measures」）を行う諸外国に対し、対話や意見交換を通じ、当該規制が自由貿易との間でバランスがとれたものとなるよう、民間団体とも連携しつつ働きかけを行う。

7-133ア

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 総務省及び経済産業省において、専門機関と連携し、情報セキュリティ分野の国際標準化
ジネス環境整備展開のための環境整 活動であるISO/IEC JTC1/SC27、ITU-T SG17等が主催する国際会合等に参加し、我が備国の研究開発成果やIT環境・基準・ガイドライン等を踏まえて国際標準化を推進する。

7-133イ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、IPAを通じ、情報セキュリティ分野と関連の深い国際標準化活動でジネス環境整備展開のための環境整 あるISO/IEC JTC1/SC27が主催する国際会合等へ機構職員を派遣し、暗号技術、暗号・備
セキュリティ製品やモジュールの認証等の国際標準化において、国内の意見が反映される
よう活動する。

7-133ウ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、情報システム等がグローバルに利用される実態に鑑み、IPA等を通
ジネス環境整備展開のための環境整 じ、脆弱性対策に関するSCAP、CVSS等の国際的な標準化活動等に参画し、情報システム
備等の国際的な安全性確保に寄与する。

7-133エ 経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、IPAを通じ、CCRAなどの海外連携、セキュリティ評価に係る国際基
ジネス環境整備展開のための環境整 準の作成や各国の情報収集を行うとともに、安全な政府調達のための国際共通プロテク
備ション・プロファイル（PP）の開発、情報収集を実施する。

7-133オ 経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、アジアでの更なる情報セキュリティ人材の育成を図るため、アジア12
ジネス環境整備展開のための環境整 か国・地域と相互・認証を行っている「情報処理技術者試験」について、我が国の情報処理
備
技術者試験制度を移入して試験制度を創設した国（フィリピン、ベトナム、タイ、ミャンマー、
マレーシア、モンゴル、バングラデシュ）が協力して試験を実施するための協議会である
ITPECがアジア統一試験を実施しているところ、ITPECの更なる定着を図る。

7-133カ

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、今後、ますますの経済連携が求められるASEAN各国において、我ジネス環境整備展開のための環境整 が国企業が安全に活動でき、また、我が国の持つノウハウをASEAN諸国と共有できるよう、
備
セキュリティマネジメント導入のためのノウハウ支援等を行う。

7-133キ経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、JPCERT/CCを通じて、我が国企業が組込みソフトウェア等の開発を
ジネス環境整備展開のための環境整 アウトソーシングしている先のアジア地域の各国を中心に、脆弱性を作りこまないコーディン
備
グ手法に関する技術セミナーを実施する。

7-133ク

経済社会の活力の向上及び持続的発展

セキュリティに係るビ 我が国企業の国際 経済産業省において、IoTシステムセキュリティの国際標準規格を視野に入れた認証制度
ジネス環境整備展開のための環境整 にかかる評価・検討を行う。
備

7-211ア

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、JPCERT/CCを通じて、ソフトウェア製品や情報システムの開発段階において、製品開発者が情報セキュリティ上の観点から配慮すべき事項を、解説資料やセ
ミナーの形で公開し、普及を図る。

7-211イ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、IPAを通じ、IoT機器、サービスを支える組込み産業の高度化に向け、産業動向の把握・分析を行うとともに、「セキュリティ・バイ・デザイン」の産業展開の観点から、セキュリティとセーフティ設計プロセスの整合化やシステムアプローチによるセキュリ
ティ分析手法の検討を進め、組込みコーディングスタンダードの整備普及を図る。

7-211ウ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、IPAを通じ、ウェブサイト運営者や製品開発者が脆弱性対策の必要性及び対策手法等を自ら学習することを支援するため、「安全なウェブサイトの作り方」を引き続き公開するとともに、体験的かつ実践的に学ぶツール「AppGoat」についてセミナー等を開催することで更なる普及啓発を図る。

↑↑

7-211エ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、IPAを通じ、情報処理システムや組込みシステム等におけるソフト
ウェアの不具合や脆弱性が社会に与える混乱や被害を防止する観点から、企画・設計段
階からセキュリティ配慮が行われるようIoTセキュリティガイドラインの普及・国際標準化の取り組みを進めるとともに、ソフトウェアによって中核機能が実現される製品、システム及びサービスについて第三者がその安全性・信頼性等を利用者に対し十分に説明できるよう、
設計プロセス・利用時体験・流通するデータ等多面的な観点から利用者への品質説明力を強化する。

7-211エ2 ↑↑↑↑7-211エ3 ↑↑↑↑7-211オ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、経済産業省告示に基づき、IPA（受付機関）とJPCERT/CC（調整機関）により運用されている脆弱性情報公表に係る制度を着実に実施するとともに、関係者との連携を図りつつ、「JVNiPedia」（脆弱性対策情報データベース）や「MyJVN」の運用など
により、脆弱性関連情報をより確実に利用者に提供する。

7-211カ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、JPCERT/CCを通じて、ソフトウェア等の脆弱性に関する情報を、マネジメントツールが自動的に取り込める形式で配信する等、ユーザー組織における、ソフト
ウェア等の脆弱性マネジメントの重要性の啓発活動及び脆弱性マネジメント支援を実施する。

7-211キ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、IPAを通じ、情報システムの脆弱性に対して、プロアクティブに脆弱性を検出する技術の普及・啓発活動を行う。

7-211ウ2 ↑

166

中項目

↑

施策

Appendix C
Itemised
Strategy
Developing Fair Business
Environment

AgencyMETIDeveloping Fair Business
Environment

METI,
IPA

Action Item
Promoting "Handbook for Confidential
Information Protection" & "Guide for Handbook
for Confidential Information Protection".
Promoting guidelines for deterrence/preventionof internal misconduct within organisations.

Developing Fair Business
Environment

METI,
MOFA

Communicating & negotiating with countries
who apply 'Forced Localization Measures'.

Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment

Improving Environment for MIC,
Japanese Enterprises’
METI
Global Operations
Improving Environment for METI,
Japanese Enterprises’
IPA
Global Operations

Supporting international standardization insecurity through participation to ISO/IEC
JTC1/SC27, ITU-T SG17 etc.
Supporting international standardization in
cryptography, certification for cryptograph &security products.

Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment

Improving Environment for METI,
Japanese Enterprises’
IPA
Global Operations
Improving Environment for METI,
Japanese Enterprises’
IPA
Global Operations
Improving Environment for METI
Japanese Enterprises’
Global Operations

Supporting international standardization invulnerability management like SCAP, CVSS etc.

#
Category
7-132b Improvement of SocioEconomic Vitality andSustainable Development
7-132c Improvement of SocioEconomic Vitality andSustainable Development
7-132d Improvement of SocioEconomic Vitality andSustainable Development

Sub-category
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment
Improvement ofCybersecurity Business
Environment

7-133a Improvement of SocioEconomic Vitality andSustainable Development
7-133b Improvement of SocioEconomic Vitality andSustainable Development
7-133c Improvement of SocioEconomic Vitality andSustainable Development
7-133d Improvement of SocioEconomic Vitality andSustainable Development
7-133e Improvement of SocioEconomic Vitality andSustainable Development

7-133f Improvement of SocioEconomic Vitality andSustainable Development
7-133g Improvement of SocioEconomic Vitality andSustainable Development
7-133h Improvement of SocioEconomic Vitality andSustainable Development
7-211a Building a Safe and Secure
Society for the People

Supporting international standardization insecurity evaluation like PP (Protection Profile)etc.
Assisting ITPEC (IT Professionals Examination
Council: organisation for a common IT
examination in Asian countries) by 'exporting'"Japan Information-Technology Engineers
Examination".

Improvement of
Improving Environment for METI
Cybersecurity BusinessJapanese Enterprises’
Environment
Global Operations
Improvement of
Improving Environment for METI,
Cybersecurity BusinessJapanese Enterprises’
JPCERT/CC
Environment
Global Operations
Improvement of
Improving Environment for METI
Cybersecurity BusinessJapanese Enterprises’
Environment
Global Operations
Measures for the Protection Building a Safe and Secure Same as 7of the People and Society Cyber Environment for
123b
Users
7-211b Building a Safe and Secure Measures for the Protection Building a Safe and Secure METI,
Society for the Peopleof the People and Society Cyber Environment for
IPA
Users

Assisting security management in ASEAN
countries.

7-211c Building a Safe and Secure Measures for the Protection Building a Safe and Secure METI,
Society for the Peopleof the People and Society Cyber Environment for
IPA
Users

Promoting "How to Secure Your Web Site".

7-211c2 Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211d Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users

METI,
IPA

Promoting "AppGoat" (training tool for securedevelopment).

METI,
IPA

Researching technologies for securer
development & more sophisticated evaluation.

7-211d2 Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211d3 Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211e Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users

Same as 7113a3

Same as 7-113a3

Same as 7113a4

Same as 7-113a4

Same as 7113h

Same as 7-113h

Assisting establishment of 'secure development'in countries where Japanese corporates outsource
software development.
Researching international standards & evaluation
system for IoT systems.
Same as 7-123b

Promoting 'Security-by-Design' in IoT &embedded systems.

7-211f Building a Safe and Secure Measures for the Protection Building a Safe and Secure METI,
Society for the Peopleof the People and Society Cyber Environment for
JPCERT/CC
Users

Supporting vulnerability management inorganisations, by promoting structured languages
for vulnerability information.

7-211g Building a Safe and Secure Measures for the Protection Building a Safe and Secure METI,
Society for the Peopleof the People and Society Cyber Environment for
IPA
Users

Promoting 'fuzz testing' for pro-active
vulnerability detection.

167

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-211ク

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

総務省において、NICTを通じ、運用するサイバー攻撃観測網（NICTER）について、センサーの高度化等による観測機能の強化を図るとともに、NISCをはじめとする政府機関等への情報提供等を通じた連携強化を図る。

7-211ケ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

総務省において、高度化・巧妙化するマルウェアの被害を防止するため、マルウェアに感染したユーザーを検知し、マルウェアの除去を促す取組（感染駆除）及び閲覧することでマルウェアに感染する悪性サイトへアクセスする利用者に注意喚起を行う取組（感染防止）等を行う実証（ACTIVE）を引き続き実施する。

7-211コ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、JPCERT/CCがインシデント対応支援活動等において解析したマルウェア検体及びその解析結果について、同様の情報を有する国内外の関係機関との適切な相互共有やインターネット定点観測システム（TSUBAME）の運用との連動等の有効活用
やその高度化を進める。

7-211サ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、フィッシング対策協議会及びJPCERT/CCを通じてフィッシングに関するサイト閉鎖依頼その他の対策実施に向けた取組等を実施する。

7-211シ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

経済産業省において、IPAを通じ、ソフトウェア等の脆弱性に関する情報をタイムリーに発信するサイバーセキュリティ注意喚起サービス「icat」を提供する。また、各種セミナーやイベントで利用方法を紹介することにより「icat」の普及を図る。

7-211ス

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

警察庁において、公衆無線LANを悪用したサイバー犯罪に対する事後追跡可能性の確保に必要な対策が適切に講じられるよう、必要な対応を行う。

7-211セ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

総務省において、安全に無線LANを利用できる環境の整備に向けて、利用者及びアクセス
ポイント設置者において必要となるセキュリティ対策に関する検討を行うとともに、利用者及びアクセスポイント設置者に対する周知啓発を実施する。

7-211ソ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

安全・安心なサイバー空間の利用環
境の構築

内閣官房及び関係省庁において、サイバー空間を安全に利用でき、また安全に発展させるよう、サイバーインシデント情報やその脅威情報を分析し、民間等の関係主体と共有することで着実にそのインシデント等への対応に繋げるため、情報共有・連携ネットワーク（仮称）の構築・運用に向けた検討を進める。

7-212ア

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 内閣官房において、「新・情報セキュリティ普及啓発プログラム」の改訂を行うとともに、同プの取組の促進ログラムに基づき、各府省庁や民間の取組主体と協力して、「サイバーセキュリティ月間」をはじめとし、サイバーセキュリティに関する各種イベント等の開催を通じ普及啓発活動を進める。

7-212イ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 警察庁及び都道府県警察において、教育機関、地方公共団体職員、インターネットの一般の取組の促進利用者等を対象として、情報セキュリティに関する意識・知識の向上、サイバー犯罪による被害の防止等を図るため、サイバー犯罪の現状や検挙事例、スマートフォン等の情報端末
やSNS等の最新の情報技術を悪用した犯罪等の身近な脅威等について、ウェブサイトへの掲載、講演の全国的な実施等による広報啓発活動を実施するほか、関係省庁との連携によるスマートフォンに関する青少年に対する有害環境対策の徹底等、スマートフォンの安全利用のための環境整備に向けた取組を実施する。

7-212イ2 ↑7-212ウ↑↑↑

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 総務省、法務省及び経済産業省において、電子署名の利活用に関するセミナーの開催及の取組の促進びHPを活用した電子署名の利活用策に関する情報提供を行うことで、国民による安全なサ
イバー空間の利用をサポートするとともに、認定認証事業者に対する説明会の開催、民間事業者等からの電子署名に関する相談対応等を行うことで、企業における電子署名の利活用の普及促進策を検討・実施する。

7-212エ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 総務省において、文部科学省と協力し、青少年やその保護者のインターネットリテラシー向の取組の促進上を図るため、多くの青少年が初めてスマートフォン等を手にする春の卒業・進学・新入学の時期に特に重点を置き、関係府省庁と協力して啓発活動を集中的に展開する「春のあんしんネット・新学期一斉行動」の取組や、「e-ネットキャラバン」等の青少年や保護者等に向けた啓発講座の実施等を行う。また、「インターネットトラブル事例集」の作成や「情報通信の安心安全な利用のための標語」の募集等を通し、インターネット利用における注意点に関する周知啓発の取組を行う。

7-212オ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 文部科学省において、2015年度に作成した動画教材や指導手引書も活用して、学校におの取組の促進ける情報モラル教育の充実を図るため、指導主事、教員等を対象としたセミナー及びフォーラムを実施する。

7-212カ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 文部科学省において、全国の学校へ配布する普及啓発資料の作成や、ネットモラルキャラの取組の促進バン隊を通じ、スマートフォン等によるインターネット上のマナーや家庭でのルールづくりの重要性の普及啓発を実施する。

7-212キ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、個人情報も含む情報漏えい対策に取り組むため、IPAを通じ、ファイの取組の促進ル共有ソフトによる情報漏えいを防止する等の機能を有する「情報漏えい対策ツール」を民間の配布サイトも活用して一般国民に提供する。

7-212ク

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じ、各府省庁と協力し、情報モラル/セキュリティの大切さをの取組の促進児童・生徒が自身で考えるきっかけとなるように、IPA主催の標語・ポスター・４コマ漫画等の募集及び入選作品公表を行い、国内の若年層における情報モラル/セキュリティ意識の醸成と向上を図る。

7-212ケ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 内閣官房において、主体的に普及啓発活動を行う動きが地域レベルでも促進されるよう、の取組の促進「情報セキュリティ社会推進協議会」等を活用しつつ、産学官民の連携・協力を通じて、必要な取組について検討を進める。

7-212コ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じ、各府省庁と協力し、家庭や学校からインターネットを利の取組の促進用する一般の利用者を対象として情報セキュリティに関する啓発を行う安全教室について、全国各地の関係団体と連携し引き続き開催していく。

7-212サ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じ、広く企業及び国民一般に情報セキュリティ対策を普及の取組の促進するため、地域で開催されるセミナーや各種イベントへの出展、普及啓発資料の配布、セキュリティプレゼンター制度の運用などにより情報の周知を行い、セキュリティ啓発サイトや各種ツール類を用いて、対策情報の提供を行う。

168

Appendix C
Itemised#
Category
Sub-category
Strategy
Agency7-211h Building a Safe and Secure Measures for the Protection Building a Safe and Secure MIC,
Society for the Peopleof the People and Society Cyber Environment for
NICT
Users
7-211i Building a Safe and Secure Measures for the Protection Building a Safe and Secure MIC
Society for the Peopleof the People and Society Cyber Environment for
Users

Action Item
Upgrading "NICTER: Network Incident Analysis
Center for Tactical Emergency Response".
Continuing operation of "ACTIVE: Advanced
Cyber Threat Response Initiative" (assistance forusers to disinfect malwares from compromised
PCs).

7-211j Building a Safe and Secure Measures for the Protection Building a Safe and Secure METI,
Society for the Peopleof the People and Society Cyber Environment for
JPCERT/CC
Users

Continuing operation of "TSUBAME" (Asia &Pacific region internet fixed point observation
system).

7-211k Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211l Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211m Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211n Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users
7-211o Building a Safe and Secure Measures for the Protection Building a Safe and Secure
Society for the Peopleof the People and Society Cyber Environment for
Users

METI,
JPCERT/CC

Continuing operation of "Council of AntiPhishing Japan".

METI,
IPA

Promoting "icat: IPA Cyber Security Alert
Service".

NPA

Urging public Wi-Fi service providers to prevent
cybercrime & to enable effective tracking back.

MIC

Initiating Wi-Fi service providers & users tosafer communication.

CabinetSecretariat

Considering development of intelligence sharing
platform for government & private sectors.

7-212a Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

CabinetSecretariat

Initiating users to security in cyber space.

7-212b Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

NPA,
MPD,
Prefectural
Polices

Initiating users to secure use of internet,
protection from cybercrimes, latest criminal
techniques & safety on smartphones.

7-212b2 Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

NPA,
MPD,
Prefectural
Polices

Initiating educators & staff of local public
entities to elimination of cyber environment thatis harmful to youth.

7-212c Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

MIC,
MOJ,
METI

Promoting use of electronic signature.

7-212d Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

MIC,
MEXT

Initiating youth to secure use of internet &smartphones.

7-212e Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212f Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212g Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212h Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

MEXT

Continuing moral education for information
usage at school.

MEXT

Continuing promotion of moral education forinternet usage.

METI,
IPA

Promoting "Information Leakage Prevention
Tool" (tool to prevent data exfiltration throughfile sharing softwares).
Arousing security awareness of youth.

7-212i Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212j Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212k Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

CabinetSecretariat

Assisting local public entities to raise publicawareness of security.

METI,
IPA

Continuing "Safety Class" to raise publicawareness of secure internet usage.

METI,
IPA

Assisting local public entities to raise publicawareness of security.

METI,
IPA

169

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-212シ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じ、中小企業における情報セキュリティ教育担当者や中小の取組の促進企業を指導する立場にある者等を対象とした「中小企業情報セキュリティ講習講師養成セミ
ナー」を実施するとともに、中小企業団体等との連携により、当該団体等が主催する情報セ
キュリティ対策セミナーに協力する取組を実施することで、中小企業のセキュリティレベルの向上、IPA等の作成する啓発資料や情報セキュリティ対策支援サイト等のツール等の利用促進等を図る。

7-212ス

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPA、JPCERT/CCを通じて、情報漏えいの新たな手法や手口の情の取組の促進報収集に努め、一般国民や中小企業等に対し、ウェブサイトやメーリングリスト等を通じて対策情報等、必要な情報提供を行う。

7-212セ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じ、「情報セキュリティ安心相談窓口」、さらに、高度なサイの取組の促進バー攻撃を受けた際の「標的型サイバー攻撃の特別相談窓口」によって、サイバーセキュリ
ティ対策の相談を受け付ける体制を充実させ、一般国民や中小企業等の十分な対策を講じることが困難な組織の取組を支援する。

7-212ソ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 経済産業省において、IPAを通じて、サイバーセキュリティに関する現状把握及び対策を実の取組の促進施する際の参考となる最新の動向の収集・分析・報告書の公表等により、サイバー空間利
用者への啓発を推進する。

7-212タ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 文部科学省において、大学等における多岐にわたる情報資産や多様なシステムの利用実の取組の促進態といった特性を踏まえ、大学等のマネジメント面・技術面の取組の強化を促進するとともに、大学等の自律的活動の向上に向けた取組を促す。また、情報セキュリティ対策を支える制度面に係る枠組みを整備し、これら取組を支援する。

7-212チ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー空間利用者 個人情報保護委員会において、関係省庁と協力し、2017年5月30日に全面施行された改の取組の促進
正個人情報保護法を踏まえ、個人情報取扱事業者における、外部からの不正アクセス等
による個人データの漏えい等にかかる対応が適切に実施されるよう、情報セキュリティ関係
機関と連携して取り組む。

7-213ア

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、新たな手口の不正アクセスや不正プログラム（スマートフォン等を狙った
策
ものを含む。）の悪用等急速に悪質巧妙化するサイバー犯罪の取締りを推進するため、サイバー犯罪捜査に従事する全国の警察職員に対する部内研修及び民間企業への講義委
託の積極的な実施、官民人事交流の推進、技術的に高度な民間資格の活用等、サイバー犯罪への対処態勢を強化する。

7-213イ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、サイバー空間の脅威に対処するため、日本版NCFTAである一般財団法策人日本サイバー犯罪対策センター（JC3）や、都道府県警察と関係事業者から成る各種協
議会等を通じた産学官連携を促進するとともに、総合セキュリティ対策会議等において官民連携による取組を推進する。

7-213ウ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁、総務省及び経済産業省において、不正アクセス行為の禁止等に関する法律に基策
づき、不正アクセス行為、フィッシング行為、他人の識別符号を不正に取得・保管する行為等の取締りを強化するとともに、事業者団体に対する不正アクセス行為の手口に関する最新情報の提供や、不正アクセス行為の発生状況及びアクセス制御機能に関する研究開発の状況の公表等を通じ、不正アクセス行為からの防御に関する啓発及び知識の普及を図るなど、官民連携した不正アクセス防止対策を更に推進する。

7-213ウ2 ↑↑↑↑7-213エ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、サイバー空間における犯罪被害防止のための教育等のボランティア活策
動の促進を図るため、サイバー防犯ボランティアの結成を促すとともに活動の支援を強化することにより、安全で安心なインターネット空間の醸成に向けた取組を推進する。

7-213オ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、スマートフォン利用者等を狙ったサイバー犯罪に関し、情報セキュリティ
策
関連事業者等との連携強化による情報集約等に努め、取締りの強化を図る。また、取締りにより判明した実態等を踏まえ、一般利用者等の情報セキュリティ対策の向上に資する情報発信等を推進する。

7-213カ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、警察大学校サイバーセキュリティ対策研究・研修センターを通じ、サイ策
バー犯罪等の取締りのための情報技術の解析に関する研究及びサイバー犯罪等の取締りに必要な専門的知識・技術に関する研修を実施する。

7-213キ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 経済産業省において、フィッシング詐欺被害の抑制のため、フィッシング対策協議会を通じ策て、海外、特に米国を中心として大きな被害を生んでいるフィッシング詐欺に関する事例情
報、技術情報の収集及び提供を行う。

7-213ク

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁において、全国の情報技術解析部門で効果的かつ効率的な解析を推進することに策
より、多様化・複雑化が著しいサイバー犯罪に的確に対処する。また、家電、電気メー
ター、自動車等の日常生活に近い機器に係るオンライン化等の新たな技術やサービスの開発が次々に進められている背景を踏まえ、デジタルフォレンジックに係る対処能力をより一層強化する。

7-213ケ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 法務省において、検察官及び検察事務官が、複雑・巧妙化するサイバー犯罪に適切に対策処するため、捜査上必要とされる知識と技能を習得できる研修を全国規模で実施し、捜査能力の充実を図る。

7-213コ

国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 検察当局及び都道府県警察において、サイバー犯罪に適切に対処するとともに，サイバー策
犯罪に関する条約を締結するための「情報処理の高度化等に対処するための刑法等の一部を改正する法律」（サイバー刑法）の適正な運用を実施する。

170

Appendix C
Itemised#
Category
Sub-category
Strategy7-212l Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

AgencyMETI,
IPA

Action Item
Supporting SMEs (small-to medium-sizedenterprises) to enhance security by training
security personnel in SMEs & counsellors forSMEs.

7-212m Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212n Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

METI,
IPA,
JPCERT/CC
METI,
IPA

Providing public & SMEs (small-to mediumsized enterprises) with intelligence of security
incidents & countermeasures.
Supporting incident response of public & SMEs
(small-to medium-sized enterprises) through"Information Security Consultation Counter" &"APT Special Consultation Counter".

7-212o Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-212p Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

METI,
IPA

Collecting, analysing & reporting cybersecurity
information.

MEXT

Urging universities to enhance information
security.

7-212q Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

PPC

Taking course of action to implement newly
effected "Amended Act on the Protection of
Personal Information".

7-213a Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA

Strengthening capability of investigation of
cybercrime.

7-213b Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA

Enhancing cooperation between public, private &academic sectors, with "JC3: Japan Cybercrime
Control Center" (Japanese version of NCFTA(National Cyber-Forensics & Training Alliance)
playing the central role.

7-213c Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA,
MIC,
METI

Strengthening capability of investigation ofunauthorized access, phishing & illegal
acquisition/retention of third party IDs.

7-213c2 Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA,
MIC,
METI
NPA

Providing corporates with intelligence of latest
criminal techniques, etc.

7-213e Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA

Strengthening capability of investigation ofcrimes targeting smartphone users.

7-213f Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA,
Training investigators specialized in cybercrime.
NPAc
Research andTraining
Center for
Cybersecurity
Countermeasu
res7-213g Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

METI,

7-213h Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA

7-213i Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

MOJ

Training prosecutors for cybercrimes.

7-213j Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

MOJ,
NPA,
Prefectural
PoliceTaking a course of action against cybercrimes
upon effectuation of "Cyber Criminal Law".

7-213d Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

Supporting establishment of anti-cybercrimevoluntary corps.

Collecting & disseminating information aboutphishing through operation of "Council of AntiPhishing Japan".
Making the most of High-Tech Crime
Technology Division to tackle complicated &diversified cybercrimes.

171

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-213サ 国民が安全で安心し 国民・社会を守るたて暮らせる社会の実 めの取組
現

サイバー犯罪への対 警察庁及び総務省において、安全・安心なサイバー空間を構築するため、通信履歴等に策関するログの保存の在り方については、「電気通信事業における個人情報保護に関するガ
イドライン」の解説を踏まえ、関係事業者における適切な取組を推進するなど必要な対応を行う。

7-213サ2 ↑↑↑↑7-220ア

国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

内閣官房及び重要インフラ所管省庁等において、「重要インフラの情報セキュリティ対策に係る第４次行動計画」に基づき、安全基準等の整備及び浸透、情報共有体制の強化、障害対応体制の強化、リスクマネジメント、防護基盤の強化の５つの施策を実施する。
・ 「安全基準等の整備及び浸透」については、重要インフラ各分野に横断的な指針の策定とそれに基づく、各分野の「安全基準」等の整備・浸透を促進する。
・ 「情報共有体制の強化」については、連絡形態の多様化や共有情報の明確化等による官民・分野横断的な情報共有体制の強化を行う。
・ 「障害対応体制の強化」については、官民が連携して行う演習等の実施、演習・訓練間の連携による重要インフラサービス障害対応体制の総合的な強化を行う。
・ 「リスクマネジメント及び対処態勢の整備」については、リスク評価やコンティンジェンシー
プラン策定等の対処態勢の整備を含む包括的なマネジメントの支援を行う。
・ 「防護基盤の強化」については、重要インフラに係る防護範囲の見直し、広報広聴活動、
国際連携の推進、経営層への働きかけ、人材育成等を推進する。

7-220イ

国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

重要インフラ事業者等及び重要インフラ所管省庁は、重要インフラ全体の防護能力の維持・向上を目的とし、各重要インフラ事業者等の対策の経験から得た知見等をもとに、継続的に安全基準等を改善する。加えて、内閣官房及び重要インフラ所管省庁は、情報セキュ
リティを更に高めるため、安全等を維持する観点から必要に応じて、情報セキュリティ対策
を関係法令等における保安規制として位置付けることや、機能保証の観点から適切な情報
セキュリティ対策を実施できるようサービス維持レベルを関係法令等において具体化することなど、制度的枠組みを適切に改善する取組を継続的に進める。内閣官房は、重要インフ
ラ所管省庁による安全基準等の改善状況を年度ごとに調査し、その結果を公表する。

7-220イ2 ↑7-220ウ↑↑

国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

7-220ウ2 ↑↑↑↑内閣官房において、重要インフラサービスを安全かつ持続的に提供できるよう、重要インフラサービス障害の発生を可能な限り減らし、迅速な復旧が可能となるよう、情報セキュリティ対策に関する取組を推進する。また、この取組を通じ、オリパラ大会に関係する重要なサービスの安全かつ持続的な提供も図る。
・ 迅速かつ効率的な情報共有に資するため、情報共有システム構築に係る調査検討を行う。
・ 重要インフラ事業者等における平時のリスクアセスメントへの利活用のための「機能保証に向けたリスクアセスメント・ガイドライン」の一般化を行う。
・ 事業継続計画及びコンティンジェンシープランに盛り込まれるべき要点等を整理する。
・ 事業者等における内部監査等の取組において、リスクマネジメント及び対処態勢における監査の観点の整理等を行う。
↑

7-220エ 国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

総務省において、重要インフラにおけるサービスの持続的な提供に向け、重要無線通信妨害事案の発生時の対応強化のため、申告受付の夜間・休日の全国一元化を継続して実施するとともに、妨害原因の排除を迅速に実施する。また、重要無線通信への妨害を未然に防ぐための周知啓発を実施するほか、必要な電波監視施設の整備、電波監視技術に関する調査研究を実施する。

7-220オ 国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

総務省において、ネットワークIP化の進展に対応して、ICTサービスのより安定的な提供を図るため、電気通信に関する事故の発生状況等の分析・評価等を行い、その結果を公表する。また、事故再発防止のため、「情報通信ネットワーク安全・信頼性基準」等の見直しの必要性について検討する。

7-220カ

情報共有体制その他の重要インフラ防護体制を実効性のあるものにするため、官民の枠を超えた関係者間での演習・訓練を次のとおり実施する。
・ 内閣官房において、重要インフラ事業者等の障害対応能力の向上を図るため、重要インフラ分野や所管省庁等が横断的に参加する演習を実施する。
・ 総務省において、NICTに組織した「ナショナルサイバートレーニングセンター」を通じ、重要インフラにおけるサイバー攻撃への対処能力を向上させるための実践的サイバー防御演習（CYDER）を実施する。
・ 経済産業省において、重要インフラ等企業におけるサイバー攻撃に対する対応能力を向上させるため、模擬システムを活用した実践的なサイバー演習を実施する。
・ 金融庁において、金融業界横断的なサイバーセキュリティ演習を引き続き実施する。

国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

7-220カ2 ↑↑↑↑7-220カ3 ↑↑↑↑7-220カ4 ↑↑↑↑7-220キ172

国民が安全で安心し 重要インフラを守るた －て暮らせる社会の実 めの取組
現

経済産業省において、IPAに、2017年４月に「産業サイバーセキュリティセンター」を設立
し、我が国の重要インフラ等におけるサイバーセキュリティ対策の中核を担う人材の育成に向けて、７月に教育カリキュラムを開始する。さらに、センターにおいて、重要インフラ等における実際の制御システム等の安全性・信頼性を検証する事業も実施し、対策強化に繋げる。

Appendix C
Itemised#
Category
Sub-category
Strategy
7-213k Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

AgencyNPA,
MOC

Action Item
Promoting "Guidelines Regarding the Protectionof Personal Information in the
Telecommunications Business".

7-213k2 Building a Safe and Secure Measures for the Protection Enhancing Measures
Society for the Peopleof the People and Society against Cybercrimes

NPA

Enhancing capabilities to analyse IoTs.

7-220a Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

CabinetSecretariat

N/A
Promoting 5 action plans (specified below) basedon "The Basic Policy of Critical Information
Infrastructure Protection (3rd Edition)".

7-220b Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

CabinetSecretariat

Considering & preparing for legislation of
security countermeasures for CIIs.

7-220b2 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-220c Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

CabinetSecretariat

Monitoring & publishing improvement of
security standards annually.

-

CabinetSecretariat

Improving security standards for CIIs including
risk assessment, functionality assurance, BCPs &internal audit.

7-220c2 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-220d Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

CabinetSecretariat

Researching for development of information
sharing platform for CIIs.

-

MIC

Improving countermeasures against interferencein critical wireless communication.

7-220e Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

MIC

Improving stability of telecommunication by
analysing incidents in telecommunication.

7-220f Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection-

CabinetSecretariat

Improving incident response ability of CII
operators by performing cross-sectional
exercises.

7-220f2 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-220f3 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-220f4 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-220g Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

-

MIC,
NICT

-

METI

Performing practical cyber defence exercise"CYDER" for CIIs at "National Cyber Training
Center".
Performing practical cyber defence exerciseswith CII operators.

-

FSA

Performing cyber defence exercises in financial
services sector.

-

METI,
IPA

Establishing "ICSCoE: Industrial Cyber Security
Center of Excellence".

173

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-221ア

国民が安全で安心し 重要インフラを守るた 重要インフラ防護の 内閣官房において、重要インフラ所管省庁の協力の下、第４次行動計画に基づく施策を、て暮らせる社会の実 めの取組
範囲等の不断の見 中小事業者へ拡大すると共に、継続的に重要インフラに係る防護範囲の見直しに取り組
現直しむ。

7-222ア

国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現

内閣官房において、重要インフラ所管省庁の協力の下、第４次行動計画に従い、情報共
有体制の強化について次のとおり検討を進める。
・ サービス障害の深刻度判断基準の導入に向けた検討を進める。
・ 連絡形態の多様化（連絡元の匿名化、セプター事務局・情報セキュリティ関係機関経由）
による情報共有の障壁の排除、及び分野横断的な情報を内閣官房に集約する仕組みの検討を進める。
・ ホットライン構築も可能な情報共有システムの整備（自動化、省力化、迅速化、確実化）の検討を進める。

7-222イ

国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現

経済産業省において、官民における最新の脅威情報やインシデント情報等の共有のため、IPAが情報ハブとなり実施している「サイバー情報共有イニシアティブ」（J-CSIP）について参加組織の拡大、共有情報の充実を行う。また、重要インフラ事業者等における信頼性・安全性向上の取組を支援するため、IPAを通じ、障害事例や提供情報の分析結果等を重要インフラ事業者等へ提供する。

7-222ウ

国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現

経済産業省において、JPCERT/CCを通じ、重要インフラ事業者等からの依頼に応じ、国際的なCSIRT間連携の枠組みも利用しながら、攻撃元の国に対する調整等の情報セキュリ
ティインシデントへの対応支援や、攻撃手法の解析の支援を行う。また、重要インフラ事業者等において対策が必要となる可能性のある脅威情報及びその対策に関する情報を、事前の合意に基づき、早期警戒情報として、JPCERT/CCから重要インフラ事業者等へ提供する。

7-222エ 国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現

内閣官房において、情報セキュリティ関係機関等と協力関係を構築・強化していくと共に、
引き続き、得られた情報を適切に重要インフラ事業者等に情報提供する。また、情報セキュ
リティ関係機関を情報共有体制のメインプレーヤの一つとして活用していくことについて、具体的な検討を行う。

7-222オ 国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現総務省において、NICTを通じ、標的型攻撃に関する情報の収集・分析能力の向上に向け、官公庁・大企業のLAN環境を模擬した実証環境を用いて標的型攻撃の解析を実施する。また、サイバー攻撃に関する情報を収集・分析・共有するための基盤となるプラット
フォームの整備・構築に向けた検討を行う。

7-222カ

警察庁において、サイバー攻撃を受けたコンピュータや不正プログラムの分析、関係省庁との情報共有等を通じて、サイバー攻撃事案の攻撃者や手口の実態解明を推進する。また、都道府県警察において、サイバー攻撃特別捜査隊を中心として、サイバー攻撃に関する情報の収集及び整理並びに犯罪の予防及び捜査を推進するとともに、重要インフラ事業者等の意向を尊重し、以下の取組を実施することにより、緊急対処能力の向上を図る。
・ 重要インフラ事業者等への個別訪問を行い、各事業者等の特性に応じた情報提供や保有するシステムに対するぜい弱性試験を実施する。
・ 事案発生を想定した共同対処訓練を実施する。
・ サイバーテロ対策協議会を通じて、参加事業者間の情報共有を実施する。

国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現7-222カ2 ↑↑↑↑7-222カ3 ↑↑↑↑7-222カ4 ↑↑↑↑7-222キ

国民が安全で安心し 重要インフラを守るた 効果的かつ迅速なて暮らせる社会の実 めの取組
情報共有の実現
現

経済産業省において、安全・安心なクレジットカードの利用環境の整備を目的とする「割賦販売法の一部を改正する法律（平成28年法律第99号）」の成立を受け、2018年6月までの円滑な施行に向けて、政省令等の整備を進める。また、クレジットカード取引に関係する事
業者等で構成されているクレジット取引セキュリティ対策協議会において、2017年3月に改訂された「クレジットカード取引におけるセキュリティ対策の強化に向けた実行計画-2017-」に基づく関係事業者等の取組を更に推進するとともに、進捗状況等を踏まえて、必要な見直しを行う。

7-223ア

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

内閣官房及び総務省において、サイバーセキュリティ基本法等に基づいて、地方公共団体に対する情報の提供など、地方公共団体におけるサイバーセキュリティの確保のために必要とされる協力を行う。

7-223イ

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

総務省において、関係機関と協力の上、地方公共団体職員が情報セキュリティ対策について習得することを支援するため、情報セキュリティ監査セミナー、情報セキュリティマネジメン
トセミナーを集合研修で、その他情報セキュリティ関連研修をeラーニングで実施する。また、マイナンバー制度における情報連携の状況等を踏まえつつ、地方公共団体における情報セキュリティポリシーに関するガイドラインの改定を実施する。

7-223イ2 ↑7-223ウ↑↑↑

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

総務省において、関係機関と協力の上、情報セキュリティ対策の取組事例の収集、情報セ
キュリティ事故情報の収集・分析の充実を図り、総合行政ネットワーク（LGWAN）内のポータルサイトに、情報セキュリティに関する解説等を提供するなど、その運営を支援し、更なる利用を促進する。

7-223エ 国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

総務省において、関係機関と協力の上、サーバやネットワーク機器等における脆弱性診断を地方公共団体自らが実施できるよう支援する。2016年度に作成・提供した訓練ツールを活用し、地方公共団体のインシデント即応体制の強化を図る。

7-223エ2 ↑

↑

174

↑

↑

Appendix C#
Category
Sub-category
7-221a Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Itemised
Strategy
Conducting ConstantReview on the Scope of
CIIP

AgencyCabinetSecretariat

Action Item
Extending action plans based on "The Basic
Policy of Critical Information Infrastructure
Protection (4th Edition)" to SMEs (small-to
medium-sized enterprises).

7-222a Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective andCabinetPrompt Information Sharing Secretariat

Enhancing information sharing mechanism for
CIIs specifically;
Considering introduction of severity grades forservice failure.
Diversifying communication method.
Establishing information sharing platform.

7-222b Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective and
METI,
Prompt Information Sharing IPA

Increasing participants & enhancing shared
information of "J-CSIP: Cyber Intelligence
Sharing Initiative".

7-222c Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective and
METI,
Prompt Information Sharing JPCERT/CC

Assisting CII operators to respond cyber attacks
from abroad.

7-222d Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective andCabinetPrompt Information Sharing Secretariat

N/A
Intra-government cooperation.

7-222e Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective andMIC,
Prompt Information Sharing NICT

Enhancing analysis of targeted attacks by using
proving environment simulating large scale LAN.

7-222f Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective and
NPA
Prompt Information Sharing

Enhancing information gathering & analysis on
cyber attacks & malwares.

7-222f2 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-222f3 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-222f4 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-222g Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Ensuring Effective andPrefectural
Prompt Information Sharing Police

Enhancing information gathering on cyberattacks.

Ensuring Effective andPrefectural
Prompt Information Sharing Police

Enhancing information sharing & cooperation
with CII operators.

Ensuring Effective and
MPD
Prompt Information Sharing

Enhancing information sharing with CII
operators through "Cyber Terrorism Council".

Ensuring Effective and
METI
Prompt Information Sharing

Enhancing security countermeasures of credit
card settlement system.

Offering Tailored Support
7-223a Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure to CII Sectors
Protection
7-223b Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

CabinetSecretariat,
MIC
MIC

Supporting local public entities for theircybersecurity.

7-223b2 Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-223c Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

MIC

Supporting local public entities to revise security
policies.

MIC

Providing local public entities with intelligence of
security incidents & countermeasures through"LGWAN: Local Government Wide Area
Network".

7-223d Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace
7-223d2 Building a Safe and Secure Measures for the Protection Promoting Security
Society for the Peopleof the People and Society Measures Taken by Usersof Cyberspace

MIC

Providing local public entities with services ofvulnerability scanning & malware detection.

MIC

Providing local public entities with tools forincident response exercises.

Supporting local public entities to educate &train their personnel for security by holding
seminars & e-learning.

175Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-223オ 国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

内閣官房及び総務省において、総合行政ネットワーク（LGWAN）に設けた集中的にセキュ
リティ監視を行う機能（LGWAN-SOC)などにより、GSOCとの情報連携を通じた、国・地方全体を俯瞰した監視・検知を行うとともに、地方公共団体のセキュリティ強化対策を推進する
ため、情報システムの強靱性の向上や自治体情報セキュリティクラウドの構築に係るフォローアップ及び、2017年度予算を活用し、地方公共団体の情報セキュリティ対策に係る
LGWAN環境の健全性を補完する新たなプラットフォームの構築により、マイナンバー制度を含めたセキュリティ確保を徹底する。また、情報提供ネットワークシステム等のマイナン
バー関係システムについて、インターネットから独立する等の高いセキュリティ対策が講じられたものとなるよう、管理・監督・支援等を行う。加えて、個人情報保護委員会において、関係省庁等と連携しつつ、特定個人情報の適正な取扱いに関するガイドラインの遵守、特定個人情報に係るセキュリティの確保を図るため、専門的・技術的知見を有する体制を拡充するとともに、監視・監督機能を強化し、情報提供ネットワークシステムに係る監視を適切に行う。

7-223オ2 ↑↑↑↑7-223オ3 ↑↑↑↑7-223オ4 ↑↑↑↑7-223カ

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

内閣府において、2017年7月に試行運用を開始し、2017年秋頃に本格運用を開始するマ
イナポータルを活用し、官民の認証連携をより一層推進していく。

7-223キ

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

内閣官房において、我が国で使用される制御系機器・システムに関する脆弱性情報やサイ
バー攻撃情報などの有益な情報について、非制御系の情報共有体制と整合性のとれた情報共有体制により、収集・分析・展開していく。また、経済産業省において、IPAとJPCERT/CCと連携し、制御システムに係る脆弱性情報の提供収集・分析・展開にも取り組む。

7-223ク

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

経済産業省において、重要インフラの制御系の情報セキュリティ対策のため、セキュリティ対策に関する知見を収集し、それに基づいた実践的な演習を実施する。

7-223ケ

国民が安全で安心し 重要インフラを守るた 各分野の個別事情て暮らせる社会の実 めの取組への支援
現

経済産業省において、制御機器のセキュリティ評価・認証の利用促進を図るとともに、制御システムのセキュリティに関する評価・認証制度の検討を行う。

7-230ア

国民が安全で安心し 政府機関を守るため －て暮らせる社会の実 の取組
現

内閣官房において、新たに直面した脅威・課題への対応について、統一基準群を始めとした規程に適時反映するため、統一基準群の次期改定に向けた検討を進める。

7-231ア

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

内閣官房において、政府機関情報セキュリティ横断監視・即応調整チーム（GSOC）により、政府機関情報システムのサイバー攻撃等に関する情報を24時間365日収集・分析し、政府機関等に対する新たなサイバー攻撃の傾向や情勢等について、分析結果を各政府機関等に対して適宜提供する。

7-231イ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 内閣官房において、サイバー攻撃への対処に関する政府機関全体としての体制を強化すて暮らせる社会の実 の取組
報システムの防御力 るため、各府省庁のインシデント対処に関わる要員による情報共有及び連携の促進に資す
現の強化・多層的な対 るコミュニティの更なる活性化を図る。
策の推進

7-231ウ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

7-231ウ2 ↑

176

↑

↑

内閣官房において、2016年度に改定した統一基準群に基づき、クラウドを利用する際の意
識向上を図るとともに、政府機関等の情報システムの調達におけるセキュリティ・バイ・デザ
インを推進するため、情報システムの調達仕様書の策定段階において適切に定めるべきセキュリティ対策要件について検討を行い、各府省庁におけるセキュリティ・バイ・デザインの取組を促進する。また、各府省庁共通的に取り組むべき事項については、規程への反映に向けた検討を行う。
↑

Appendix C#
Category
Sub-category
7-223e Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Itemised
Strategy
Offering Tailored Support
to CII Sectors

AgencyCabinetSecretariat,
CabinetOffice,MIC,
GSOC

Action Item
Establishing integrated cybersecurity network
monitoring for government & local public
entities.

CabinetSecretariat,
MIC
CabinetSecretariat,
MIC

Supporting local public entities to enhancecybersecurity of their ICTs & to establish cloud
network with FY2017 budget.
Urging local public entities to isolate "My
Number" (Japanese version of Social Security
Number) related systems/networks from internet.
Urging local public entities to comply with
"Guidelines for Proper Handling of Specific
Personal Information".

7-223e2 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-223e3 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Offering Tailored Support
to CII Sectors

7-223e4 Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Offering Tailored Support
to CII Sectors

CabinetSecretariat,
MIC,
PPC

7-223f Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection
7-223g Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure
Protection

Offering Tailored Support
to CII Sectors

Cabinet Office Promoting collaboration of public & private
sectors on authentication using "My Number
Portal".
Cabinet
Incorporating vulnerability information for
Secretariat,
control systems into existing operation of
METI,reporting & dissemination system for
IPA,vulnerability information.
JPCERT/CC

Offering Tailored Support
to CII Sectors

Offering Tailored Support
to CII Sectors

Offering Tailored Support
7-223h Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure to CII Sectors
Protection
Offering Tailored Support
7-223i Building a Safe and Secure Measures for CriticalSociety for the People
Information Infrastructure to CII Sectors
Protection
7-230a Building a Safe and Secure Measures for the Protection Society for the Peopleof Governmental Bodies

METI

Performing practical exercises for control
systems of CIIs.

METI

Promoting security assessment & certification forcontrol systems.

CabinetSecretariat

Preparing for next revision of "CommonStandards Group for Information Security
Measures for Government Agencies and Related
Agencies".

Cabinet7-231a Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat,
Systems and Promoting
GSOC
Multi-layered Measuresagainst Presumed Cyber
Attacks

Monitoring & analysing ICT networks ofgovernment agencies @24/7.

Cabinet7-231b Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Strengthening incident response capabilities ofgovernment agencies by enhancing cooperation
between CSIRT of public organisations.

Cabinet7-231c Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Urging government agencies to adopt 'security bydesign' in procurement.

Cabinet7-231c2 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Urging government agencies to consider security
upon utilisation of cloud network.

177

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-231エ 国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

経済産業省において、政府調達等におけるセキュリティの確保に資するため、IPAを通じ、「IT製品の調達におけるセキュリティ要件リスト」の記載内容（製品分野、製品に対する脅
威、脅威に対する要件としてのプロテクション・プロファイルなど）の見直しを行うとともに、政府機関の調達担当者等に対し、最新のプロテクション・プロファイル（翻訳版）を含む情報の提供や普及啓発を行う。

7-231エ2 ↑↑↑↑7-231オ 国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

経済産業省において、IPAを通じ、JISEC（ITセキュリティ評価及び認証制度）の利用者の視点に立った評価・認証手続の改善、積極的な広報活動等を実施するとともに、政府調達を推進するため、調達関係者に対する勉強会やヒアリングを実施するとともに必要に応じて手順等の見直しを実施する。

7-231カ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 経済産業省において、安全性の高い暗号モジュールの政府機関における利用を推進するて暮らせる社会の実 の取組
報システムの防御力 ためIPAの運用する暗号モジュール試験及び認証制度（JCMVP）の普及を図る。
現の強化・多層的な対策の推進

7-231キ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

内閣官房において、各府省庁の情報システムにおけるセキュリティ対策の点検・改善を行う
ため、実際の攻撃手法を用いて情報システム内部への侵入及び侵入後の被害状況について検証を行うペネトレーションテストを行い、その結果を踏まえて、問題点の改善に向けた助言等を行う。

7-231ク

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

内閣官房において、巧妙化する情報セキュリティに関する脅威、動向等を踏まえ、各府省庁の情報システムにおける対策の実施状況の点検・改善を行うため、公開された脆弱性等への対応やサイバー攻撃に係る対策の実施状況の調査を行う。調査結果は、マネジメント
監査により確認された課題等も踏まえ、統一基準群を始めとした規程への反映や改善に向けた取組について検討を行う。

7-231ケ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

内閣官房において、2020年東京オリンピック・パラリンピック競技大会及びその後を見据えて、インシデント発生前及び発生時の情報提供の迅速化・高度化に資するGSOCシステムの検知・解析機能を始めとした機能強化、GSOCセンサーの増強等の検討を行うとともに、将来のGSOCシステムにおける監視の在り方を検討する。

7-231コ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 内閣官房において、各府省庁におけるサイバー攻撃に係る事態の把握・対処機能の強化て暮らせる社会の実 の取組
報システムの防御力 を図るため、情報システムにおけるログの取得や活用の在り方について、サイバー攻撃を
現の強化・多層的な対 受けた際の影響範囲の特定、原因究明等の観点から更なる検討を行う。
策の推進

7-231サ 国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対
策の推進

178

内閣官房において、各府省庁におけるサイバー攻撃に係る事態の把握・対処機能が強化されるよう、CSIRT体制の強化やインシデント対処の改善に関する各府省庁の取組状況及
び課題を把握し、府省庁CSIRTの対処能力の更なる強化のために必要な施策を検討する。

Appendix C
Itemised#
Category
Sub-category
Strategy
AgencyMETI,
7-231d Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information IPA
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Action Item
Reviewing "List of Requirements for Ensuring
Security in Procurement of IT Products".

METI,
7-231d2 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information IPA
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Disseminating information including PP(protection profiles) to procurement professionalsof government agencies.

METI,
7-231e Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information IPA
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Reviewing & promoting "JISEC: Japan
Information Technology Security andCertification Scheme".

METI,
7-231f Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information IPA
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Promoting "JCMVP: Japan Cryptographic
Module Validation Program".

Cabinet7-231g Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Performing penetration testing to ICT systems ofgovernment agencies.

Cabinet7-231h Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Performing vulnerability scanning & examining
cybersecurity measures of government agencies.

Cabinet7-231i Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat,
Systems and Promoting
GSOC
Multi-layered Measuresagainst Presumed Cyber
Attacks

Speeding up detecting & informing incidents togovernment agencies by enhancing GSOC
censors/systems.
Considering next generation system of GSOC.

Cabinet7-231j Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Reviewing policies for obtaining & storing ICT
systems logs to enhance incident response
capabilities.

Cabinet7-231k Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Examining CSIRT of government agencies &urging them to enhance incident response
capabilities.

179

Appendix C

項番
7-231シ

大項目【原文】サイバーセキュリティ2017
小項目

中項目

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情て暮らせる社会の実 の取組
報システムの防御力
現の強化・多層的な対策の推進

7-231シ2 ↑↑↑↑7-231シ3 ↑↑↑↑7-231シ4 ↑↑↑↑7-231ス

施策

政府機関におけるサイバー攻撃に係る対処要員の能力及び連携の強化を図るため、以下の訓練・演習を実施する。
・ 内閣官房において、各府省庁における情報セキュリティインシデント対処に関わる要員を対象として、最高情報セキュリティ責任者及びサイバーセキュリティ・情報化審議官等をはじめとした幹部による指揮の下での組織的かつ適切な対処の実現を目指し、これまでの訓練や調査等により明らかになった課題や近年のサイバー攻撃動向等を踏まえた訓練を実施する。また、府省庁、独立行政法人及び指定法人における情報セキュリティインシデント対処に関わる要員を対象として、研修を年間を通じて実施する。さらに、政府機関等において自組織の環境に最適化した訓練を独自に実施できるようにするために必要な支援の実施を検討する。
・ 内閣官房において、サイバー攻撃等により発生した支援対象機関等の情報システム障
害又はその発生が予想される場合等、政府一体となった対応が必要となる情報セキュリティ
インシデントに対応できる人材を養成・維持するため、情報セキュリティ緊急支援チーム（CYMAT）要員等に対する訓練等を実施する。
・ 総務省において、NICTに組織した「ナショナルサイバートレーニングセンター」を通じ、政府機関におけるサイバー攻撃への対処能力の向上に向け、新たなシナリオによる実践的な
サイバー防御演習（CYDER）を実施する。
・ 内閣官房及び総務省において、政府機関のインシデント対処能力の向上のため、府省間の競技形式による演習（NATIONAL 318(CYBER) EKIDEN）を実施する。

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 文部科学省において、国立情報学研究所（NII）を通じ、国立大学法人及び大学共同利用て暮らせる社会の実 の取組
報システムの防御力 機関法人（以下「国立大学法人等」という）のインシデント対応体制を高度化するために、国
現の強化・多層的な対 立大学法人等へのサイバー攻撃の情報提供と情報セキュリティ担当者の研修を実施する。
策の推進

7-231ス2 ↑↑↑↑7-231セ 国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 内閣官房において、政府職員のインシデント対処能力等を向上させていくため、サイバーて暮らせる社会の実 の取組
報システムの防御力 攻撃対処能力を競うNATIONAL 318(CYBER) EKIDENを、さらに発展させていくべく取り組
現の強化・多層的な対 む。
策の推進

7-231ソ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 内閣官房において、サイバーセキュリティ基本法に基づく重大インシデント等に係る原因究て暮らせる社会の実 の取組
報システムの防御力 明調査をより適切に実施するため、デジタルフォレンジック調査に当たる職員の技術力の現の強化・多層的な対 向上に引き続き取り組むとともに、民間事業者の知見を活用するための方策を講じる。
策の推進

7-231タ

国民が安全で安心し 政府機関を守るため 攻撃を前提とした情 内閣官房において、「高度サイバー攻撃対処のためのリスク評価等のガイドライン」の運用て暮らせる社会の実 の取組
報システムの防御力 等を通じて標的型攻撃に対する多重防御の取組を引き続き推進する。
現の強化・多層的な対策の推進

7-232ア

国民が安全で安心し 政府機関を守るため しなやかな組織的対 内閣官房において、政府機関における統一基準群等に基づく施策の取組状況について、て暮らせる社会の実 の取組
応能力の強化
セキュリティ対策を強化するための体制等が有効に機能しているかとの観点を中心とした検現証を通じて、自律的なセキュリティ水準の向上を促す仕組みを確立するため、国の行政機関に対して監査を実施する。監査の実施に当たっては、２年間で全府省庁に対して監査を実施する計画とし、国の行政機関のサイバーセキュリティ対策及びその維持改善の体制の整備及び運用状況に係る現状を把握し、改善のために必要な助言等を行う。2017年度の監査については、前回までの監査の結果を踏まえるとともに前回対象としなかった部局・シ
ステムを対象とした内容とした監査テーマで実施する。

180

Appendix C
Itemised#
Category
Sub-category
Strategy
AgencyCabinet7-231l Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Action Item
Performing cybersecurity exercises for incident
response personnel of government agencies.

Cabinet7-231l2 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat,
Systems and Promoting
CYMAT
Multi-layered Measuresagainst Presumed Cyber
Attacks

Performing cybersecurity exercises for CYMAT
members.

MIC,
7-231l3 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information NICT
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Performing practical cyber defence exercise"CYDER" for government agencies with"National Cyber Training Center".

Cabinet7-231l4 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat,
Systems and Promoting
MIC
Multi-layered Measuresagainst Presumed Cyber
Attacks

Performing "NATIONAL 318 (CYBER)EKIDEN" (CTF for government agencies).

MEXT,
7-231m Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information NII
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Sharing cybersecurity intelligence with national
universities.

MEXT,
7-231m2 Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information NII
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Supporting national universities to enhancecybersecurity by training security personnel.

Cabinet7-231n Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Considering to enhance "NATIONAL 318(CYBER) EKIDEN" (CTF for government
agencies).

Cabinet7-231o Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Training digital forensics professionals.

Cabinet7-231p Building a Safe and Secure Measures for the Protection Strengthening Defense
Society for the Peopleof Governmental Bodies
Capabilities of Information Secretariat
Systems and Promoting
Multi-layered Measuresagainst Presumed Cyber
Attacks

Promoting "Guidelines for Risk Assessment ofAdvanced Cyber Attacks Measurements".

7-232a Building a Safe and Secure Measures for the Protection Achieving More Resilient
Society for the Peopleof Governmental Bodies
Organizational Response
Capabilities

Performing audit of all government agencies &
related agencies during 2 years based on"Common Standards Group for Information
Security Measures for Government Agencies andRelated Agencies".

CabinetSecretariat

181

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-232イ

国民が安全で安心し 政府機関を守るため しなやかな組織的対 内閣官房及び各府省庁において、最高情報セキュリティ責任者及びサイバーセキュリて暮らせる社会の実 の取組
応能力の強化
ティ・情報化審議官等をはじめとした幹部による指揮の下で、「サイバーセキュリティ人材育
現成総合強化方針」に基づき策定した「各府省庁セキュリティ・IT人材確保・育成計画」の推進を始めとし、体制の整備、有意な人材の確保、一定の専門性を有する人材の育成、適切な処遇の確保を含む政府内部のセキュリティ人材の充実に係る諸施策を推進する。

7-232ウ

国民が安全で安心し 政府機関を守るため しなやかな組織的対 内閣官房において、サイバーセキュリティ・情報化審議官等の研修等を通じて政府機関内て暮らせる社会の実 の取組
応能力の強化における相互の事例共有、意見交換等の継続的な実施を促進する。
現

7-232エ 国民が安全で安心し 政府機関を守るため しなやかな組織的対 内閣官房において、引き続き、府省庁、独立行政法人及び指定法人を対象に、昨今のサて暮らせる社会の実 の取組
応能力の強化イバーセキュリティの動向や課題等に応じたテーマによる勉強会等を開催する。また、人事
現院と協力し、政府職員の採用時の合同研修にサイバーセキュリティに関する事項を盛り込
むことによる教育機会の付与に取り組む。
7-232オ 国民が安全で安心し 政府機関を守るため しなやかな組織的対 内閣官房及び総務省において、各府省庁のセキュリティ・IT人材の育成・確保のため、現て暮らせる社会の実 の取組
応能力の強化行の研修体系の抜本的整理を進めるとともに、研修修了者にスキル認定を行う枠組みを構現築し、研修修了者等に対するスキル認定の実施に向けて取り組む。
7-233ア

国民が安全で安心し 政府機関を守るため 技術の進歩や業務て暮らせる社会の実 の取組
遂行形態の変化へ
現の対応

内閣官房において、各府省庁におけるクラウドサービス等の利用や対策の状況について調査するとともに、各府省庁と共有し、統一的な対策の必要性が把握された場合は統一基準群等への反映に向けた検討を行う。

7-233イ

国民が安全で安心し 政府機関を守るため 技術の進歩や業務て暮らせる社会の実 の取組
遂行形態の変化へ
現の対応

内閣官房において、ITを活用した政府機関全体としての行政事務について、関係機関と連携し、サイバーセキュリティの確保が前提となった遂行形態の実現を図る。

7-234ア

国民が安全で安心し 政府機関を守るため 監視対象の拡大等 内閣官房において、IPAとの連携等により、引き続き、日本年金機構を含む独立行政法人・て暮らせる社会の実 の取組による総合的な対策 指定法人に対して監査を行う。監査の実施に当たっては、2020年東京オリンピック・パラリ
現強化
ンピック競技大会までに、全ての法人に対し監査を行う計画とする。また、IPAの実施する、独立行政法人・指定法人に係る監視業務の監督を行うとともに、監視に係る能力や機能の向上の観点から、攻撃情報の共有等の連携を図る。

7-310ア

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障－

内閣官房において、国民の生命等に重大な被害が生じ、若しくは生じるおそれのあるサイ
バー攻撃事態又はその可能性のある事態（大規模サイバー攻撃事態等）発生時における政府の初動対処態勢の整備及び対処要員の能力の強化を図るため、関係府省庁、重要イ
ンフラ事業者等と連携した初動対処訓練を実施する。

7-310イ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障－

防衛省において、高度なサイバー攻撃からの防護を目的として、国内外におけるサイバー
攻撃関連情報を収集・分析する体制を強化するとともに、必要な機材の拡充を実施する。

7-311ア

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

内閣官房において、「カウンターインテリジェンス機能の強化に関する基本方針」に基づき、各府省庁と協力し、サイバー空間におけるカウンターインテリジェンスに関する情報の集約・分析を行い各府省との共有化を図る。また、政府機関が保有する機密情報が保護されるよう適切な措置を実施する。

7-311イ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

警察庁及び法務省において、サイバーインテリジェンス対策に資する取組を実施する。

7-311ウ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

警察庁において、大規模産業型制御システムに対するサイバー攻撃及び当該システムの脆弱性の調査等を目的とした不正なアクセスが国内外で多数確認されている背景を踏まえ、こうした攻撃の未然防止活動、有事の緊急対処に係る能力向上に資する訓練、サイバー空間に関する観測機能の強化等に取り組むことで、サイバーフォースセンターの技術力の向上等を図る。また、大規模産業型制御システムに対するサイバー攻撃対策に係る訓練を実施する。さらに、サイバー攻撃の実態解明に必要不可欠な不正プログラム等の解析を推進する。

7-311ウ2 ↑↑↑↑7-311ウ3 ↑↑↑↑7-311エ 国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

警察庁において、警察部内の高度な専門性を有する人材等の確保・育成を図る方策を検討する。

7-311オ 国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

防衛省において、対処機関としてのサイバー攻撃対処能力向上のため、サイバー防護分
析装置、サイバー情報収集装置、各自衛隊の防護システムの機能の拡充を図るとともに、多様な事態において指揮命令の迅速かつ確実な伝達を確保するため、防衛情報通信基盤（DII）のクローズ系及びネットワーク監視器材へ常続監視等を強化するための最新技術を適用していく。

7-311オ2 ↑

↑

↑

182

↑

Appendix C
Itemised#
Category
Sub-category
Strategy7-232b Building a Safe and Secure Measures for the Protection Achieving More Resilient
Society for the Peopleof Governmental Bodies
Organizational Response
Capabilities

AgencyCabinetSecretariat,
Government
Agencies

Action Item
Training cybersecurity personnel & experts
based on "General Policy for Cybersecurity
Human Resources Development".
Each government agency establishes own planfor build security & IT human resources.

7-232c Building a Safe and Secure Measures for the Protection Achieving More Resilient
Society for the Peopleof Governmental Bodies
Organizational Response
Capabilities
7-232d Building a Safe and Secure Measures for the Protection Achieving More Resilient
Society for the Peopleof Governmental Bodies
Organizational Response
Capabilities

CabinetSecretariat

Continuing information sharing in cybersecurity
community across government.

CabinetSecretariat

Supporting government agencies to develop
cybersecurity human resources by training nonsecurity personnel & providing with educational
materials.

7-232e Building a Safe and Secure Measures for the Protection Achieving More Resilient
Society for the Peopleof Governmental Bodies
Organizational Response
Capabilities
7-233a Building a Safe and Secure Measures for the Protection Adapting to TechnologicalSociety for the Peopleof Governmental Bodies
Advancement and Change
in Business Performance
StylesCabinetSecretariat,
MIC
CabinetSecretariat

Reviewing & reconstructing education & training
systems for IT human resources.
Researching & developing security measures forcloud services, standardising if necessary.

7-233b Building a Safe and Secure Measures for the Protection Adapting to Technological Cabinet
Society for the Peopleof Governmental Bodies
Advancement and Change Secretariat
in Business Performance
StylesPromoting 'security-by-design' in obtainment of
new ICT systems for administrative operation.

7-234a Building a Safe and Secure Measures for the Protection Comprehensively
Society for the Peopleof Governmental Bodies
Enhancing Measuresthrough the Extended
Scope of Monitoring andOthersCabinetSecretariat,
IPA

Performing audit of related agencies (besides
government agencies) on cybersecurity.

7-310a Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security -CabinetSecretariat

Performing initial response exercises in
preparation for potential large-scale cyber attack.

7-310b Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security -MOD

Enhancing resources for collection & analysis ofcyber attack intelligence from homeland &abroad.

7-311a Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

CabinetSecretariat

Enhancing counter-intelligence capabilities.

7-311b Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

NPA,
MOJ

N/A
Not referring to specific action plans.

7-311c Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

NPA

Enhancing capability of Cyber Force Center byperforming exercises & upgrading monitoring
equipment.

7-311c2 Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

NPA

Performing cybersecurity exercises for largescale industrial control systems.

7-311c3 Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

NPA

Enhancing analytic capabilities of malwares.

7-311d Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

NPA

Considering education & training of highly
professional human resources.

7-311e Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

MOD

Enhancing protection & analysis equipment &cyber intelligence collection equipment.

7-311e2 Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

MOD

Enhancing security of "DII: Defense Information
Infrastructure".

183

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-311カ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

防衛省において、自衛隊のサイバー攻撃対処部隊の対処能力の練度を向上させるため、
指揮システムを模擬した環境を構築して、攻撃・防御の機能とこれに対する統裁・評価の機能等を備えた実戦的な演習環境を整備する。

7-311キ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

防衛省において、巧妙化するサイバー攻撃に適切に対応していくため、CSIRT要員に対するインシデント対処訓練を実施するとともに、国内外の大学院等への留学等を行い、人材育成への取組を実施する。

7-311ク

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

防衛省・自衛隊が保有する情報通信ネットワーク等に対する侵入試験（ペネトレーションテ
スト）について、次年度の実施に向けた所要の準備を進める。

7-311ケ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

対処機関の能力強化

防衛省において、サイバー攻撃等によって防衛省・自衛隊の情報通信基盤の一部が損なわれた場合においても、運用継続を実現する研究を実施する。

7-312ア

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

我が国の先進技術の活用・防護

防衛省において、サイバーセキュリティの更なる確保のため、調達する情報システムに係る情報セキュリティ上のサプライチェーンリスク対策として、調達仕様書に係る関連規則の整備を行うとともに、引き続き調査研究等を通じて必要な関連規則等の整備を進める。

7-312イ

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

我が国の先進技術の活用・防護

科学技術競争力や安全保障等に係る技術情報を保護する観点から、以下の取組を行う。
・ 内閣官房において、先端的な技術を保有する国立研究開発法人について、当該法人のマネジメント・技術面の取組を促進するとともに、これら法人相互の協力による自立的活動の向上に向けた取組を促す。また、情報セキュリティ対策を支える制度面に係る支援を本格化させる。
・ 文部科学省において、先端的な技術情報を保有する大学等に対して、サイバー攻撃による当該情報の漏えいを防止するための取組を促すとともに、支援する。

↑↑

7-312イ2 ↑↑7-313ア

国際社会の平和・安 我が国の安全の確定及び我が国の安 保
全保障

政府機関・社会シス 防衛省において、防衛省と防衛産業との間におけるサイバー攻撃対処のための具体的・実テムの防護
効的連携要領の確立等に向けた取組を実施する。また、任務保証の観点から、任務遂行上依拠する社会インフラへのサイバー攻撃の影響に関する知見を向上し、関係主体との連携を深化させていく。

7-320ア

国際社会の平和・安 国際社会の平和・安 －定及び我が国の安 定
全保障

7-321ア

国際社会の平和・安 国際社会の平和・安 サイバー空間におけ 内閣官房、警察庁、総務省、外務省、経済産業省及び防衛省において、各二国間協議や定及び我が国の安 定
る国際的な法の支配 国連政府専門家会合、APEC、OECD会合等の多国間協議に参画し、我が国の意見表明
全保障の確立
や情報発信に努め、サイバー空間における国際法の適用や国際的なルール・規範作り等に積極的に関与し、それらに我が国の意向を反映させる。

7-321イ

国際社会の平和・安 国際社会の平和・安 サイバー空間におけ 警察庁及び法務省において、容易に国境を越えるサイバー犯罪に効果的に対処するた定及び我が国の安 定
る国際的な法の支配 め、原則として共助を義務的なものとする日・米、日・韓、日・中、日・香港、日・EU、日・露全保障の確立
間の刑事共助条約・協定及びサイバー犯罪に関する条約の発効を受け、これらの条約・協定の下で、中央当局を設置し、外交ルートを経由せずに直接中央当局間で共助実施のための連絡を行うことで共助の迅速化を図る。今後は、更なる刑事共助条約の締結について検討していく。

7-321ウ

国際社会の平和・安 国際社会の平和・安 サイバー空間におけ 警察庁において、迅速かつ効果的な捜査共助等の法執行機関間における国際連携の強定及び我が国の安 定
る国際的な法の支配 化を目的とし、我が国のサイバー犯罪情勢に関係の深い国々の各法執行機関と効果的な全保障の確立
情報交換を実施するとともに、G7/G8、ICPO等のサイバー犯罪対策に係る国際的な枠組みへの積極的な参加、アジア大洋州地域サイバー犯罪捜査技術会議の主催等を通じた多国間における協力関係の構築を推進する。また、外国法執行機関等に派遣した職員を通じ、当該機関等との連携強化を推進する。さらに、証拠の収集等のため外国法執行機関からの協力を得る必要がある場合について、外国の法執行機関に対して積極的に捜査共助を要請し、的確に国際捜査を推進する。

経済産業省において、JPCERT/CCを通じて、主にアジア太平洋地域等を対象としたインターネット定点観測システム（TSUBAME）に関し、運用主体のJPCERT/CCと各参加国関係機関等との間での共同解析やマルウェア解析連携との連動等の取組を進める。また、アジア太平洋地域以外への観測点の拡大を進める。

7-321ウ2 ↑↑↑↑7-321ウ3 ↑↑↑↑7-321エ 国際社会の平和・安 国際社会の平和・安 サイバー空間におけ 外務省において、我が国が2012年７月にサイバー犯罪に関する条約を締結し、同年11月
定及び我が国の安 定
る国際的な法の支配 から我が国について同条約の効力が生じたことを受け、引き続きアジア地域初の締約国と全保障の確立して同条約の普及等に積極的に参画する。

184

Appendix C#
Category
7-311f Ensuring Peace andStability of theInternational Community
and National Security

Itemised
Sub-category
Strategy
Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

AgencyMOD

Action Item
Performing practical exercises on environment
simulating defence information systems.

7-311g Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

MOD

Training CSIRT members for response against
highly advanced attacks.

7-311h Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

MOD,
JSDF

Preparing for penetration testing of defence
information network.

7-311i Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Enhancing Response
Capabilities of Relevant
Governmental Bodies

MOD

Researching contingency operation of defence
information infrastructures.

7-312a Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Utilizing and Protecting
Japan’s Advanced
Technology

MOD

Implementing cybersecurity measures of supply
chains of defence equipment.

7-312b Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Utilizing and Protecting
Japan’s Advanced
Technology

CabinetSecretariat

Backing-up National Research and Development
Agencies with leading technologies especially in
information security area.

7-312b2 Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Utilizing and Protecting
Japan’s Advanced
Technology

MEXT

Supporting universities with leading technologies
to enhance countermeasures against information
exfiltration by cyber attacks.

7-313a Ensuring Peace andStability of theInternational Community
and National Security

Ensuring National Security Protecting Governmental
MOD
Bodies and Social Systems

Enhancing cooperation between MOD & defence
industry.

7-320a Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

-

METI,
JPCERT/CC

Continuing operation of "TSUBAME" (Asia &Pacific region internet fixed point observation
system).
Extending observation points to other regions.

7-321a Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

CabinetSecretariat,
NPA,
MIC,
MOFA,
METI,
MOD

Positively contributing to international debate ofinternational laws, rules & codes for cyberspace.

7-321b Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

NPA,
MOJ

Speeding up international assistance ininvestigation of cybercrimes under treaty formutual legal assistance.
Considering further conclusion of treaty.

7-321c Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

NPA

Exchanging information with law enforcement of
those countries who are related to Japanesecybercrime circumstances.

7-321c2 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

NPA

Positively contributing to internationalframework for cooperation of anti-cybercrime.

7-321c3 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

NPA

Enhancing relationship with neighbouring
countries by holding Asian Pacific Regional
Cyber Crime Investigation TechnicalConferences.

7-321d Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Establishing theInternational Rule of Law
in Cyberspace

MOFA

Positively contributing to promotion of"Budapest Convention on Cybercrime" (the firstinternational treaty seeking to address Internet
and computer crime by harmonizing nationallaws), improving investigative techniques, &increasing cooperation among nations.

185

Appendix C

項番
7-322ア

大項目【原文】サイバーセキュリティ2017
小項目

中項目

国際社会の平和・安 国際社会の平和・安 国際的な信頼醸成
定及び我が国の安 定
措置
全保障

7-322ア2 ↑

↑

↑

施策

内閣官房、外務省及び関係府省庁において、サイバー攻撃を発端とした不測事態の発生を未然に防止するため、国連の場を活用したルール作りに携わるとともに、二国間協議等を通じて、脅威認識やサイバーセキュリティ戦略等の政策について共有し、国際的な連絡体制等を平素から構築する。これらの取組に当たっては、関係府省庁が共同して対外的な情報発信を強化すると共に、把握したサイバーセキュリティに関する情報を国内の関係機関と共有する。
↑

7-322イ

国際社会の平和・安 国際社会の平和・安 国際的な信頼醸成
定及び我が国の安 定
措置
全保障

内閣官房及び関係府省庁において、各二国間協議やIWWN等のサイバー空間に関する多国間の国際会議等に参画し、それぞれの取組においてインシデント対応演習や机上演
習等を通じて、各国との情報共有や国際連携、信頼醸成を推進し、インシデント発生時の国外との情報連絡体制を整備する。

7-322ウ

国際社会の平和・安 国際社会の平和・安 国際的な信頼醸成
定及び我が国の安 定
措置全保障

経済産業省において、JPCERT/CCを通じて、インシデント対応調整や脅威情報の共有に係るCSIRT間連携の窓口を運営するとともに、各国の窓口チームとの間のMOU/NDAに基づく継続的な連携関係の維持を図り、迅速かつ効果的なインシデントへの対処を継続する。また、JPCERT/CCのFIRST、IWWNやAPCERTにおける活動、及びアジア太平洋地域
におけるインシデント対応演習等の活動等を通じた各国CSIRTとJPCERT/CCとのインシデント対応に関する連携を行う。

7-323ア

国際社会の平和・安 国際社会の平和・安 サイバー空間を悪用 内閣官房において、サイバー空間における国際テロ組織の活動等に関する情報の収集・定及び我が国の安 定
した国際テロ組織の 分析の強化等により、全体として、テロの未然防止に向けた多角的かつ隙の無い情報収全保障
活動への対策
集・分析を推進するとともに、関連情報の内閣情報官の下での集約・共有を強化する。

7-323イ

国際社会の平和・安 国際社会の平和・安 サイバー空間を悪用 警察庁及び法務省において、サイバー空間における国際テロ組織等の動向把握及びサイ
定及び我が国の安 定
した国際テロ組織の バー攻撃への対策を強化するため、サイバー空間における攻撃の予兆等の早期把握を可全保障
活動への対策能とする態勢を拡充し、人的情報収集やオープンソースの情報を幅広く収集する等により、攻撃主体・方法等に関する情報収集・分析を強化する。

186

Appendix C#
Category
7-322a Ensuring Peace andStability of theInternational Community
and National Security

Sub-category
Maintaining Peace andStability of theInternational Community

7-322a2 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

7-322b Ensuring Peace andStability of theInternational Community
and National Security

Itemised
Strategy
Building International
Confidence Measures

AgencyCabinetSecretariat,
MOFA

Action Item
Contributing to UN effort to establish
international rules to prevent contingencies fromarising out of cyber attacks.

Building International
Confidence Measures

CabinetSecretariat,
MOFA

Sharing information about cyber threat &cybersecurity strategies through bilateralmeetings.

Maintaining Peace andStability of theInternational Community

Building International
Confidence Measures

CabinetSecretariat

Enhancing international relationship &cooperation through participating international
conferences like "IWWN: International Watch
and Warning Network" (established in 2004 to
foster international collaboration on addressing
cyber threats, attacks, and vulnerabilities).

7-322c Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Building International
Confidence Measures

METI,
JPCERT/CC

Continuing & enhancing international
coordination & cooperation in incident
responses,

7-323a Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Tackling Activities of
CabinetInternational Terrorist
Secretariat
Organizations Maliciously
Using Cyberspace

Enhancing intelligence gathering & analysis ofterrorism activities in cyberspace under directionof Director of Cabinet Intelligence.

7-323b Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Tackling Activities of
NPA,International Terrorist
MOJ
Organizations Maliciously
Using Cyberspace

Enhancing intelligence gathering & analysis ofterrorism activities in cyberspace.

187

Appendix C

項番
7-324ア

大項目【原文】サイバーセキュリティ2017
小項目

中項目

施策

国際社会の平和・安 国際社会の平和・安 サイバー分野におけ 内閣官房、警察庁、総務省、外務省、経済産業省、その他関係府省庁・機関が相互に連定及び我が国の安 定る能力構築（キャパ 携、情報共有を行い、ASEAN加盟国をはじめとする各国における能力構築支援に積極的
全保障
シティビルディング） に取り組む。取組に際しては、内閣官房を中心に、 「サイバーセキュリティ分野における開への協力
発途上国に対する能力構築支援（基本方針）」（2016年10月）を踏まえ、政府及び関係機関が一体となって対応していく。
・ 内閣官房において、日・ASEAN情報セキュリティ政策会議を通じた人材育成の取組やASEAN加盟国と連携したサイバーセキュリティに関する国際キャンペーンの取組を通じて、
ASEAN加盟国の能力構築に貢献する。
・ 警察庁において、アジア大洋州地域サイバー犯罪捜査技術会議やJICA課題別研修（サイバー犯罪対処能力向上）の開催等を通じ、アジア大洋州地域をはじめとする各国における能力構築に貢献する。
・ 総務省において、APEC電気通信・情報産業大臣会合を通じて、情報通信分野に関して
APEC域内各国・地域との間でのネットワークセキュリティ分野における意識啓発等の連携を推進する。また、APT（アジア・太平洋電気通信共同体）における取組やITU-D等の取組を通じて、研修やセミナーを開催することにより、諸外国に対する意識啓発に取り組む。
・ 外務省において、警察庁等とも協力しつつ、第２回日・ASEANサイバー犯罪対策対話やUNODCプロジェクトへの拠出を通じて、ASEAN加盟国のサイバー犯罪対策能力構築支援を行う。その他国際機関などと連携したプロジェクトについても検討する。
・ 経済産業省において、ASEAN加盟国に対し、ISMS、CSMSに関する研修・セミナー等を通じて、我が国のセキュリティマネジメントに関するノウハウを共有することで、ASEAN加盟
国への能力構築支援へ貢献する。
・ 経済産業省において、JPCERT/CCを通じ、アジア太平洋地域、アフリカ等において、各国における対外・対内調整を担うCSIRTの構築及び運用、連携の支援を行う。JPCERT/CCの経験の蓄積をもとに開発されたサイバー攻撃に対処するための演習ツールの提供や演習実施を行う。また、アジア太平洋地域等我が国企業の事業活動に関係の深い国や地域を念頭に、組織内CSIRT構築セミナー等の普及・啓発、サイバー演習の実施等の活動等を行う。さらに、我が国企業が組込みソフトウェア等の開発をアウトソーシングしている先のア
ジア地域の各国を中心に、脆弱性を作りこまないコーディング手法に関する技術セミナーを実施する。

7-324ア2 ↑↑↑↑7-324ア3 ↑↑↑↑7-324ア4 ↑↑↑↑7-324ア5 ↑↑↑↑7-324ア6 ↑↑↑↑7-324ア7 ↑↑↑↑7-325ア

国際社会の平和・安 国際社会の平和・安 国際的な人材育成
定及び我が国の安 定
全保障

内閣官房及び関係府省庁において、各国機関との連携、国際会議への参加や留学の支援、我が国での国際会議の開催、現在国内で開催されている競技イベントを国際レベルで行うこと等を通じ、我が国の情報セキュリティ人材が海外の優秀な技術者等と切磋琢磨しな
がら研鑽を積む場を増やす。

7-330ア

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

内閣官房、外務省及び関係府省庁において、ハイレベルの会談・協議等を通じ、サイバー空間における我が国の利益が達成されるよう、戦略的な取組を進める。

7-330イ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

内閣官房及び外務省において、サイバー空間の安全及び安定を促進するため、「Ｇ７伊勢志摩サイバーグループ」を含め、Ｇ７各国との政策協調及び実務的な協力の強化に向け、Ｇ７各国と連携のうえ我が国も引き続きイニシアチブを発揮していく。

7-330ウ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

内閣官房、総務省、外務省、経済産業省及び関係府省庁において、これまで二国間対話等を実施してきた各国との枠組を継続するとともに、合意された連携を推進する。また、更なる連携の対象を検討し、必要があれば新たな二国間対話等の立ち上げを図り、国際協力体制を確立する。

188

Appendix C#
Category
7-324a Ensuring Peace andStability of theInternational Community
and National Security

Sub-category
Maintaining Peace andStability of theInternational Community

Itemised
Strategy
Cooperating for
Cybersecurity Capacity
Building

7-324a2 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

7-324a3 Ensuring Peace andStability of theInternational Community
and National Security

AgencyCabinetSecretariat

Action Item
Government agencies positively support othernations based on "Basic Policy for Assistance ofCybersecurity Capacity Building in Developing
Counties".
Supporting ASEAN countries to build
cybersecurity capabilities through "ASEANJapan Information Security Policy Meeting".

Cooperating for
Cybersecurity Capacity
Building

NPA

Supporting countries in Asian Pacific region tobuild cybersecurity capabilities through "Asian
Pacific Regional Cyber Crime Investigation
Technical Conferences" & JICA's technicaltraining programs.

Maintaining Peace andStability of theInternational Community

Cooperating for
Cybersecurity Capacity
Building

MIC

Contributing to regional cybersecurity awarenessraising through "APT: Asia-PacificTelecommunity", "ITU-D: ITU
Telecommunication Development Sector" &"Ministerial Meeting on Telecommunications andInformation Industry of APEC: Asia Pacific
Economic Cooperation".

7-324a4 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Cooperating for
Cybersecurity Capacity
Building

MOFA

Supporting ASEAN countries to build
cybersecurity capabilities through "Asian PacificRegional Cyber Crime Investigation TechnicalConferences" & "UNODC: United Nations
Office on Drugs and Crime".

7-324a5 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Cooperating for
Cybersecurity Capacity
Building

METI

Supporting ASEAN countries to build
cybersecurity capabilities by holding seminars of
ISMS & CSMS.

7-324a6 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Cooperating for
Cybersecurity Capacity
Building

METI,
JPCERT/CC

Supporting countries in Asian Pacific & Africa tobuild & operate national CSIRTs.

7-324a7 Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Cooperating for
Cybersecurity Capacity
Building

METI,
JPCERT/CC

Holding seminars for 'secure development' forforeign software suppliers.

7-325a Ensuring Peace andStability of theInternational Community
and National Security

Maintaining Peace andStability of theInternational Community

Developing World-Class
Human Resources

CabinetSecretariat

Encouraging personnel of government agencies& related agencies to attend international
conferences, international CTFs & foreignschools.

7-330a Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

CabinetSecretariat,
MOFA

N/A
Not a specific action.

7-330b Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

CabinetSecretariat,
MOFA

Enhancing coordination & cooperation of G7
through "Ise-Shima Cyber Group".

7-330c Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

CabinetSecretariat,
MIC,
MOFA,
METI

Continuing & extending international cooperation
through bilateral meetings.

189

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-330エ 国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

内閣官房及び外務省において、外国関係機関との情報交換等を緊密に行い、主要国のサイバー攻撃対処や国家の関与が疑われるようなサイバー攻撃の動向等の情報収集・分析に努める。

7-330オ 国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

内閣官房及び関係府省庁において、「サイバーセキュリティ国際キャンペーン」を実施し、サイバーセキュリティに関する国際的なイベントの開催や各国と連携した意識啓発活動を行うことで、幅広い範囲での国際協力体制を確立し、サイバー空間の安全を確保していく。

7-330カ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

警察庁及び法務省において、サイバー攻撃対策を推進するため、諸外国関係機関との情報交換等国際的な連携を通じて、サイバー攻撃に関する情報収集・分析を継続的に実施する。

7-330キ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

経済産業省において、攻撃者が悪用する、グローバルに広がっている脅威や攻撃基盤等の問題に、各国のCSIRTが連携して対応・対策を実施するために必要となる、サイバーセ
キュリティに関する比較可能で堅牢な定量評価の仕組み（サイバーグリーン）の検討や、効率的な対処のためのオペレーション連携を実現するための基盤構築に資する開発、運用
協力体制の検討を進める。

7-330ク

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

経済産業省において、国際協力体制を確立するという観点から、米NIST等の各国の情報
セキュリティ機関との連携を通じて、情報セキュリティに関する最新情報の交換や技術共有等に取組む。

7-330ケ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

経済産業省において、JPCERT/CCを通じ、アジア太平洋地域、アフリカ等において、各国における対外・対内調整を担うCSIRTの構築及び運用、連携の支援を行う。JPCERT/CCの経験の蓄積をもとに開発されたサイバー攻撃に対処するための演習ツールの提供や演習実施等を行う。また、アジア太平洋地域等我が国企業の事業活動に関係の深い国や地域を念頭に、組織内CSIRT構築セミナー等の普及・啓発、サイバー演習の実施等の活動等を行う。さらに、我が国企業が組込みソフトウェア等の開発をアウトソーシングしている先のア
ジア地域の各国を中心に、脆弱性を作りこまないコーディング手法に関する技術セミナーを実施する。

7-330コ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障－

防衛省において、国家の関与が疑われるような高度なサイバー攻撃に対処するため、防衛省・自衛隊のサイバーセキュリティに係る諸外国との技術面・運用面の協力に関する企画・立案機能を強化する。

7-331ア

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

アジア大洋州

内閣官房、総務省、外務省及び経済産業省において、日ASEAN情報セキュリティ政策会
議、二国間協議等の枠組みを通じ、アジア大洋州各国とのサイバー分野における連携を強化する。また、ワークショップの開催等を通じて、我が国とASEAN加盟国のネットワークオペ
レータによって培われた知見や経験の相互共有を促進する。さらに、ARFを中心とした地域の枠組みによる信頼醸成を進める。

7-331ア2 ↑↑↑7-331イ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

アジア大洋州

警察庁、法務省及び外務省において、国境を越えるサイバー犯罪の脅威に対抗するため、特にアジア太平洋地域諸国におけるサイバー犯罪対策に関する刑事司法制度の整備が進むよう、二国間又は多国間の枠組みを活用した技術援助活動を積極的に推進する。

7-331ウ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

アジア大洋州

防衛省及び関係府省庁において、東南アジア各国との間で、防衛当局間のITフォーラム
等の取組を通じ、サイバー分野での連携やこれらの国に対する能力構築への協力、情報の収集や発信を推進していく。また、防衛省において、オーストラリアとのサイバー防衛協力を推進していく。

7-332ア

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

北米

内閣官房、外務省及び関係府省庁において、日米サイバー対話等の枠組みを通じ、幅広
い分野における日米協力について議論し、両国間の政策面での協調や体制及び能力の強化、インシデント情報の交換等を推進し、同盟国である米国とのサイバー空間に関する幅広い連携を強化する。

7-332ア2 ↑7-332イ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

7-332イ2 ↑7-332ウ190↑↑

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

↑

北米

総務省、外務省及び関係府省庁において、米国とのインターネットエコノミーに関する日米政策協力対話にて一致した、産業界及び他の関係者と共同してサイバーセキュリティ上の課題に取り組むことが不可欠であるとの認識に基づき、引き続き米国との情報共有を強化する。また、関連して、総務省において、日米の通信分野のISAC間の連携を推進する。

↑

北米

防衛省において、日米サイバー防衛政策ワーキンググループ（CDPWG）の開催等を通じて、情報共有、訓練・人材育成等の様々な協力分野において日米サイバー防衛の連携を深めていく。また、新たな日米防衛協力のための指針で示された方向性に基づき、自衛隊と米軍との間における運用面のサイバー防衛協力を深化させていく。

Appendix C#
Category
7-330d Ensuring Peace andStability of theInternational Community
and National Security

Sub-category
Cooperation and
Collaboration withCountries around the World

7-330e Ensuring Peace andStability of theInternational Community
and National Security

Itemised
Strategy

AgencyCabinetSecretariat,
MOFA

Action Item
Enhancing intelligence sharing with foreign
governments.

Cooperation and
Collaboration withCountries around the World

CabinetSecretariat

Contributing to international effort to raisecybersecurity awareness.

7-330f Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

NPA,
MOJ

Enhancing intelligence sharing with foreign law
enforcement & legal communities.

7-330g Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

METI

Researching technologies for measuring cyberhealth of countries/regions ("Cyber Green
Project").

7-330h Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

METI

Enhancing information sharing with foreign
agencies for information security like NIST.

7-330i Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

Same as 7Same as 7-324a, 7-324b
324a, 7-324b

7-330j Ensuring Peace andStability of theInternational Community
and National Security

Cooperation and
Collaboration withCountries around the World

MOD

Considering possible cooperation in cyberspace
between MOD/JSDF & foreign forces.

7-331a Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andAsia PacificCollaboration withCountries around the World

Same as 7324c

Same as 7-324c

7-331a2 Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andAsia PacificCollaboration withCountries around the World

CabinetSecretariat,
MIC,
MOFA,
METI

Building regional confidence measures through"ARF: ASEAN Regional Forum".

7-331b Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andAsia PacificCollaboration withCountries around the World

NPA,
MOJ,
MOFA

Supporting countries in Asian Pacific region toestablish cybercrime jurisdiction.

7-331c Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andAsia PacificCollaboration withCountries around the WorldMOD

Establishing cooperation with South-East Asian
countries & Australia in cybersecurity.

7-332a Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andNorth America
Collaboration withCountries around the World

CabinetSecretariat,
MOFA

Enhancing coordination & cooperation with US
through "Japan-U.S. Cyber Dialogues".

7-332a2 Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andEuropeCollaboration withCountries around the WorldMOD

Enhancing cyber defence cooperation with
European countries through "Japan-UK Bilateral
Consultations on Cyberspace", "Japan-NATO
Staff Talks on Cyber defence" & participation in
exercises held by NATO.

7-332b Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andNorth America
Collaboration withCountries around the World

MIC,
MOFA

Enhancing information sharing with US based on"U.S.-Japan Policy Cooperation Dialogue on theInternet Economy".

7-332b2 Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andNorth America
Collaboration withCountries around the World

MIC

Promoting cooperation between Japan's ICTISAC & US IT-ISAC.

7-332c Ensuring Peace andStability of theInternational Community
and National Security

Cooperation andNorth America
Collaboration withCountries around the WorldMOD

Enhancing cyber defence cooperation with US
through "U.S.-Japan Cyber defence Policy
Working Group".

191

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-333ア

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

欧州

内閣官房、外務省及び関係府省庁において、二国間協議の枠組みを通じ、各国との連携を強化する。防衛省において、日英防衛当局間サイバー協議、日NATOサイバー防衛ス
タッフトークスやNATO主催の演習への参加等を通じ、欧州各国とのサイバー防衛協力を
引き続き推進していく。

7-333イ

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

欧州

経済産業省において、IPAを通じ、技術的評価能力の向上に資する最新技術動向の情報
収集等を行うため、JIWG及びその傘下のJHAS、JTEMS、JEDSと定期的に協議を行う。

7-334ア

国際社会の平和・安 世界各国との協力・
定及び我が国の安 連携
全保障

中南米、中東、アフリ 内閣官房、外務省及び関係府省庁において、国際的な会議の場等を活用し、二国間協議
カを実施していない国との関係も強化する。

7-410ア

横断的施策

研究開発の推進－7-410イ

横断的施策

研究開発の推進－7-411ア

横断的施策

研究開発の推進

総務省において、NICTを通じ、情報通信ネットワークの安全性を確保する上で、さまざまなシステムで利用されている暗号方式・プロトコル等の安全性評価を行い、システムの安全性維持に向けた研究開発を実施する。
サイバー攻撃の検 総務省において、NICTを通じ、政府、重要インフラ、企業・団体、個人等に対するサイバー
知・防御能力の向上 攻撃の対策技術の研究開発を行う。また、サイバーセキュリティ関連情報の大規模集約を行うとともに、セキュリティ検証プラットフォームを構築し、サイバーセキュリティ研究の基盤となる環境整備を行う。

7-411ア2 ↑↑↑7-411ア3 ↑↑↑7-411イ

研究開発の推進サイバー攻撃の検 経済産業省において、制御システムの挙動を解析し、サイバー攻撃を検知・予測する技術
知・防御能力の向上 開発や、可用性を確保した脆弱性への対処技術に関する研究を行う。

7-411イ2 ↑↑↑7-411ウ

横断的施策

研究開発の推進サイバー攻撃の検 総務省において、NICTを通じ、サイバーセキュリティの研究開発を促進するため、攻撃トラ
知・防御能力の向上 フィック、マルウェア検体等のデータセットについて、大学等の外部の研究機関の安全な利用を可能にする研究基盤（NONSTOP）を運用する。

7-411エ 横断的施策

研究開発の推進サイバー攻撃の検 文部科学省において、NIIを通じ、サイバー攻撃耐性を向上させるため、大学等の関係機
知・防御能力の向上 関において、M2Mを含み学術評価に適したデータを実環境から継続的に収集し、データ解析技術の開発を促進する。

7-412ア

横断的施策

研究開発の推進サイバーセキュリティ 内閣官房において、各府省庁と連携し、信頼性工学、心理学等の様々な社会科学的視点と他分野の融合領域 も含めた「サイバーセキュリティ研究開発戦略」を策定する。
の研究

7-412イ

横断的施策

研究開発の推進サイバーセキュリティ 経済産業省において、IoT・ビッグデータ・AI（人工知能）等の進化により実世界とサイバーと他分野の融合領域 空間が相互連関する社会（サイバーフィジカルシステム）の実現・高度化に向け、そうした社の研究会を支えるコア技術の調査・研究開発・実証等を行う。

7-412ウ

横断的施策

研究開発の推進サイバーセキュリティ 文部科学省において、理化学研究所革新知能統合研究センター（AIPセンター）を通じ、と他分野の融合領域 革新的な人工知能基盤技術の構築と、サイバーセキュリティを含む社会的課題の解決に向の研究けた応用研究等を進めていく。

7-413ア

横断的施策

研究開発の推進7-413イ

横断的施策

研究開発の推進サイバーセキュリティ 総務省において、NICTを通じ、情報理論的安全性（暗号が情報理論的な意味で無条件にのコア技術の保持安全である性質）を具備した量子暗号等を活用した量子情報通信ネットワーク技術の確立に向け、研究開発を実施する。
サイバーセキュリティ 総務省及び経済産業省において、CRYPTREC暗号リストに掲載された暗号技術の監視、のコア技術の保持
安全性及び信頼性の確保のための調査、研究、基準の作成等を行う。また、社会ニーズを見据え、暗号プロトコルを安全に利活用するための取組などについて検討する。さらに、
NICT及びIPAを通じ、暗号技術の安全性に係る監視及び評価、新世代暗号に係る調査、暗号技術の安全な利用方法に関する調査、暗号の普及促進、セキュリティ産業の競争力強化に係る検討、暗号政策の中長期的視点からの取組の検討を実施するため、暗号技術評価委員会及び暗号技術活用委員会を開催する。

横断的施策

内閣官房において、各府省庁と連携し、信頼性工学、心理学等の様々な社会科学的視点も含めた「サイバーセキュリティ研究開発戦略」を策定する。

7-413イ2 ↑↑↑7-413イ3 ↑↑↑7-413ウ

横断的施策

研究開発の推進サイバーセキュリティ 経済産業省において、AIST等を通じ、IoTシステムに付随する脅威に対応するため、ソフトのコア技術の保持
ウェア工学、暗号技術などを用いてシステムのセキュリティ、品質、安全性、効率の向上、などを両立させるための革新的、先端的技術の基礎研究に取り組む。

7-414ア

横断的施策

研究開発の推進

国際連携による研究 総務省において、情報セキュリティ分野の国際標準化活動であるITU-T SG17等が主催す
開発の強化る国際会合等に参加し、我が国の研究開発成果やIT環境・基準・ガイドライン等を踏まえて、国際規格への反映が行われるよう積極的に参画する。

192

Appendix C#
Category
7-333a Ensuring Peace andStability of theInternational Community
and National Security

Sub-category
Cooperation andEuropeCollaboration withCountries around the World

7-333b Ensuring Peace andStability of theInternational Community
and National Security
7-334a Ensuring Peace andStability of theInternational Community
and National Security

Itemised
Strategy

AgencyCabinetSecretariat,
MOFA

Action Item
Enhancing cooperation through bilateralmeetings.

Cooperation andEuropeCollaboration withCountries around the World

METI,
IPA

Gathering information on latest technologies
through consultation with "JIWG: Joint Industry
Working Group".

Cooperation and
Latin America and theCollaboration with
Caribbean, Middle East
Countries around the World and Africa

CabinetSecretariat,
MOFA

Enhancing cooperation through bilateralmeetings.

CabinetSecretariat
MIC,
NICT

Establishing "Strategy for Research &Development of Cybersecurity".
Researching security assessment ofcryptographic algorisms & protocols.

MIC,
NICT

Researching technologies for countermeasuresagainst cyber attacks.

7-410a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity
7-410b Cross-Cutting Approaches Advancement of R&D
to Cybersecurity-

7-411a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Improving Detection andDefense Capabilities
against Cyber Attacks

7-411a2 Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Building up large scale reservoir of cybersecurity
related information.

7-412a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Improving Detection and
MIC,
Defense Capabilities
NICT
against Cyber Attacks
Improving Detection and
MIC,
Defense Capabilities
NICT
against Cyber Attacks
Improving Detection and
METI
Defense Capabilities
against Cyber Attacks
Improving Detection and
METI
Defense Capabilities
against Cyber Attacks
Improving Detection and
MIC,
Defense Capabilities
NICT
against Cyber Attacks
Improving Detection and
MEXT,
Defense Capabilities
NII
against Cyber Attacks
Promoting Interdisciplinary Same as 7Research on Cybersecurity 410a2

7-412b Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Promoting Interdisciplinary METI
Research on Cybersecurity

Researching technologies for creation of cyberphysical system.

7-412c Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Promoting Interdisciplinary MEXT,
Research on Cybersecurity AIP Center

7-413a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Securing Cybersecurity
Core Technologies

MIC,
NICT

Promoting researching of advanced AI
infrastructure & its practical research forcybersecurity area.
Researching for quantum cryptography
communication.

7-413b Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Securing Cybersecurity
Core Technologies

MIC,
METI

Promoting "The List of Ciphers that should be
Referred to in the Procurement for the eGovernment System" by "CRYPTREC:
Cryptography Research and Evaluation
Committees".

7-413b2 Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Securing Cybersecurity
Core Technologies

MIC,
METI,
NICT,
IPA

Researching technologies for secure
cryptography.

7-413b3 Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Securing Cybersecurity
Core Technologies

MIC,
METI,
NICT,
IPA

Promoting use of secure cryptography.

7-413c Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Securing Cybersecurity
Core Technologies

METI,
AIST

Researching innovative & advanced technologies
for balancing security & efficiency of IoTs.

7-414a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Enhancing R&D in
MICInternational Coordination

7-411a3 Cross-Cutting Approaches Advancement of R&D
to Cybersecurity
7-411b Cross-Cutting Approaches Advancement of R&D
to Cybersecurity
7-411b2 Cross-Cutting Approaches Advancement of R&D
to Cybersecurity
7-411c Cross-Cutting Approaches Advancement of R&D
to Cybersecurity
7-411d Cross-Cutting Approaches Advancement of R&D
to Cybersecurity-

Improving R&D environment by establishingsecurity validation platform.
Researching technologies for detection &prediction of cyber attacks on control systems.
Researching technologies for vulnerability
management on control systems without
interruption of services.
Providing with "NONSTOP" (R&D platform forsecure handling of malware samples).
Researching technologies for data analysis &resilience against cyber attacks.
Same as 7-410a2

Positively contributing to international debate ofstandards for information security byparticipating ITU-T SG17.

193

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-415ア

横断的施策

研究開発の推進

国際機関との連携

内閣府において、戦略的イノベーション創造プログラム（SIP）「重要インフラ等におけるサイ
バーセキュリティの確保」により真贋判定技術（機器やソフトウェアの真正性・完全性を確認する技術）を含めた動作監視・解析技術と防御技術の研究開発を行う。

7-420ア

横断的施策

人材の育成・確保－

内閣官房において、関係府省庁と連携しつつ、「サイバーセキュリティ人材育成プログラム」に基づき、施策間連携を図りつつ、関係施策を促進していく。

7-421ア

横断的施策

人材の育成・確保

高等教育段階や職 文部科学省において、複数の大学や産学の連携によるサイバーセキュリティに係る実践的
業能力開発における な演習を推進する体制の構築やPBL（課題解決型学習）の実施を支援する。
社会ニーズに合った人材の育成

7-421イ

横断的施策

人材の育成・確保

高等教育段階や職 内閣官房において、産業界や大学、関係省庁等、産学官の連携体制の下、情報共有を行業能力開発における いつつ、モデルとなるカリキュラムの策定をはじめとした施策間連携を推進する。
社会ニーズに合った人材の育成

7-421ウ

横断的施策

人材の育成・確保

高等教育段階や職 文部科学省及び経済産業省において、高度なITの知識と経営などその他の領域における業能力開発における 専門知識を併せもつハイブリッド型人材の育成を進める。
社会ニーズに合った人材の育成

7-421エ 横断的施策

人材の育成・確保

高等教育段階や職 文部科学省において、高等専門学校におけるセキュリティ教育の強化のための施策とし
業能力開発における て、企業等のニーズを踏まえた技術者のセキュリティ教育に必要な教材・教育プログラム開
社会ニーズに合った 発を進める。また、並行して、2016年より、情報セキュリティ教育の演習拠点を整備（2016人材の育成
年：５拠点、2017年：５拠点（予定）、合計10拠点整備予定）し、全国の高等専門学校生が共同で利用できるサイバーレンジ（実践的な演習環境）の提供に向けた取組を推進する。

7-421オ 横断的施策

人材の育成・確保

高等教育段階や職 文部科学省において、IT技術者等のサイバーセキュリティに係る素養の向上を図るため、
業能力開発における 高等教育機関等における社会人学生の受け入れを促進する。
社会ニーズに合った人材の育成

7-421カ

横断的施策

人材の育成・確保

高等教育段階や職 厚生労働省において、離職者や在職者を対象として職業に必要な技能及び知識を習得さ
業能力開発における せるため、サイバーセキュリティに関する内容を含む公共職業訓練を実施するとともに、離社会ニーズに合った 職者や在職者を対象とした教育訓練給付制度において、サイバーセキュリティに関する内
人材の育成
容を含む教育訓練を指定する。

7-422ア

横断的施策

人材の育成・確保

初等中等教育段階 文部科学省において、次期学習指導要領の実施を見据え、児童生徒の発達の段階に応じにおける教育の充実 た、プログラミング的思考や情報セキュリティ、情報モラル等を含めた情報活用能力を培う教育を一層推進する。特に、各学校における指導の改善・充実に向けて、教科横断的な情報活用能力の育成に係るカリキュラム・マネジメントの在り方や、それに基づく指導方法・教材の利活用等について、実践的な研究を実施する。

7-422イ

横断的施策

人材の育成・確保

初等中等教育段階 文部科学省において、教員研修センターと連携し、情報通信技術を活用した指導や情報における教育の充実 モラルに関する指導力の向上を図るため、各地域で情報教育の中核的な役割を担う教員等を対象とした研修を実施する。また、教員等を対象とした情報モラル教育セミナー・
フォーラム等を開催する。

7-423ア

横断的施策

人材の育成・確保

突出した能力を有し 経済産業省において、若年層のセキュリティ意識向上と突出した人材の発掘・育成を目的
グローバルに活躍で としてIPAと「セキュリティ・キャンプ実施協議会」にて共催しているセキュリティ・キャンプにつきる人材の発掘・育 いて、サイバーセキュリティを取り巻く状況の変化への更なる対応を図る。
成・確保

7-423イ

横断的施策

人材の育成・確保

突出した能力を有し 経済産業省において、情報セキュリティをテーマとした様々な競技を通して、攻撃・防御両グローバルに活躍で 者の視点を含むセキュリティの総合力を試すハッキングコンテスト「CTF」について、NPO日きる人材の発掘・育 本ネットワークセキュリティ協会及び企業が共同で開催地域拡大や競技内容の向上を図成・確保
り、更なる人材候補者を増やすべく、大学等との連携や多用なコンテストの在り方を検討するとともに、同協会で実施するコンテスト（「SECCON CTF 2017」）について経済産業省において普及・広報の支援を行う。

7-423ウ

横断的施策

人材の育成・確保

突出した能力を有し 経済産業省において、ITを駆使してイノベーションを創出することのできる独創的なアイ
グローバルに活躍で ディア・技術を有する人材の発掘・育成に向け、「未踏IT人材発掘・育成事業」を実施する。
きる人材の発掘・育成・確保7-424ア

横断的施策

人材の育成・確保

人材が将来にわたっ 内閣官房及び経済産業省において、情報セキュリティ人材を含めた高度IT人材の育成強て活躍し続けるため 化のため、情報セキュリティ分野を含めた各種情報分野の人材スキルを測る情報処理技術の環境整備者試験について一層の周知及び普及を図る。

7-424イ

横断的施策

人材の育成・確保

人材が将来にわたっ 経済産業省において、国家試験である情報処理技術者試験において、組織のセキュリティて活躍し続けるため ポリシーの運用等に必要となる知識を問う「情報セキュリティマネジメント試験」の普及を図
の環境整備
る。

7-424ウ

横断的施策

人材の育成・確保

人材が将来にわたっ 経済産業省において、情報サービスの提供に必要な実務能力を明確化、体系化した共通て活躍し続けるため 指標であるITスキル標準の全面的な改訂に向け、第４次産業革命に伴い主流となる新技の環境整備
術に対応するIT人材に焦点を当てたスキル標準の検討を引き続き行う。

7-424エ 横断的施策

人材の育成・確保

人材が将来にわたっ 経済産業省において、情報セキュリティに係る最新の知識・技能を備えた専門人材の国家て活躍し続けるため 資格として2016年に開始した情報処理安全確保支援士（登録セキスペ）制度の着実な実の環境整備
施に向けて必要な措置を講じるとともに、当該制度の普及のため、企業や団体への周知等を積極的に行う。

194

Appendix C#
Category
Sub-category
7-415a Cross-Cutting Approaches Advancement of R&D
to Cybersecurity

Itemised
StrategyPartnering with Relevant
Entities

AgencyCabinetOffice,NEDO

Action Item
Researching technologies for monitoring &analysis of control & communication systems
through "Cyber-Security for Critical
Infrastructure" of "SIP: Cross-ministerial
Strategic Innovation Promotion Program".

Cabinet7-420a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity
Secretariat
Workforce
Promoting Human
MEXT
7-421a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Promoting human resources development basedon "Cybersecurity Human Resources
Development Program".
Promoting practical exercise & PBL (problem
based learning) on cybersecurity by collaborationof multiple universities and/or academia-industry.

Promoting Human
Cabinet7-421b Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
Secretariat
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Promoting collaboration of industry, government& academia on practical cyber exercises.

Promoting Human
MEXT,
7-421c Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
METI
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Developing human resources with hybrid careers.

Promoting Human
MEXT
7-421d Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Enhancing cybersecurity education at colleges oftechnology ("Kosen") based on needs fromindustry.
Providing with cyber ranges

Promoting Human
MEXT
7-421e Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Promoting cybersecurity education for working
adults at universities.

Promoting Human
MHLW
7-421f Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development
Workforce
Corresponding to Social
Needs in Higher Education
and Vocational Training

Incorporating cybersecurity education into public
vocational training.

Expanding Elementary and MEXT
7-422a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Secondary Education for
Workforce
Cybersecurity

Promoting education at elementary, middle &high schools about IT, information security &information moral based on individual ability ofuse of IT.

Expanding Elementary and MEXT
7-422b Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Secondary Education for
Workforce
Cybersecurity

Training teachers for IT skills & information
moral

Discovering, Fostering, and METI,
7-423a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Acquiring the Best Brains IPA
Workforceas Global Players

Continuing to hold "Security Camp" to raiseawareness of youth & to discover prominenthuman resources.

Discovering, Fostering, and METI
7-423b Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Acquiring the Best Brains
Workforceas Global Players

Jointly promoting CTFs with "JNSA: Japan
Network Security Association".

Discovering, Fostering, and METI
7-423c Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Acquiring the Best Brains
Workforceas Global Players

Conducting "MITOU Program: Exploratory IT
Human Resources Project" to discover
innovative talents.

Building Long Term Career Cabinet
7-424a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Paths for Cybersecurity
Secretariat,
Workforce
Experts
METI,
IPA

Promoting "Information Technology Engineers
Examination" to develop highly skilled IT humanresources.

Building Long Term Career METI,
7-424b Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Paths for Cybersecurity
IPA
Workforce
Experts
Building Long Term Career METI
7-424c Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Paths for Cybersecurity
Workforce
Experts
Building Long Term Career METI
7-424d Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Paths for Cybersecurity
Workforce
Experts

Promoting "Information Security Management
Examination" (a subject of "Information
Technology Engineers Examination").
Supporting young engineers & student to design
their career pass in IT industry.
Promoting new national qualification "Registered
Information Security Specialist".

195

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-424オ 横断的施策

人材の育成・確保

人材が将来にわたっ 総務省において、NICTに組織した「ナショナルサイバートレーニングセンター」を通じて、若て活躍し続けるため 年層のICT人材を対象に、高度なセキュリティ技術を本格的に指導し、未来のサイバーセの環境整備
キュリティ研究者・起業家の育成に取り組む。

7-425ア

横断的施策

人材の育成・確保

組織力を高めるため 防衛省において、巧妙化するサイバー攻撃に適切に対応していくため、CSIRT要員に対すの人材育成
るインシデント対処訓練を実施するとともに、国内外の大学院等への留学等を行い、人材育成への取組を実施する。

7-425イ

横断的施策

人材の育成・確保

組織力を高めるため 総務省において、NICTに組織した「ナショナルサイバートレーニングセンター」を通じ、国のの人材育成
行政機関、独立行政法人、重要インフラ事業者及び地方公共団体等におけるサイバー攻撃への対処能力の向上に向け、新たなシナリオによる実践的サイバー防御演習（CYDER）を実施する。

7-425ウ

横断的施策

人材の育成・確保

組織力を高めるため 防衛省において、自衛隊のサイバー攻撃対処部隊の対処能力の練度を向上させるため、の人材育成
指揮システムを模擬した環境を構築して、攻撃・防御の機能とこれに対する統裁・評価の機能等を備えた実戦的な演習環境を整備する。

7-425エ 横断的施策

人材の育成・確保

組織力を高めるため 防衛省において、防衛省と防衛産業との間におけるサイバー攻撃対処のための具体的・実の人材育成
効的連携要領の確立等に向けた取組を実施する。また、任務保証の観点から、任務遂行上依拠する社会インフラへのサイバー攻撃の影響に関する知見を向上し、関係主体との連携を深化させていく。

7-425エ2 ↑

↑

↑

196

Appendix C
Itemised#
Category
Sub-category
Strategy
AgencyBuilding Long Term Career MIC,
7-424e Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Paths for Cybersecurity
NICT
Workforce
Experts
Strategizing HumanMOD
7-425a Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development for
Workforce
Enhanced Organizational
Capacities

Action Item
Training youth to cybersecurity expert at"National Cyber Training Center".
Sending officials to study at graduate schools.

Strategizing Human
MIC,
7-425b Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development for NICT
Workforce
Enhanced Organizational
Capacities

Performing upgraded practical cyber defence
exercise "(New) CYDER" at "National Cyber
Training Center".

Strategizing HumanMOD
7-425c Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development for
Workforce
Enhanced Organizational
Capacities

Establishing practical exercise environment ofcommunication system of JSDF.

Strategizing HumanMOD
7-425d Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development for
Workforce
Enhanced Organizational
Capacities

Enhancing cooperation between MOD/JSDF &defence industry.

Strategizing HumanMOD
7-425d2 Cross-Cutting Approaches Development andto Cybersecurity
Assurance of Cybersecurity Resources Development for
Workforce
Enhanced Organizational
Capacities

Enhancing cooperation between MOD/JSDF &operators of infrastructures affecting operation.

197

Appendix C

項番

大項目

【原文】サイバーセキュリティ2017
小項目

中項目

施策

7-500ア

推進体制－－

内閣官房において、JPCERT/CCと締結した国際連携活動及び情報共有等に関するパー
トナーシップの一層の進化を図るため、2015年度に構築した情報共有システムの機能向上を図るとともに連携体制についても逐次見直しを実施する。中期的には、2020年東京オリン
ピック・パラリンピック競技大会を見据え、NISC内に専従のCSIRT組織を整備する。また、サイバーセキュリティに関し、司令塔機能を果たすため、総合的分析機能の強化を図る。さらに、NICTと締結した研究開発や技術協力等に関するパートナーシップに基づいてNICTとの協力体制を整備し、サイバーセキュリティ対策に係る技術面の強化を図る。

7-500イ推進体制－－

警察庁において、「セキュリティ情報センターについて」（2015年８月３日セキュリティ幹事会決定）等に基づき、セキュリティ情報センターを設置する。同センターにおいては、国の関係機関の協力を得て、サイバーセキュリティに係るものを含む2020年東京オリンピック・パラ
リンピック競技大会の安全に関する情報を集約するとともに、大会の安全に対する脅威及びリスクの分析、評価を行い、国の関係機関等に対し必要な情報を随時提供する。

7-500ウ

推進体制－－

内閣官房において、「2020年東京オリンピック競技大会・東京パラリンピック競技大会に向けたセキュリティ基本戦略（Ver.1）」（2017年３月21日セキュリティ幹事会決定）に基づくサイ
バーセキュリティ対策の強化のため、運営に大きな影響を及ぼし得る重要サービス事業者
等におけるサイバーセキュリティに係るリスク評価について、大会の詳細や情勢の変化に応じた手順書の見直しを実施するとともに、地方における会場等を勘案し、対象となる事業者の地理的、分野的な拡大を図る。更に、特に重要なサービス事業者については国として横断的リスク評価を実施していく。また、これら重要サービス事業者等に対するサイバー攻撃への対応に係る関係主体との情報共有の中核的役割を果たすサイバーセキュリティ対処
調整センター（オリンピック・パラリンピックCSIRT）の2018年度中の構築に向け、情報共有システムの構築を推進するとともに、2018年２月から３月にかけて開催される平昌冬期オリンピック・パラリンピック競技大会等の機会をとらえ関係組織間のさらなる連携の深化を図る。

7-500エ 推進体制－－

内閣官房において、サイバー攻撃等の事象に関する政府としての一連の初動対処（検知、判断、対処、報告）を見直し、サイバーセキュリティに係る危機管理対応の一層の強化が図られるよう留意する。

Department Abbreviation
AbbreviationAIST
AIP Center
Cabinet OfficeCabinet Secretariat
CSSC
CYMAT
FSA
GSOC
IPA
JICA
JPCERT/CC
JSDF
METI
MEXT
MHLW
MIC
MOD
MOFA
MOJ
MPD
NEDO
NICT
NII
NISC
NPA
NPAc
PPC
Prefectural Police

198

Full Name
National Institute of Advanced Industrial Science and Technology
Center for Advanced Intelligence Project(@ RIKEN: National Research & Development Agency, Institute of Physical and Chemical Reseach)Cabinet OfficeCabinet Secretariat
Cotrol System Security Center
Cyber Incident Mobile Assistant Team
Financial Services Agency
Government Security Operation Coodination Team
Information-Technology Promotion Agency
Japan International Cooperation Agency
Japan Computer Emergency Response Team Cordination Center
Japan Self-Defense Forces
Ministry of Economy, Trade and Industry
Ministry of Education, Culture, Sports, Science and Technology
Ministry of Health, Labour and Welfare
Ministry of Internal Affairs and Communications
Ministry of Defense
Ministry of Foreign Affairs
Minstry of Jastice
Metropolitan Police Department
New Energy and Industrial Technology Development Organization
National Institute of Information and Communications Technology
National Institute of Informatics
National Center of Incident Readiness and Strategy for Cybersecurity
National Police Agency
National Police Academy
Personal Information Protection Commission
Prefectural Police

Appendix C#

Category

Sub-category

Itemised
Strategy

AgencyAction Item
N/A

N/A

N/A

N/A

199

Appendix D

Appendix D U.K. Cybersecurity Strategy("National Cyber Security Strategy 2016 - 2023" itemised to action items)
Section5. DEFEND

Subsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring5.0.1. The DEFEND elements of this strategy aim to ensurethat UK networks, data and systems in the public,commercial and private spheres are resilient to andprotected from cyber attack. It will never be possible tostop every cyber attack, just as it is not possible to stop
every crime.

5.1. ACTIVE CYBER
DEFENCE200#

Itemised
Action Item
None

However, together with citizens, education providers,
academia, businesses and other governments, the UK
can build layers of defence that will significantly reduce
our exposure to cyber incidents, protect our mostprecious assets, and allow us all to operate successfully
and prosperously in cyberspace. Acting to promote
cooperation between states and good cyber security
practice is also in the interest of our collective security.

None

5.0.2. The Government will implement measures to ensure thatcitizens, businesses, public and private sector
organisations and institutions have access to the rightinformation to defend themselves. The National Cyber
Security Centre provides a unified source of advice ingovernment for threat intelligence and information
assurance, ensuring that we can offer tailored guidancefor cyber defence and respond quickly and effectively tomajor incidents in cyberspace.

None

The Government will work with industry andinternational partners to define what good cyber security
looks like for public and private sectors, for our mostimportant systems and services, and for the economy asa whole. We will build security by default into all new
government and critical systems. Law enforcement
agencies will collaborate closely with industry and the
National Cyber Security Centre to provide dynamic
criminal threat intelligence with which industry canbetter defend itself, and to promote protective security
advice and standards.

None

5.1.1. Active Cyber Defence (ACD) is the principle of
implementing security measures to strengthen a networkor system to make it more robust against attack. In acommercial context, Active Cyber Defence normallyrefers to cyber security analysts developing an
understanding of the threats to their networks, and thendevising and implementing measures to proactively
combat, or defend, against those threats. In the context
of this strategy, the Government has chosen to apply thesame principle on a larger scale: the Government will use
its unique expertise, capabilities and influence to bringabout a step-change in national cyber security to respondto cyber threats.

None

The ‘network’ we are attempting to defend is the entire
UK cyberspace. The activities proposed represent a
defensive action plan, drawing on the expertise of NCSC
as the National Technical Authority to respond to cyberthreats to the UK at a macro level.

None

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Objectives
5.1.2. In undertaking ACD, the Government aims to:• make the UK a much harder target for state sponsoredactors and cyber criminals by increasing the resilience ofUK networks;• defeat the vast majority of highvolume/ lowsophistication malware activity on UK networks byblocking malware communications between hackers andtheir victims;

Approach#

Itemised
Action Item
None
None

None

• evolve and increase the scope and scale ofGovernment’s capabilities to disrupt serious state
sponsored and cyber criminal threats;• secure our internet and telecommunications traffic fromhijacking by malicious actors;• harden the UK’s critical infrastructure and citizenfacing services against cyber threats; and• disrupt the business model of attackers of every type,to demotivate them and to reduce the harm that their
attacks can cause.
5.1.3. In pursuit of these aims, the Government will:• work with industry, especially Communications Service
Providers (CSPs), to make it significantly harder toattack UK internet services and users, and greatly reduce
the prospect of attacks having a sustained impact on the
UK. This will include tackling phishing, blocking
malicious domains and IP addresses, and other steps todisrupt malware attacks. It will also include measures tosecure the UK’s telecommunications and internet routing
infrastructure;None• increase the scale and development of GCHQ, Ministryof Defence and NCA capabilities to disrupt the mostserious cyber threats to the UK, including campaigns bysophisticated cyber criminals and hostile foreign actors;
and

None

• better protect government systems and networks, help
industry build greater security into the CNI supply chain,make the software ecosystem in the UK more secure,and provide automated protections for government online
services to the citizen.

None

5.1.4. Where possible, these initiatives will be delivered withor through partnerships with industry. For many, industry
will be designing and leading implementation, with theGovernment’s critical contribution being expert support,
advice and thought-leadership.

None

None
None
None

None
None

201

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
5.1.5. The Government will also undertake specific actions to
implement these measures, which will include:• working with CSPs to block malware attacks. We will
do this by restricting access to specific domains or web
sites that are known sources of malware. This is known
as Domain Name System (DNS) blocking / filtering;#

Itemised
Action Item
None

5105-1 Blocking known
malware sources• preventing phishing activity that relies on domain‘spoofing’ (where an email appears to be from a specificsender, such as a bank or government department, but isactually fraudulent) by deploying an email verification
system on government networks as standard andencouraging industry to do likewise;

5105-2 Promoting email
verification systems• promoting security best practice through multistakeholder internet governance organisations such as
the Internet Corporation for Assigned Names andNumbers (ICANN) which coordinates the domain namesystem), the Internet Engineering Task Force (IETF) andthe European Regional Internet Registry (RIPE) andengagement with stakeholders in the UN Internet
Governance Forum (IGF);

5105-3 Promoting security bestpractices• working with law enforcement channels in order toprotect UK citizens from being targeted in cyber attacks
from unprotected infrastructure overseas;• working towards the implementation of controls tosecure the routing of internet traffic for government
departments to ensure that it cannot be illegitimately rerouted by malicious actors; andNone5105-4 Implementing securerouting• investing in programmes in the Ministry of Defence,
5105-5 Enhancing capabilities
the NCA and GCHQ that will enhance the capabilities ofagainst state-sponsoredthese organisations to respond to, and disrupt, serious
cyber activities
state-sponsored and criminal cyber activity targeting UK
networks.
We will develop these technical interventions as threats
evolve to ensure that UK citizens and businesses areprotected by default from the majority of large-scalecommodity cyber attacks.
Measuring
success

5.1.6. The Government will measure its success in establishingeffective ACD by assessing progress towards thefollowing outcomes:• the UK is harder to ‘phish’, because we have largescale defences against the use of malicious domains,
more active anti-phishing protection at scale and it ismuch harder to use other forms of communication, suchas ‘vishing’ and SMS spoofing, to conduct social
engineering attacks;• a far larger proportion of malware communications andtechnical artefacts associated with cyber attacks andexploitation are being blocked;• the UK’s internet and telecommunications traffic issignificantly less vulnerable to rerouting by malicious
actors;• GCHQ, the Armed Forces’ and NCA capabilities to
respond to serious statesponsored and criminal threats
have significantly increased.

202

5105-6 Promoting technicaldevelopment

5106-1 Metrics

None

None

None

None

Appendix D

SectionNational Cyber Security Strategy 2016 - 2023
Subsection
Objective/Approach/Measuring
5.2. BUILDING A
5.2.1. Changing technology provides us with the opportunity to
MORE SECURE
significantly reduce the ability of our adversaries to
INTERNET
conduct cyber crime in the UK by ensuring that future
online products and services coming into use are ‘secureby default’. That means ensuring that the security
controls built into the software and hardware we use are
activated as a default setting by the manufacturer so thatthe user experiences the maximum security offered tothem, unless they actively choose to turn it off.

#

Itemised
Action ItemNone

The challenge is to effect transformative change in a waythat supports the end user and offers a commercially
viable, but secure, product or service – all within thecontext of maintaining the free and open nature of theInternet.

None

5.2.2. The Government is well-placed to take a lead role in
exploring those new technologies that will better protect
our own systems, help industry build greater security into
the supply chain, secure the software ecosystem andprovide automated protections to citizens accessing
government services online.

None

The Government must test and implement newtechnologies that provide automated protection forgovernment online products and services. Where
possible, similar technologies should be offered to theprivate sector and the citizen.

None

Objective

5.2.3. The majority of online products and services coming into
use become ‘secure by default’ by 2021. Consumers will
be empowered to choose products and services that havebuilt-in security as a default setting. Individuals can
switch off these settings if they choose to do so but those
consumers who wish to engage in cyberspace in the mostsecure way will be automatically protected.

None

Our approach

5.2.4. We will pursue the following actions:• the Government will lead by example by running secureservices on the Internet that do not rely on the Internet
itself being secure;• the Government will explore options for collaboration
with industry to develop cutting-edge ways to makehardware and software more ‘secure by default’; and• we will adopt challenging new cyber security
technologies in government, encouraging Devolved
Administrations to do likewise, in order to reduce
perceived risks of adoption. This will provide proof ofconcept and demonstrate the security benefits of newtechnologies and approaches.

None
None

It will also put security at the heart of new productdevelopment, eliminate opportunities for criminal
exploitation and thereby protect the end user.

None

None

None

203

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Itemised
Objective/Approach/Measuring#
Action Item
5.2.5. To do this we will:
None• continue to encourage hardware and software providers 5205-1 Security settings by
to sell products with security settings activated as
default
default, requiring the user to actively disable thesesettings to make them insecure.
Some vendors are already doing this, but some are notNone
yet taking these necessary steps;• continue to develop an Internet Protocol (IP) reputation 5205-2 Developing IP
service to protect government digital services (this would
reputation informing
allow online services to get information about an IP
serviceaddress connecting to them, helping the service makemore informed risk management decisions in real time);• seek to install products on government networks thatwill provide assurance that software is running correctly,
and not being maliciously interfered with;• look to expand beyond the GOV.UK domain into otherdigital services measures that notify users who arerunning out-of-date browsers; and• invest in technologies like Trusted Platform Modules(TPM) and emerging industry standards such as Fast
Identity Online (FIDO), which do not rely on passwords
for user authentication, but use the machine and otherdevices in the user’s possession to authenticate. The
Government will test innovative authentication
mechanisms to demonstrate what they can offer, both interms of security and overall user experience.

5205-3 Software integrity
assuarance
5205-4 Promoting out-of-datebrowsers filtering
5205-5 Investing newtechnologies like TPM,
FIDO

5.2.6. The Government will also explore how to encourage the 5206-1 Introducing security
market by providing security ratings for new products, so
ratings for productsthat consumers have clear information on which products
and services offer them the greatest security. The
Government will also explore how to link these productratings to new and existing regulators, and ways to warn
consumers when they are about to take an action onlinethat might compromise their security.
Measuring
success

5.3. PROTECTING
GOVERNMENT

204

5.2.7. The Government will measure its success in building asecure Internet by assessing progress towards thefollowing outcomes:• the majority of commodity products and services
available in the UK in 2021 are making the UK moresecure because they have their default security settings
enabled by default or have security integrated into theirdesign; and5207-1 Metrics

None• all government services provided at national, local and
Devolved Administration level are trusted by the UK
public because they have been implemented as securely
as possible, and fraud levels are within acceptable risk
parameters.

None

5.3.1. The UK Government, Devolved Administrations and thewider public sector hold large quantities of sensitive
data. They deliver essential services to the public andoperate networks that are critical to national security andresilience. The Government’s systems underpin thefunctioning of our society. The modernisation of public
sector services will continue to be the cornerstone of the
UK’s Digital Strategy – the Government’s digital
ambition is for the UK to be the world’s leading digitalnation.

None

To retain the trust of citizens in online public sector
services and systems, data held by government must be
protected and all branches of government must
implement appropriate levels of cyber security in the faceof continuous attempts by hostile actors to gain access togovernment and public sector networks and data.

NoneAppendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Objectives
5.3.2. We want to achieve the following outcomes:• citizens use government online services withconfidence: they trust that their sensitive information issafe and, in turn, understand their responsibility tosubmit their sensitive information online in a securemanner;Our approach#

Itemised
Action Item
None
None

• the Government will set and adhere to the mostappropriate cyber security standards, to ensure that all
branches of government understand and meet their
obligations to secure their networks, data and services;
and

None

• the Government’s critical assets, including those at thehighest classification, are protected from cyber attacks.
5.3.3. The UK Government will continue to move more of its
services online so that the UK can become truly ‘digitalby default’.
The Government Digital Service (GDS), the Crown
Commercial Service (CCS) and the NCSC will ensurethat all new digital services built or procured bygovernment are also ‘secure by default’.

None5303-1 Promoting e-government

5303-2 'Security-by-default' in
e-government

5.3.4. The Government’s networks are highly complex and in
5304-1 Eliminating unsupported
many cases still incorporate legacy systems, as well assoftwares in public
some commercially available software which is no longer
sectorsupported by the vendor. We will ensure that there are
no unmanaged risks from legacy systems andunsupported software.
5.3.5. We will improve government and wider public sector
resilience to cyber attack. This means ensuring an
accurate and up to date knowledge of all systems, data,
and those who have access to them.
The likelihood and impact of a cyber incident will beminimised by implementing best practice as set out by
the NCSC.
The Government will also ensure that it is able torespond effectively to cyber incidents through a
programme of incident exercises and regular testing ofgovernment networks.

5305-1 Comprehensive
knowledge about all
public sector systems
5305-2 Promoting best practices
in public sector
5305-3 Cyber exercise

We will invite Devolved Administrations and local
authorities to participate in these exercises, as
appropriate.
Through automated scanning, we will ensure that wehave a better knowledge of government’s online security
status.
5.3.6. Cyber security is not just about technology. Almost all
successful cyber attacks have a contributing humanfactor.
We will therefore continue to invest in our people, toensure that everyone who works in government has asound awareness of cyber risk.
We will develop specific cyber expertise in areas where
the risks are heightened and ensure that we have the rightprocesses in place to manage these risks effectively.

5305-4 Participation of lower
levels of public sector

5.3.7. The NCSC will develop worldleading cyber security
guidance which will keep pace with the threat anddevelopment of new technologies.
We will take steps to make sure governmentorganisations have easy access to threat information to
inform their understanding of their own cyber risks andtake appropriate action.

5307-1 Developing new
guidance

5.3.8. We will continue to improve our highest classification
networks to safeguard the Government’s most sensitive
communications.

5308-1 Improving highest
classification networks

5305-5 Automated vulnerability
scan on e-governmentNone

5306-1 Awarenes raising inpublic sector
5306-2 Development of cyberexpertise5307-2 Making cyber threat
infomation easily
available

205

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
5.3.9. Health and care systems pose unique challenges in thecontext of cyber security.
The sector employs around 1.6 million people in over
40,000 organisations, each with vastly differing
information security resources and capability. The
National Data Guardian for Health and Care has set new
data security standards for the health and social caresystems in England, alongside a new data consent/optout model for patients. The Government will work withhealth and social care organisations to implement thesestandards.
5.3.1 Cyber security is vital to our defence.
0.
Our Armed Forces depend on information andcommunications systems, both in the UK and on
operations around the world. The infrastructure andpersonnel of the Ministry of Defence (MoD) areprominent targets.

Measuring
success

206

Defence systems are regularly targeted by criminals,
foreign intelligence services and other malicious actors
seeking to exploit personnel, disrupt business andoperations, and corrupt and steal information. We will
enhancecyber threat
reaction
5.3.1 The
Government
willawareness,measure itsdetection,
success inandprotecting
1.

government networks, systems and data by assessing
progress towards the following outcomes:• the Government has an in-depth understanding of thelevel of cyber security risk across the whole ofgovernment and the wider public sector;• individual government departments and other bodies
protect themselves in proportion to their level of risk andto an agreed government minimum standard;• government departments and the wider public sector
are resilient and can respond effectively to cyberincidents, maintaining functions and recovering quickly;• new technologies and digital services deployed bygovernment will be cyber secure by default;• we are aware of, and actively mitigating, all known
internet-facing vulnerabilities in government systems andservices; and• all suppliers to the Government meet appropriate cybersecurity standards.

#

Itemised
Action Item
None

5309-1 Promoting new
standards in health &care industries

None
None

5310-1 Awareness raising in
Armed Forces5310-2 Enhancing detection &reaction functions
5311-1 Metrics

None

None

None

None
None

None

Appendix D

SectionNational Cyber Security Strategy 2016 - 2023
Subsection
Objective/Approach/Measuring
5.4. PROTECTING
Context
5.4.1. The cyber security of certain UK organisations is of
OUR CRITICAL
particular importance because a successful cyber attack
NATIONAL
on them would have the severest impact on the country’s
INFRASTRUCT
national security. This impact could have a bearing on
URE AND
the lives of UK citizens, the stability and strength of the
OTHER
UK economy, or the UK’s international standing and
PRIORITY
reputation. This premium group of companies and
SECTORS
organisations within the public and private sector
includes the critical national infrastructure (CNI), which
provides essential services to the nation. Ensuring the
CNI is secure and resilient against cyber attack will be apriority for the Government. This premium group also
includes other companies and organisations, beyond the
CNI, that require a greater level of support. They
include:Objective#

Itemised
Action Item
None

• the jewels in our economic crown – the UK’s mostsuccessful companies and also those that hold our future
economic strength in the value of their research andintellectual property;

None• data holders – not just organisations that hold large
amounts of personal data, but also those that hold dataon vulnerable citizens here and abroad, such as charities;

None• high-threat targets – such as media organisations,where an attack could harm the UK’s reputation, damage
public confidence in the Government, or endanger
freedom of expression;None• the touchstones of our digital economy – digital service
providers that enable e-commerce and our digital
economy, and who depend on consumer trust in theirservices; andNone• those organisations that, through market forces andauthority, can exert influence on the whole economy to
improve their cyber security, such as insurers, investors,
regulators and professional advisors.

None

5.4.2. More needs to be done to protect these vital parts of oureconomy and support the organisations that heavily
influence others. Our CNI – in both the private andpublic sector – continues to be a target for attack. Acrossthese and many other priority sectors cyber risk is still
not properly understood or managed, even as the threat
continues to diversify and increase.

None

5.4.3. the UK Government, working with the Devolved
Administrations and other responsible authorities whereappropriate, will ensure that the UK’s most importantorganisations and companies, including the CNI, aresufficiently secure and resilient in the face of cyberattack. Neither the Government nor other public bodies
will take on the responsibility to manage this risk for theprivate sector, which rightly sits with boards, owners andoperators.

None

But the Government will provide support and assurance
proportionate both to the threat these companies andorganisations face, and to the consequences of their
being attacked.

None

207

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Our approach 5.4.4. Organisations and company boards are responsible for
ensuring their networks are secure. They must identify
critical systems and regularly assess their vulnerability
against an evolving technological landscape and threat.

Itemised#
Action Item
5404-1 Awareness raising ofboard members

They must invest in technology and their staff to reduce
vulnerabilities in current and future systems, and in their
supply chain, to maintain a level of cyber security
proportionate to the risk.

5404-2 Urging organisations &companies to invest in
security

They must also have tested capabilities in place torespond if an attack happens.

5404-3 Urging organisations &companies to excercise
incident response
5404-4 Cybersecurity in CNI

For the CNI, they must do this with government bodies
and regulators so we can be confident that cyber risk isbeing properly managed and – if it is not – intervene in
the interests of national security.
5.4.5. The Government will, therefore, understand the level ofcyber security across our CNI and have measures inplace to intervene where necessary to drive
improvements that are in the national interest.

5405-1 Government tounderstandcybersecurity levels in
CNI

5.4.6. The Government will:• share threat information with industry that only theGovernment can obtain so they know what they must
protect themselves against;• produce advice and guidance on how to manage cyberrisk and, working collaboratively with industry andacademia, define what good cyber security looks like;• stimulate the introduction of the highend security
needed to protect the CNI, such as training facilities,
testing labs, security standards and consultancy services;
and

None
5406-1 Sharing information
with CNI
5406-2 Setting a new standard
by collaborating withindustries & academia
5406-3 Encouraging investmentin the latest technologies• conduct exercises with CNI companies to assist them in 5406-4 Exercising with CNI
managing their cyber risks and vulnerabilities.
5.4.7. The NCSC will provide these services for the UK’s mostNoneimportant companies and organisations, including the
CNI. It will do so in partnership with departments andregulators, who will assure whether cyber risk is being
managed in their sectors to the level demanded by thenational interest.
5.4.8. The Government will also make sure that the right
regulatory framework for cyber security is in place, onethat:• ensures industry acts to protect itself from the threat;• is outcome focused and sufficiently flexible so that it
will not fall behind the threat, or lead to compliancerather than sound risk management;• is agile enough to foster growth and innovation, rather
than lead it;• is harmonised with regimes in other jurisdictions so that
UK companies do not suffer from a fragmented andburdensome approach; and• delivers, when combined with effective support fromthe Government, a competitive advantage for the UK.
5.4.9. Many of our industry sectors are already regulated forcyber security.
Nonetheless, we must ensure the right steps are taken
across the whole economy, including the CNI, to manage
cyber security risks.

208

None

5408-1 Private sector mind-set
5408-2 Flexible policies forprivate sector
cybersecurity
5408-3 Promoting growth ofcybersecurity industries
5408-4 Coordinatinginternational legal
frameworkNone
None
5409-1 Cybersecurity as aregulation

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Itemised
Objective/Approach/Measuring#
Action Item
Measuring
5.4.1 The Government will measure its success in protecting
5410-1 Metrics
success
0. our CNI and other priority sectors by assessing progress
towards the following outcomes:• we understand the level of cyber security across theNone
CNI, and have measures in place to intervene, where
necessary, to drive improvements in the national interest;and• our most important companies and organisations
understand the level of threat and implement
proportionate cyber security practices.
5.5.1. A successful UK digital economy relies upon theconfidence of businesses and the public in online
services. The UK The Government has worked withindustry and other parts of the public sector to increaseawareness and understanding of the threat. The
Government has also provided the public and businesswith access to some of the tools that they need to protect
themselves. While there are many organisations that are
doing an excellent job – in places, world-leading – ofprotecting themselves, and in providing services toothers online, the majority of businesses and individuals
are still not properly managing cyber risk.

None

Objective

5.5.2. Our objective is to ensure that individuals andorganisations, regardless of size or sector, are taking
appropriate steps to protect themselves, and theircustomers, from the harm caused by cyber attacks.

None

Our approach

5.5.3. The Government will provide the advice that theeconomy needs to protect itself. We will improve how
this advice is delivered to maximise its effect. For the
public, the Government will harness ‘trusted voices’ toincrease the reach, credibility and relevance of ourmessage. We will provide advice that is easy to act uponand relevant to individuals, at the point they areaccessing services and exposing themselves to risk.

5.5. CHANGING
PUBLIC AND
BUSINESSBEHAVIOURS

None

5503-1 Public awareness raising

We will involve the Devolved Administrations and otherNoneauthorities as appropriate.
5.5.4. For businesses, we will work through organisations such 5504-1 Using cybersecurity
as insurers, regulators and investors which can exert
insurance for corporate
influence over companies to ensure they manage cyberawareness raisingrisk. In doing so, we will highlight the clear businessbenefits and the pricing of cyber risk by market
influencers. We will seek to understand better why manyorganisations still fail to protect themselves adequately
and then work in partnership with organisations such asprofessional standards bodies, to move beyond raisingawareness to persuade companies to take action. We will
also make sure we have the right regulatory frameworkin place to manage those cyber risks the market fails to
address. As part of this, we will seek to use levers, suchas the GDPR, to drive up standards of cyber security andprotect citizens.
5.5.5. Individuals and organisations and organisations in the
UK will have access to the information, education, andtools they need to protect themselves. To ensure wedeliver a step-change in public behaviour, we will
maintain a coherent and consistent set of messages oncyber security guidance from both the Government andour partners.
The NCSC will provide technical advice to underpin thisguidance. It will reflect business and public priorities andpractices, and be clear, easily accessible and consistent,
while keeping pace with the threat.

5505-1 Making information,
education, tools easily
available to public &corporates

None

Law enforcement will work closely with industry and the 5505-2 Intelligence sharing
NCSC to share the latest criminal threat intelligence, tobetween government &support industry to defend itself against threats, and tolaw enforcement
mitigate the impact of attacks on UK victims.

209

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Measuring
5.5.6. The Government will measure its success in protecting
success
our CNI and other priority sectors by assessing progress
towards the following outcomes:• the UK economy’s level of cyber security is as high as,or higher than, comparative advanced economies;• the number, severity and impact of successful cyberattacks against businesses in the UK has reduced,
because cyber hygiene standards have improved; and• there is an improving cyber security culture across the
UK because organisations and the public understandtheir cyber risk levels and understand the cyber hygiene
steps they need to take to manage those risks.

5.6. MANAGING
INCIDENTSAND
UNDERSTANDI
NG THETHREAT

Objectives

Our approach

210#

Itemised
Action Item
(same as 5.4.10)

None
None

None

5.6.1. The number and severity of cyber incidents affecting
organisations across the public and private sector are
likely to increase. We therefore need to define how boththe private sector and the public engage with theGovernment during a cyber incident. We will ensure that
the UK Government’s level of support for each sector –taking into account its cyber maturity – is clearly definedand understood. The Government’s collection anddissemination of information about the threat must be
delivered in a manner and at a speed suitable for all
types of organisation. The private sector, government
and the public can currently access multiple sources of
information, guidance and assistance on cyber security.

None

This must be simplified.
5.6.2. We must ensure that the Government offering, both inresponse to incidents, and in the provision of guidance,
does not exist in isolation, but in partnership with theprivate sector. Our incident management processes
should reflect a holistic approach to incidents, whereby
we learn from partners and share mitigation techniques.
We will also continue to use our relationships with other
Computer Emergency Response Teams (CERTs) and ourallies as an integrated part of our incident management
function.

None
None

5.6.3. Current incident management remains somewhat
fragmented across government departments and thisstrategy will create a unified approach. The NCSC will
deliver a streamlined and effective government-led
incident response function.

None

In the event of a serious cyber incident, we will ensurethat the Armed Forces are able to provide assistance,
whether in a conventional form addressing the physicalimpact of an incident, or in the form of specialist support
from regular or reserve cyber personnel. While we will
provide all the support our resources will allow, theGovernment continues to stress the importance ofindustry, society and the public acting to safeguard theirbasic cyber security.

None

5.6.4. Our objectives are as follows:• the Government will provide a single, joined-up
approach to incident management, based on an improved
understanding and awareness of the threat and actions
being taken against us. The NCSC will be a key enabler,
as will partnership with the private sector, law
enforcement and other government departments,
authorities and agencies;

None
None

• the NCSC defines clear processes for reporting
incidents, tailored to the profile of the victim; and• we will prevent the most common cyber incidents, andwe will have effective information-sharing structures inplace to inform ‘pre-incident’ planning.
5.6.5. It is the responsibility of organisation and company
management, in both the public and private sector, toensure their networks are secure and to exercise incident
response plans. In the event of a significant incident, theGovernment incident management process will reflect
the three distinct elements of a cyber incident: theprecursor causes, the incident itself and the post-incident
response.

None
None

None

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
5.6.6. To deliver incident management that is effective for bothgovernment and the private sector, we will work closely
to review and define the scope of the Government
response to ensure it reinforces cooperation.
We will build on our national cyber exercise plan, using
our improved understanding and awareness of the threat,
to improve our offer of support to public and private
sector partners.

Itemised#
Action Item
5606-1 Enhancing cooperation
in incident response
between government &private sector
5606-2 Performing intersectoral exercise

5.6.7. We will create a trusted and credible government identity 5607-1 Trust between
for incident advice, assistance and assurance. This will
government & private
increase the cyber security awareness across the UK
sectordigital community and will enable us the better to
identify trends, take pro-active measures and, ultimately,
prevent incidents.

Measuring
success

6. DETER

6.1. CYBER’S ROLE
IN
DETERRENCE

5.6.8. In moving towards automated information sharing (i.e.
cyber security systems automatically alerting each otherto incidents or attacks), we will deliver a more effective
service. This will allow organisations to act swiftly on
relevant threat information.

5608-1 Automated information
sharing system

5.6.9. The Government will measure its success in managing
incidents by assessing progress towards the following
outcomes:• a higher proportion of incidents are reported to theauthorities, leading to a better understanding of the sizeand scale of the threat;• cyber incidents are managed more effectively,
efficiently and comprehensively, as a result of thecreation of the NCSC as a centralised incident reporting
and response mechanism; and5609-1 Metrics

None

None

• we will address the root causes of attacks at a national
level, reducing the occurrence of repeated exploitation
across multiple victims and sectors.
6.0.1. The National Security Strategy states that defence andprotection start with deterrence. This is as true incyberspace as any other sphere. To realise our vision ofa nation that is secure and resilient to cyber threats, andprosperous and confident in the digital world, we have to
dissuade and deter those who would harm us and ourinterests. To achieve this we all need to continue to raiselevels of cyber security so that attacking us incyberspace – whether to steal from us or harm us – isneither cheap nor easy. Our adversaries must know thatthey cannot act with impunity: that we can and will
identify them, and that we can act against them, using themost appropriate response from amongst all the tools at
our disposal. We will continue to build global alliancesand promote the application of international law incyberspace. We will also more actively disrupt theactivity of all those who threaten us in cyberspace andthe infrastructure on which they rely. Delivering thisambition requires world-class sovereign capabilities.

None

6.1.1. Cyberspace is only one sphere in which we must defend
our interests and sovereignty. Just as our actions in thephysical sphere are relevant to our cyber security anddeterrence, so our actions and posture in cyberspacemust contribute to our wider national security.

None

6.1.2. The principles of deterrence are as applicable incyberspace as they are in the physical sphere. The UK
makes clear that the full spectrum of our capabilities will
be used to deter adversaries and to deny them
opportunities to attack us. However, we recognise thatcyber security and resilience are in themselves a meansof deterring attacks that rely on the exploitation ofvulnerabilities.

None

None

211

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
6.1.3. We will pursue a comprehensive national approach to
cyber security and deterrence that will make the UK aharder target, reducing the benefits and raising the costs
to an adversary – be they political, diplomatic, economic
or strategic. We must ensure our capability and intent to
respond are understood by potential adversaries in order
to influence their decision-making.
We shall have the tools and capabilities we need: to deny
our adversaries easy opportunities to compromise our
networks and systems; to understand their intent andcapabilities; to defeat commodity malware threats at
scale; and to respond and protect the nation incyberspace.

6.2. REDUCINGCYBER CRIME

Objective

212#

Itemised
Action Item
None

None

6.2.1. We need to raise the cost, raise the risk, and reduce thereward of cyber criminals’ activity. While we must
harden the UK against cyber attacks and reduce
vulnerabilities, we must also focus relentlessly on
pursuing criminals who continue to target the UK.

None

6.2.2. Law enforcement agencies will focus their efforts on
pursuing the criminals who persist in attacking UK
citizens and businesses. We will work with domestic andinternational partners to target criminals wherever they
are located, and to dismantle their infrastructure andfacilitation networks. Law enforcement agencies will
also continue to help raise awareness and standards ofcyber security, in collaboration with the NCSC.

None

6.2.3. This strategy complements the 2013 Serious andOrganised Crime Strategy, which set out the UK
Government’s strategic response to cyber crime,
alongside other types of serious and organised crime.
The National Cyber Crime Unit (NCCU) that sits within
the National Crime Agency (NCA) was established tolead and coordinate the national response to cyber crime.
Action Fraud provides a national reporting centre forfraud and cyber crime. A network of cyber crime units
within Regional Organised Crime Units (ROCUs)
provide access to specialist cyber capabilities at aregional level, supporting the NCCU and local forces.

None

6.2.4. We will reduce the impact of cyber crime on the UK and
its interests by deterring cyber criminals from targeting
the UK and relentlessly pursuing those who persist in
attacking us.

NoneAppendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Our approach 6.2.5. To reduce the impact of cyber crime, we will:• enhance the UK’s law enforcement capabilities andskills at national, regional and local level to identify,
pursue, prosecute and deter cyber criminals within the
UK and overseas;

Itemised
Action Item
None
6205-1 Enhancing law
enforcement capability
in national, regional &local levels#• build a better understanding of the cyber crime business 6205-2 Making UK inefficientmodel, so we know where to target interventions in ordercybercrime target based
to have the most disruptive effect on criminal activity.
on understanding of
We will use this knowledge to: - make the UK a highcybercrime businesscost, high-risk environment in which to operate bymodel
targeting the UK nexus of criminality, and by working
with industry to reduce the ability of criminals to exploit
UK infrastructure; and - tackle cyber crime upstream,adding friction to the criminal business model by
dismantling their infrastructure and financial networks,
and wherever possible, bringing offenders to justice.

Measuring
success

6.3. COUNTERINGHOSTILEFOREIGN
ACTORS• build international partnerships to end the perceived
impunity of cyber criminals acting against the UK, bybringing criminals in overseas jurisdictions to justice;• deter individuals from being attracted to, or becoming
involved in, cyber crime by building on our earlyintervention measures;• enhance collaborations with industry to provide themwith proactive intelligence on the threat, and to provide
us with the upstream intelligence that they possess, inorder to assist with our upstream disruption efforts;

6205-3 International juridical
partnership• develop a new 24/7 reporting and triage capability in
Action Fraud, linked to the NCSC, the NCA’s National
Cyber Crime Unit and the wider law enforcement
community, to improve support to victims of cybercrime, to provide a faster response to reported crimes
and enhanced protective security advice. A newreporting system will be established to share informationin real time across law enforcement on cyber crime andthreats;

6205-6 New 24/7 reporting
system• work with the NCSC and the private sector to reduce
vulnerabilities in UK infrastructure that could be
exploited at scale by cyber criminals; and• work with the finance sector to make the UK a more
hostile environment for those seeking to monetise stolen
credentials, including by disrupting their networks.
6.2.6. The Government will measure its success in reducing
cyber crime by assessing progress towards the following
outcomes:• we have a greater disruptive effect on cyber criminals
attacking the UK, with higher numbers of arrests andconvictions, and larger numbers of criminal networks
dismantled as a result of law enforcement intervention;

6205-4 Discouraging
individuals being
involved in cybercrime6205-5 Exchanging intelligencewith industry

6205-7 Reducing vulnerabilities
in infrastructures
6205-8 Making use of stolen
credentials difficult inUK
6206-1 Metrics

None• there is improved law enforcement capability, including
greater capacity and skills of dedicated specialists andmainstream officers and enhanced law enforcement
capability amongst overseas partners;

None• there is improved effectiveness and increased scale ofearly intervention measures dissuades and reforms
offenders; and• there are fewer low-level cyber offences as a result ofcyber criminal services being harder to access and lesseffective.
6.3.1. We need to bring to bear the full range of government
capabilities to counter the threat posed by hostile foreign
actors that increasingly threaten our political, economic
and military security. Working with international
partners will be key to our success, and greater emphasis
will be placed on engaging them and working with themto counter the threat. Much of this action will not be in
the public domain.

None

Our investment in sovereign capabilities and partnerships
with industry and the private sector will continue tounderpin our ability to detect, observe and identify thisconstantly evolving activity against us.

None

None

None

213

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Objective
6.3.2. We will have strategies, policies and priorities in placefor each adversary, to ensure a proactive, well-calibrated
and effective approach is taken to counter the threat andin order to drive down the number and severity of cyberincidents in the future.
Our approach

Measuring
success

Itemised
Action Item
None

None
6303-1 Applying internationallaw in cyberspace

and the development and implementation of confidencebuilding measures;• work with international partners, particularly throughcollective defence, cooperative security, and enhanced
deterrence that our membership of NATO affords;• identify both the unique and generic aspects of ouradversaries’ cyber activity;• generate and explore all available options for deterringand countering this threat, drawing on the full range ofgovernment capabilities. We will take full account ofother related factors, including country-specificstrategies, international cyber priorities, and cyber crimeand prosperity objectives;6303-2 Confidence building• use existing networks and relationships with our key
international partners to share information about current
and nascent threats, adding value to existing thought andexpertise; and6303-6 Intenational information
sharing6303-3 Enhancing NATOcooperation
6303-4 Understanding cyber
activity of adversaries
6303-5 Generating all available
options• attribute specific cyber identities publicly when we
6303-7 Attributing specificjudge it in the national interest to do so.
identities
6.3.4. The Government will measure its success in countering
6304-1 Metrics
the actions of hostile foreign actors by assessing progress
towards the following outcomes:• the stronger information-sharing networks that we haveNone
established with our international partners, and wider
multilateral agreements in support of lawful andresponsible behaviour by states, are substantiallycontributing to our ability to understand and respond to
the threat, resulting in a better defended UK; and• our defence and deterrence measures, alongside ourcountry-specific strategies, are making the UK a hardertarget for hostile foreign actors to act against.
6.4.1. The technical capability of terrorists currently remains
limited but they continue to aspire to conduct damaging
computer network operations against the UK, withpublicity and disruption as the primary objective of theircyber activity. The Government will identify and disrupt
terrorists using and intending to use cyber for thispurpose. In doing so, we will minimise their impact andprevent an uplift in terrorist cyber capability that would
further threaten UK networks and national security.

None

Objective

6.4.2. To mitigate the threat of terrorist use of cyber, throughthe identification and disruption of terrorist cyber actors
who currently hold, and aspire to build, capability that
could threaten UK national security.

None

Our approach

6.4.3. To ensure the threat posed by cyber terrorism remains
low, we will:• detect cyber terrorism threats, identifying actors whoare seeking to conduct damaging network operations
against the UK and our allies;• investigate and disrupt these cyber terrorism actors toprevent them from using cyber capability against the UK
and its allies; and• work closely with international partners to enable us tobetter tackle the threat from cyber terrorism.

None

6.4. PREVENTINGTERRORISM

214

6.3.3. To reduce the cyber threat from hostile foreign actors,
we will:• reinforce the application of international law incyberspace in addition to promoting the agreement ofvoluntary, non-binding norms of responsible statebehaviour#None6403-1 Enhancing detection of
cyber terrorism
6403-2 Enhancing investigationof cyber terrorism
6403-3 International
cooperation

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Measuring
6.4.4. The Government will measure its success in preventing
success
terrorism by assessing progress towards the following
outcomes:• a full understanding of risk posed by cyber terrorism,
through identification and investigation of cyberterrorism threats to the UK; and• close monitoring, and disruption of terrorist cybercapability at the earliest opportunity, with the aim ofpreventing an increase in such terrorist capability in thelong term.

6.5. ENHANCING
SOVEREIGNCAPABILITIES –OFFENSIVE
CYBER

Itemised#
Action Item
6404-1 Metrics

None

None

6.5.1. Offensive cyber capabilities involve deliberate intrusions
into opponents’ systems or networks, with the intentionof causing damage, disruption or destruction. Offensive
cyber forms part of the full spectrum of capabilities wewill develop to deter adversaries and to deny them
opportunities to attack us, in both cyberspace and thephysical sphere.

None

Through our National Offensive Cyber Programme(NOCP), we have a dedicated capability to act incyberspace and we will commit the resources to develop
and improve this capability.

None

Objective

6.5.2. We will ensure that we have at our disposal appropriate
offensive cyber capabilities that can be deployed at atime and place of our choosing, for both deterrence andoperational purposes, in accordance with national andinternational law.

None

Our approach

6.5.3. To do this, we will:• invest in our NOCP – the partnership between the
Ministry of Defence and GCHQ that is harnessing theskills and talents of both organisations to deliver thetools, techniques and tradecraft required;• develop our ability to use offensive cyber tools; and• develop the ability of our Armed Forces to deploy
offensive cyber capabilities as an integrated part ofoperations, thereby enhancing the overall impact we canachieve through military action.

None
6503-1 Enhancing developmentof cyber HR

6503-2 Developing offensive
cyber capability
6503-3 Integrating offensive
cyber capability toarmed forces

Measuring
success

6.5.4. The Government will measure our success in
6504-1 Metrics
establishing offensive cyber capabilities by assessing
progress towards the following outcomes:• the UK is a world leader in offensive cyber capability;Noneand• the UK has established a pipeline of skills andNoneexpertise to develop and deploy our sovereign offensive
cyber capabilities.
6.6.1. Cryptographic capability is fundamental to protecting ourNonemost sensitive information and to choosing how wedeploy our Armed Forces and national security
capabilities. To maintain this capability, we will require
private sector skills and technologies that are assured by
GCHQ. This is likely to require work to be done in theUK, by British Nationals with the requisite security
clearance, working for companies who are prepared tobe completely open with GCHQ in discussing design andimplementation details. The MOD and GCHQ are
working to establish a sound understanding of the longterm cost implications of maintaining such sovereign
cryptographic capabilities, based on prevailing market
conditions and in cooperation with those companies
currently able to provide such solutions.

Objective

6.6.2. We have the confidence that the UK will always havepolitical control over those cryptographic capabilities
vital to our national security and, therefore, the means toprotect UK secrets.

6.6. ENHANCING
SOVEREIGNCAPABILITIES –CRYPTOGRAPH
Y

None

215

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Itemised
Objective/Approach/Measuring#
Action ItemOur approach 6.6.3. We will select the means that allow us to share6603-1 Creating new
information effectively with our allies, and ensure that
requirement oftrusted information and information systems are
cryptography
available, when and where required. Working closelywith other government departments and agencies, GCHQ
and MOD will together define sovereign requirements,and how best to meet those requirements when suppliersmust be domestic. This will be delivered through a new
joint framework for determining requirements for
operational advantage and freedom of action.
Measuring
success

7. DEVELOP

7.1. STRENGTHENING CYBER
SECURITYSKILLS

Objective

216

6.6.4. The Government will measure its success in maintaining 6604-1 Metrics
our cryptographic capabilities by assessing progress
towards the following outcome:• our sovereign cryptographic capabilities are effective inNone
keeping our secrets and sensitive information safe fromunauthorised disclosure.
7.0.1. The DEVELOP strand of the strategy sets out how we
Nonewill acquire and strengthen the tools and capabilities that
the UK needs to protect itself from the cyber threat.
7.0.2. The UK requires more talented and qualified cyberNonesecurity professionals.
The Government will act now to plug the growing gap
None
between demand and supply for key cyber security roles,
and inject renewed vigour into this area of education andtraining. This is a long-term, transformative objective,
and this strategy will kick-start this important work,
which will necessarily continue beyond 2021.
A skilled workforce is the lifeblood of a vital and world
leading cyber security commercial ecosystem. Thisecosystem will ensure cyber start-ups prosper andreceive the investment and support they need. This
innovation and vigour can only be provided by theprivate sector; but the Government will act to support its
development, and actively promote the wider cybersecurity sector to the world market. A dynamic andthriving scientific research sector is required to support
both the development of highly skilled people, and toensure that new ideas translate into cutting-edge
products.

None

7.1.1. The UK needs to tackle the systemic issues at the heartof the cyber skills shortage: the lack of young people
entering the profession; the shortage of current cybersecurity specialists; insufficient exposure to cyber andinformation security concepts in computing courses; ashortage of suitably qualified teachers; and the absenceof established career and training pathways into theprofession.

None

7.1.2. This calls for swift intervention by the Government tohelp address the current shortage and develop a coherent
long-term strategy that can build on these interventions
to close the skills gap. However, it must be recognisedthat to have any profound impact, this effort must becollaborative, with input from a range of participants andinfluencers across the Devolved Administrations, public
sector, education providers, academia bodies andindustry.

None

7.1.3. The Government’s ambition is to ensure the sustained
supply of the best possible home-grown cyber security
talent, whilst funding specific interventions in the shortterm to help meet known skills gaps.

None

We will also define and develop the cyber security skills
needed across the population and workforce to operatesafely and securely online.
7.1.4. This requires action over the next twenty years, not justthe next five. We will define the long-term, coordinatedset of actions needed by government, industry, education
providers and academia to establish a sustained supply ofcompetent cyber security professionals, who meet therequisite standards and certification to practise
confidently and securely.

None

None

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
7.1.5. We will close the skills gap in Defence. We will attract
cyber specialists to government who are not only
effectively trained but also ready to maintain our national
security. This includes an understanding of the impact ofcyberspace on military operations.
Our approach

7.1.6. We will develop and implement a self-standing skills
strategy that builds on existing work to integrate cybersecurity into the education system. This will continue toimprove the state of computer science teaching overall
and embed cyber security into the curriculum. Everyone
studying computer science, technology or digital skills
will learn the fundamentals of cyber security and will beable to bring those skills into the workforce. As part ofthis effort, we will address the gender imbalance incyber-focused professions, and reach people from morediverse backgrounds, to make sure we are drawing fromthe widest available talent pool. We will work closelywith the Devolved Administrations to encourage aconsistent approach across the UK.

#

Itemised
Action Item
None

7106-1 Including cybersecurity
into computer scienceeducation

7.1.7. We will set out more clearly the respective roles of7107-1 Making clear rolls ofgovernment and industry, including how these might
government & private
evolve over time. The UK Government and Devolved
sector in cybersecurity
Administrations have a key role in creating the righttraining
environment for cyber security skills to be developed andto update the education system to reflect the changing
needs of industry and government.
But employers also have a significant responsibility to
7107-2 Urging corporate
clearly articulate their needs, as well as train and develop
management to train
employees and young people entering the profession.
employees
Industry has an important role in building diverse andattractive career and training pathways in partnershipwith academia, professional bodies and tradeassociations.
7.1.8. In recognition of the collective challenge we face inclosing the skills gap, we will establish a skills advisorygroup formed of government, employers, professional
bodies, skills bodies, education providers and academia,
which will strengthen the coherence between these key
sectors. This group will support the development of along-term strategy which will take account ofdevelopments in the broad field of digital skills, ensuringthat cyber security considerations are aligned andincorporated throughout. This group will work withsimilar bodies across the UK.

7107-3 More attractive careersof cybersecurity
professionals
7108-1 Inter-sectoral
coordination of
education/training

217

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
7.1.9. Alongside this work, the Government will invest in arange of initiatives to bring about immediate
improvements and inform the development of the longterm skills strategy. These include:#

Itemised
Action ItemNone

• establishing a schools programme to create a step7109-1 Specialist education
change in specialist cyber security education and training
targeting 14-18 years
for talented 14-18 year olds (involving classroom-based
activities, after-school sessions with expert mentors,
challenging projects and summer schools);• creating higher and degree-level apprenticeships within 7109-2 Degree-level
the energy, finance and transport sectors to address skills
apprenticeship in
gaps in essential areas;
energy, finance &transport• establishing a fund to retrain candidates already in theworkforce who show a high potential for the cybersecurity profession;• identifying and supporting quality cyber graduate andpost graduate education, and identifying and filling any
specialist skills gaps – acknowledging the key role that
universities play in skills development;

7109-3 Retraining funds• supporting the accreditation of teacher professional
development in cyber security. This work will help
teachers, and others supporting learning, to understandcyber security education and provide a method ofexternally accrediting such individuals;

7109-5 Accredition of teachers7109-4 Supporting high quality
post graduate education• developing the cyber security profession, including
7109-6 Identifying excellent
through achieving Royal Chartered status by 2020,
organisation
reinforcing the recognised body of cyber security
excellence within the industry and providing a focal point
which can advise, shape and inform national policy;• developing a Defence Cyber Academy as a centre of
excellence for cyber training and exercise across the
Ministry of Defence and wider Government, addressing
specialist skills and wider education;

7109-7 Defence cyber academy
to CoE• developing opportunities for collaboration in training
and education between government, the Armed Forces,industry and academia, together with facilities tomaintain and exercise skills; and7109-8 Collaborating between
government, forces,industry & academia• we will work with industry to expand the CyberFirst7109-9 CyberFirst: nurturing
programme to identify and nurture the diverse young
young talent programmetalent pool to defend our national security; and• embedding cyber security and digital skills as an
7109-10 Cybersecurity education
integral an integral part of relevant courses within thefrom primary to
education system, from primary to postgraduate levels,
postgraduate
setting standards, improving quality and providing a firm
foundation for onwards progression into the field.
As education is a devolved matter, some of these
initiatives will apply mainly in England. We will
however work with the Devolved Administrations toencourage a consistent approach across the UK
education systems.
Measuring
success

7.1.1 The Government will measure our success in
7110-1 Metrics
0. strengthening cyber security skills by assessing progress
towards the following outcomes:• there are effective and clear entry routes into the cyberNone
security profession, which are attractive to a diverse
range of people;• by 2021 cyber security is taught effectively as anNoneintegral part of relevant courses from primary to postgraduate level;• cyber security is widely acknowledged as anNoneestablished profession with clear career pathways, andhas achieved Royal Chartered Status;• appropriate cyber security knowledge is an integral partNoneof the continual professional development for relevant
non-cyber security professionals, across the economy;
and• the Government and the Armed Forces and the Armed
Forces have access to cyber specialists able to maintainthe security and resilience of the UK.

218

None

None

Appendix D

SectionNational Cyber Security Strategy 2016 - 2023
Subsection
Objective/Approach/Measuring
7.2. STIMULATING
7.2.1. A burgeoning and innovative cyber security sector is a
GROWTH IN
necessity for our modern, digital economy. UK cyber
THE CYBER
security firms provide world-leading technologies,
SECURITY
training and advice to industry and governments.
SECTOR

Objective

Our approach#

Itemised
Action Item
None

But whilst the UK is a leading player, it faces fierce
competition to stay ahead. There are also barriers that
the Government needs to address. UK companies andacademics develop cutting-edge technology, but somerequire support to develop the commercial andentrepreneurial skills required to thrive.

None

There are funding gaps that prevent SMEs from growing
and expanding into new markets and territories. The
most groundbreaking products and services, that offer
the potential to keep us ahead of the threat, struggle tofind customers who are willing to act as early adopters.

None

Overcoming these challenges requires government,
industry and academia to work effectively together.
7.2.2. The Government will support the creation of a growing,
innovative and thriving cyber security sector in the UK inorder to create an ecosystem where:• security companies prosper, and get the investment
they need to grow;• the best minds from government, academia and theprivate sector collaborate closely to spur innovation; andNone• customers of the Government and industry are
sufficiently confident and prepared to adopt cutting-edge
services.
7.2.3. To create this ecosystem, we will:• commercialise innovation in academia, providing
training and mentoring to academics;

None

None

None
None

None
7203-1 Supporting
commercialisation ofacademic innovation• establish two innovation centres, to drive the7203-2 Establishing innovation
development of cutting-edge cyber products and dynamic
centres
new cyber security companies, which will sit at the heartof a programme of initiatives to give start-ups the
support they need to get their first customers and attract
further investment;• allocate a proportion of the £165m Defence and Cyber
Innovation Fund to support innovative procurement in
defence and security;• provide testing facilities for companies to develop theirproducts, together with a fast-track form of assessment
for the next generation of cyber security products andservices as they emerge, enabling customers to be
confident in their use;

7203-3 Allocating funds

7203-4 Providing testing
facilities• draw on the collective expertise of the industry7203-5 Enhancing cooperation
government Cyber Growth Partnership to help shape andbetween industry &focus further growth and innovation interventions;
government• help companies of all sizes scale-up and access
7203-6 Supporting scaling-up
international markets; and• promote agreed international standards that support
7203-7 Promoting international
access to the UK market.
standards for easier
market access7.2.4. We will also use the weight of government procurement 7204-1 Easier access toto spur innovation. The Government faces some of thegovernment
hardest challenges in cyber security, and some of the
procurement for startbiggest threats. We can, and must, pursue the mostups
effective solutions to these problems. That means making
it easier for smaller companies to do business withgovernment. It also means the Government must be lessrisk averse in testing and using new products.
This is a win-win solution: the Government will get thebest services, and innovative technology will get an early
adopter, making it easier to attract investment and alarger customer base. We will encourage all parts ofgovernment, including the Devolved Administrations, totake a similar approach.

None

219

Appendix D

SectionNational Cyber Security Strategy 2016 - 2023
Itemised
Objective/Approach/Measuring#
Action Item
Measuring
7.2.5. The Government will measure its success in stimulating 7205-1 Metrics
success
growth in the cyber security sector by assessing progress
towards the following outcomes:• greater than average global growth in the size of theNone
UK cyber sector year on year;• a significant increase in investment in early stage
None
companies;• adoption of more innovative and effective cyberNonesecurity technologies in government.
7.3. PROMOTING
7.3.1. The UK’s thriving science and technology sector and its
None
CYBER
cutting-edge research, underpins our world-leading cyber
SECURITY
security capabilities. To maintain and enhance the UK’s
SCIENCE AND
reputation as a global leader in cutting-edge research, we
TECHNOLOGY
need our academic research establishments to continue
to attract the best and the brightest minds in the field ofcyber security. This will require us to foster centres of
excellence that attract the most able and dynamic
scientists and researchers, and deepen the active
partnership between academia, the Government andindustry. This will involve a match-making role for theGovernment, where we incentivise such collaborations.
Subsection

Objective

Our approach

220

Success would see us establish a selfsustaining
ecosystem that allows ideas – and people – to circulate
between the three sectors in a mutually beneficial way.
7.3.2. By 2021, the UK will have strengthened its position as aworld leader in cyber science and technology.
Flexible partnerships between universities and industry
will translate research into commercially successful
products and services. The UK will maintain its
reputation for innovative excellence, including in thoseareas of exceptional national strength, such as thefinancial sector.

None

None
None

7.3.3. To achieve this, the Government will encourage
7303-1 Making researchcollaboration, innovative and flexible funding models forfunding more effective
research, and the commercialisation of research.
Government will ensure that the human and behavioural 7303-2 Human & behaviouralaspects of cyber are given sufficient attention, and that
aspects of cyber sciencesystems beyond the technical, such as business processes
and organisational structures, are included within cyberscience and technology.
7.3.4. This will underpin the creation of products, systems andservices that are ‘secure by default’, with appropriate
security considered from the outset and where security
becomes a conscious ‘opt-out’ for users.

7304-1 Enhancing 'secure-bydefault'

7.3.5. We will publish a detailed Cyber Science andTechnology Strategy after a thorough consultation withpartners and stakeholders. This will include identifying
areas of science and technology that the Government,
industry and academia consider to be important andidentifying gaps in the UK’s current capacity to addressthem.

7305-1 Establishing Cyber
Science and Technology
Strategy

7.3.6. The Government will continue to provide funding andsupport for the Academic Centres of Excellence,
Research Institutes and Centres for Doctoral Training.
In addition, we will create a new Research Institute in a
strategically important subject area. We will also fundfurther research in those areas where the upcoming
Cyber Science and Technology Strategy identifies
capability gaps. Important areas that will be given
consideration include: big data analytics; autonomous
systems; trustworthy industrial control systems; cyberphysical systems and the Internet of Things; smart cities;
automated system verification; and the science of cybersecurity.

7306-1 Supporting academic
CoE, research institutes& doctral training
7306-2 Establishing new
research institute

7.3.7. We will continue to sponsor UK national PhD students
at the Academic Centres of Excellence to increase thenumber of UK nationals with cyber expertise.

7307-1 Supporting PhD

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
7.3.8. The Government will work with bodies, including
Innovate UK and the Research Councils to encourage
collaboration between industry, the Government andacademia. To support this collaboration we will review
best practice concerning security classifications andidentify security-cleared experts, including academics.
This will ensure that work from the unclassified space tobeyond secret can be as collaborative as possible.

Itemised#
Action Item
7308-1 Encouraging
collaboration between
government, industry &academia

7.3.9. The Government will fund a ‘grand challenge’ to identify 7309-1 Funding 'grandand provide innovative solutions to some of the mostchallenge'pressing problems in cyber security. CyberInvest, a new
industry and Government partnership to support cuttingedge cyber security research and protect the UK incyberspace, will be part of our approach to building theacademic-government-industry partnership.
Measuring
success

7.4. EFFECTIVE
HORIZON
SCANNING

Objective

Our approach

7.3.1 The Government will measure its success in promoting
0. cyber security science and technology by assessing
progress towards the following outcomes:• significantly increased numbers of UK companies
successfully commercialising academic cyber research
and fewer agreed and identified gaps in the UK’s cybersecurity research capability with effective action to close
them; and7310-1 Metrics

None• the UK is regarded as a global leader in cyber security
research and innovation.
7.4.1. The Government must ensure that policy-making takes
account of the changing cyber, geopolitical andtechnology landscape. To do this, we need to makeeffective use of broad horizon scanning and assessment
work. We need to invest in proofing ourselves against
future threats and anticipate market changes that might
affect our cyber resilience in five to ten years’ time.

None

We need horizon scanning programmes that generate
recommendations to inform current and future
government policy and programme planning.
7.4.2. The Government will ensure that our horizon scanning
programmes include a rigorous assessment of cyber risk,
and that this is integrated into cyber security and othertechnology policy development areas, along with allsource assessment and other available evidence. We will
join up horizon scanning between national security andother policy areas to ensure a holistic assessment ofemerging challenges and opportunities.

None

7.4.3. We will:• identify gaps in current work, and coordinate work
across disciplinary boundaries to develop a holistic
approach to horizon scanning for cyber security;• promote better integration of technical aspects of cybersecurity with behavioural science;• support rigorous monitoring of the cyber criminal
market place to spot new tools and services that mightenable technology transfer to hostile states, terrorists or
criminals;• analyse emergent internet-connected process control
technologies;• anticipate vulnerabilities around digital currencies; and

None

None

None
7403-1 Promoting interdisciplinary research fordevelopment of horizon
scanning
7403-2 Integration of
cybersecurity &behavioural science
7403-3 Monitoring cybercriminal market

7403-4 Investigating newtechnologies
7403-5 -do-• monitor market trends in telecommunications
7403-6 Early defence
technologies to develop early defences against
technology
anticipated future attacks.
7.4.4. We recognise that horizon scanning goes beyond the7404-1 Including cybersecurity
technical, to include political, economic, legislative,
into any other researchsocial and environmental dimensions. Cyber security is
areas for horizon
just one aspect of the issues that effective horizon
scanning
scanning can help to address. Therefore, we will ensurethat where we conduct horizon scanning of these otherpolicy areas, we will take into account any cyber security
implications.

221

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
7.4.5. We will also ensure that cyber policy-making follows anevidence-based approach, taking into accountassessments from all available sources. This will include,for example:

Measuring
success

8. INTERNATIONALACTION

Objectives

222#

Itemised
Action Item
None

• specific technical evidence, for example on the Internetof Things, or the future role of advanced materials; andNone• international strategic and societal trends and theirimpact on cyber.
7.4.6. We will ensure that cyber security is considered within
the remit of the cross- Government Emerging
Technology and Innovation Analysis Cell (ETIAC),
which will be established to identify technology threats
and opportunities relevant to national security and thatcyber is considered by existing horizon-scanningstructures, including the Government Futures Group(GFG), and the Cabinet Secretary’s Advisory Group on
horizon scanning (CSAG).

None

7.4.7. The Government will measure our success inestablishing an effective horizon scanning capability byassessing progress towards the following outcomes:• cross-government horizon scanning and all-source
assessment are integrated into cyber policy making; and• the impact of cyber security is factored into all crossgovernment horizon scanning.
8.1. Our economic prosperity and social wellbeing
increasingly depend on the openness and security of
networks that extend beyond our own borders.
It is essential that we work closely with international
partners to ensure the continuation of a free, open,
peaceful and secure cyberspace that delivers thesebenefits. This will only become more important as thenext billion users come online across the globe.

None

7407-1 Metrics

None
None
None

None

8.2. International cooperation on cyber issues has become an
essential part of wider global economic and security
debates. It is a rapidly evolving area of policy, without asingle agreed international vision. The UK and its allies
have been successful in ensuring some elements of therules-based international system are in place: there has
been agreement that international law applies incyberspace; that human rights apply online as they dooffline; and a broad consensus that the multi-stakeholder
approach is the best way to manage the complexities ofgoverning the Internet.

None

However, with a growing divide over how to address thecommon challenge of reconciling national security withindividual rights and freedoms, any global consensus
remains fragile.

None

8.3. The UK aims to safeguard the long-term future of a free,open, peaceful and secure cyberspace, driving economic
growth and underpinning the UK’s national security. On
this basis, the UK will continue to: champion the multistakeholder model of internet governance; oppose data
localisation; and work to build the capacity of ourpartners to improve their own cyber security. In order toreduce the threat to the UK and our interests, much ofwhich originates overseas, we will seek to influence thedecision-making of those engaging in cyber crime, cyberespionage, and disruptive or destructive cyber activity
and continue to build frameworks to support
international cooperation.

None

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Our Approach 8.4. To do this we will:• strengthen and embed a common understanding of
responsible state behaviour in cyberspace;

Itemised
Action Item
None
84---1 Contributing tointernational debate ofinternational law incyber space#• build on agreement that international law applies incyberspace;• continue to promote the agreement of voluntary, nonbinding, norms of responsible state behaviour;• support the development and implementation ofconfidence-building measures;• increase our ability to disrupt and prosecute cybercriminals based abroad, especially in hard-to-reachjurisdictions;• help foster an environment which allows our law
enforcement agencies to work together to ensure fewer
places exist where cyber criminals can act without fearof investigation and prosecution;

84---2 -do-

• promote the resilience of cyberspace by shaping thetechnical standards governing emerging technologies
internationally (including encryption), making
cyberspace more ‘secure by design’ and promoting bestpractice;84---7 Promoting international
standards & bestpractices in emerging
technologies• work to build common approaches amongst likeminded countries for capabilities such as strong
encryption, which have cross-border implications;84---8 Cross-bordercooperation incapabilities & newtechnologies• build the capacity of others to tackle threats to the UK,
and our interests overseas;• continue to help our partners develop their own cybersecurity – since we share a single cyberspace, wecollectively become stronger when each country
improves its own defences;

84---9 Assist other countries tobuild capabilities
84---10 Assist other countries toenhance cybersecurity• ensure that NATO is prepared for the conflicts of the
21st century, which will play out in cyberspace as wellas on the battlefield;• work with our allies to enable NATO to operate aseffectively in cyberspace as it does on land, air and sea;and• ensure that the ‘London Process’ of Global
Conferences on Cyberspace continues to promote global
consensus towards a free, open, peaceful and secure
cyberspace.

84---11 Enhancing NATO's
capability in cyber space

8.5. There are a range of relationships and tools we willcontinue to invest in to deliver and underpin all ourinternational cyber objectives; we cannot achieve ourobjectives in isolation. These include:

84---3 -do84---4 Confidence building
measures84---5 Cross-borderprosecution
84---6 Enhancing law
enforcement

84---12 -do-84---13 Contributinginternational norm
development in cyber
space
None

• working in concert with traditional allies and new
partners to establish and maintain strong active politicaland operational relationships; creating the politicalconditions to build strong global alliances;

85---1 Enhancing cooperation
with allies• using our influence with multilateral organisations suchas the United Nations, G20, European Union, NATO,
OSCE, Council of Europe, the Commonwealth andwithin the global development community; and85---2 Contributing tointernational
oganisations• building stronger relationships with non-government
actors – industry, civil society, academia and thetechnical community. These actors are crucial in
informing and challenging international policy
formulation, and strengthening political messages on awide range of cyber issues. Our world-class academic
links provide a neutral, collaborative platform withinternational partners.

85---3 Cooperatinginternational nongovernment actors

223

Appendix D

Section

9. METRICS

Subsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
Measuring
8.6. The Government will measure its success in advancing
Success
our international interests in cyber by assessing progress
towards the following outcomes:• enhanced international collaboration reduces cyberthreat to the UK and our interest overseas;• a common understanding of responsible state behaviour
in cyberspace;• international partners have increased their cybersecurity capability; and• strengthened international consensus on the benefits ofa free, open, peaceful and secure cyberspace.
9.1. Cyber security remains an area of relative immaturity
when it comes to the measurement of outcomes andimpacts – normally referred to as metrics. Already thescience of cyber security has been obscured byhyperbole and obstructed by an absence of calibrated
data. This is a source of frustration for policy-makers
and businesses alike, who have struggled to measureinvestment against outcomes.
The Government assesses that the effective use of
metrics is essential for delivering this strategy andfocussing the resources that underpin it.
9.2. We will ensure that this strategy is founded upon arigorous and comprehensive set of metrics against which
we measure progress towards the outcomes we need toachieve. As well as being a major deliverable under theStrategy in its own right, the NCSC will play a crucialrole in enabling other parts of Government, industry andsociety to deliver all of these strategic outcomes within
this strategy.

224

Itemised#
Action Item
86---1 Metrics

None
None
None
None
None

None

None

Appendix D

SectionSubsection

National Cyber Security Strategy 2016 - 2023
Objective/Approach/Measuring
9.3. Annex 3 sets out how the success measures set out in thestrategy will contribute to the strategic outcomes, which
will be reviewed annually to ensure they accuratelyreflect our national goals and requirements. The
headline, strategic outcomes are as follows:#

Itemised
Action Item
None

1. The UK has the capability effectively to detect
investigate and counter the threat from the cyber
activities of our adversaries.
2. The impact of cybercrime on the UK and its interests
is significantly reduced and cyber criminals are deterredfrom targeting the UK.
3. The UK has the capability to manage and respondeffectively to cyber incidents to reduce the harm theycause to the UK and counter cyber adversaries.
4. Our partnerships with industry on active cyber defence
mean that large scale phishing and malware attacks are
no longer effective.
5. The UK is more secure as a result of technology
products and services having cyber security designed
into them and activated by default.
6. Government networks and services will be as secure
as possible from the moment of their first
implementation. The public will be able to use
government digital services with confidence and trustthat their information is safe.

None

7. All organisations in the UK, large and small, areeffectively managing their cyber risk and are supported
by high quality advice designed by the NCSC,
underpinned by the right mix of regulation andincentives.

None

8. There is the right ecosystem in the UK to develop andsustain a cyber security sector that can meet our national
security demands.
9. The UK has a sustainable supply of home growncyber skilled professionals to meet the growing demandsof an increasingly digital economy, in both the public andprivate sectors, and defence.

None

10. The UK is universally acknowledged as a global
leader in cyber security research and development,
underpinned by high levels of expertise in UK industry
and academia.

None

11. The UK government is already planning andpreparing for policy implementation in advance of futuretechnologies and threats and is ‘future proofed’.
12. The threat to the UK and our interests overseas is
reduced due to increased international consensus andcapability towards responsible state behaviour in a free,open, peaceful and secure cyberspace.

None

13. UK Government policies, organisations andstructures are simplified to maximise the coherence andeffectiveness of the UK’s response to the cyber threat.
9.4. We recognise that some of our ambitions for this strategy
go beyond its five year timescale. In order that any future
investment in cyber beyond 2021 can continue to deliver
the maximum transformative effect, we intend that these
longer term outcomes are allocated beyond 2021 toindustry, regulators, auditors, insurers and other parts ofthe public and private sector, as the effective
management of cyber security risks is integrated into
standard management activity for all.

None

None

None

None

None

None

None

None

None

225

Appendix E

Appendix E Japanese Action Items Allocated to Tentative ANC3T#

Action Item

7-111a Promoting 'Security-by-Design' in new business harnessing
IoT systems.
7-112a Promoting 'Security-by-Design' in new & large scalebusiness harnessing IoT systems.
7-112a2 Promoting secure IoT systems based on "General
Framework for Secure IoT Systems".
7-112b Considering measures to exterminate 'bot-net'.
7-113a Promoting "IoT Security Guidelines".

Allocation (Requirement ID)
1
2
3
4
511L2-4 512L1-2 513L3-1
511L2-4 512L1-2 513L3-1
511L2-4
221L2-2 521L2-1 541L2-1
511L2-4

7-113a2 Promoting "IoT Security Guidelines" as international
511L3-3standard.
7-113b Promoting "EDSA certification" (security certification for
133L3-1 511L2-4
control systems).
7-113c Analysing open source information & warning organisations 122L4-2 131L3-2 132L2-1
of vulnerable systems.
7-113d Continuing operation of reporting & dissemination system 571L3-1 571L3-2
for vulnerability information.
7-114a Researching innovative & advanced technologies.
321L2-5 322L2-2

51
Promotion of use of standards & bestpractices
Promotion of use of standards & bestpractices
Promotion of use of standards & bestpractices
Promotion of online trust established
Promotion of use of standards & bestpractices
Contributing to international standards
Cybersecurity oriented risk
management in CI
Early warning capability
Established responsible disclosure
processes
Research & development incybersecurity promoted
Regular review of technical security
controls
Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI

7-114b Researching technologies for security countermeasures for 541L3-2
IoTs.
7-114c Developing technologies of threat analysis & risk evaluation 133L3-1 511L2-1
for control systems.
7-114d Researching & developing technologies for automotive
133L3-1 511L2-1 541L3-2
security in "SIP: Cross-ministerial Strategic Innovation
Promotion Program".
7-114e Promoting countermeasures against vulnerable IoT products 213L3-1 221L2-2 221L3-1
Most users have mind-set
in the market based on "Policy for IoT Security
Countermeasures ver.1.0".
7-121a Surveying & promoting cybersecurity measures of
311L3-2 312L3-1 511L2-3 511L2-4 511L2-5 Metrics for effectiveness of awarenessenterprises based on "Guidelines of Cybersecurity forraising programmes
Corporate Management".
7-121b Promoting "Cybersecurity Management Guidelines".
Mind-set spread in private sector
212L3-1 312L3-1 511L2-1
7-121c Promoting cybersecurity insurance & "Cybersecurity
Executives' understandings of
312L3-1 511L2-1 512L3-1 562L2-1
Management Guidelines" by requiring them in national
cybersecurity measurestenders.
7-122a Promoting human resources development for each category 312L3-1 312L3-3 331L2-4 331L3-2 331L3-3 Executives' understandings of- board members, bridge personnel & working-level - based
cybersecurity measures
on "Cybersecurity Human Resources Development
Program".
7-123a Promoting 'Security-by-Design'.

511L2-4 512L1-2 513L3-1

Promotion of use of standards & bestpractices

212L4-1 312L3-1 511L2-2

Mind-set commonplace in private
sector
Security consideration in all stages

7-123b same as 7-121c2
7-123b2 Promoting "Cybersecurity Management Guidelines" to
SMEs (small-to medium-sized enterprises).
7-123c Reviewing rules & regulations so as to improve security ofwhole supply chains of IT development & operation.
7-123d Encouraging corporates to establish CSIRT.

513L3-1 513L4-2
212L3-2 312L3-3

7-123e Performing practical cyber defence exercise "CYDER" at
124L4-1 141L3-1"National Cyber Training Center".
7-123e2 Performing cyber exercises assuming attacks against Tokyo 124L4-1 141L3-1
Olympics/Paralympics in 2020, employing large scale
exercise environment "Cyber Colosseo".
7-123f Performing practical APT exercises.
141L3-1
7-123g Enhancing "J-CRAT: Cyber Rescue Team" (activity toassist organisational incident responses).
7-123h Performing financial industry-wide cyber exercises.

123L3-1

7-123i Promoting "iLogScanner: Attack Indication Detecting Tool
for Websites".
7-123j Continuing & enhancing operation of "J-CSIP: CyberIntelligence Sharing Initiative".
7-123k Continuing & enhancing operation of "ICT-ISAC"(expanded & reorganised from Telecom-ISAC).
7-123l Enhancing "Financial ISAC Japan".

221L2-2 521L2-1

226

141L3-1

Mind-set based strategy in private
sectorScenario testing of incident response
processes
Scenario testing of incident response
processes
High-level scenario of national incident
exercise
Subnational / sectorial incident
response organisations
High-level scenario of national incident
exercise
Promotion of online trust established

132L2-1 132L2-2 132L2-3 132L2-4 153L2-2 Information sharing establishedbetween CI & government
Information sharing established
132L2-1 132L2-2 132L2-3 431L3-3
between CI & government
Information sharing established
132L2-1 132L2-2 132L2-3 431L3-3
between CI & government

Appendix E

2
Promotion of use of standards & bestpractices for procurement
Promotion of use of standards & bestpractices for procurement

Reliable internet infrastructures

Promotion of use of standards & bestpractices
Vulnerability & asset management of
CI assets
Analysis & dissemination processes

Allocation (Requirement Keyword)
3
Security consideration in all stages

4

5

Promotion of use of standards & bestpractices

Metrics of compliance of standards &best practices

Security consideration in all stages

Latest technical controls & patch
managements widely implemented

Information sharing establishedbetween CI & government

Budget for research & education forcybersecurity

Established standards & best practices
Established standards & best practices Regular review of technical security
controls
Promotion of online trust established

Most users can use internet securely

Executives' understandings ofcybersecurity measures

Metrics of adoption of standards &best practices

Executives' understandings ofEstablished standards & best practices
cybersecurity measures
Established standards & best practices Standards & best practices for
Established cybersecurity insurance
procurement widely used & complied market
Executives' understanding of crisis
management plans

Cybersecurity training programmes for Cybersecurity training aligned with
non-professionals
national strategy

Promotion of use of standards & bestpractices for procurement

Security consideration in all stages

Communication skills in cybersecurity
training

Executives' understandings ofStandards & best practices widely usedcybersecurity measures
Adopting standards throughout lifetime
Executives' understanding of crisis
management plans
High-level scenario of national incident
exerciseHigh-level scenario of national incident
exercise

Reliable internet infrastructures
Formal & consistent information
sharing between CI & government
Formal & consistent information
sharing between CI & government
Formal & consistent information
sharing between CI & government

Point of contact
Point of contact
Point of contact

Government engagement in CI
protection
Resources for information exchange
between public & private sectors
Resources for information exchange
between public & private sectors

Intelligence sharing between CI &defence

227

Appendix E#

Action Item

7-131a Cultivating cybersecurity-related business to a growthindustry by establishing certification for security services.
7-131b Promoting "Cloud Security Guidelines" & "Cloud Audit
System".
7-131c Promoting security investment of SMEs (small-to mediumsized enterprises).
7-131d Reconsidering "Copyright Act" about reverse engineering
for security purposes.
7-132a Continuing "Public & Private Sectors Forum for Trade
Secret" to share information about information exfiltration.

Allocation (Requirement ID)
1
2
3
4
561L2-1 561L2-2
511L2-1 561L3-1

5

1
Domestic providers of security
products
Established standards & best practices

312L3-1 511L2-2 511L2-4 541L2-1 541L2-2 Executives' understandings ofcybersecurity measures
Adapted analysis of incidents
121L4-1 124L3-2
311L2-1 431L1-2

National programme of awarenessraising7-132b Promoting "Handbook for Confidential Information
Protection" & "Guide for Handbook for Confidential
Information Protection".
7-132c Promoting guidelines for deterrence/prevention of internal
misconduct within organisations.
7-132d Communicating & negotiating with countries who apply'Forced Localization Measures'.
7-133a Supporting international standardization in security throughparticipation to ISO/IEC JTC1/SC27, ITU-T SG17 etc.
7-133b Supporting international standardization in cryptography,
certification for cryptograph & security products.
7-133c Supporting international standardization in vulnerability
management like SCAP, CVSS etc.
7-133d Supporting international standardization in security
evaluation like PP (Protection Profile) etc.
7-133e Assisting ITPEC (IT Professionals Examination Council:
organisation for a common IT examination in Asian
countries) by 'exporting' "Japan Information-Technology
Engineers Examination".

511L2-1 511L2-4

Established standards & best practices

511L2-1 511L2-4

Established standards & best practices

521L4-2

Optimised cost for internet
infrastructures
Contributing to international standards

7-133f Assisting security management in ASEAN countries.

311L3-4

7-211b Promoting 'Security-by-Design' in IoT & embedded
systems.
7-211c Promoting "How to Secure Your Web Site".

511L2-4 512L1-2 513L3-1

7-211c2 Promoting "AppGoat" (training tool for securedevelopment).
7-211d Researching technologies for securer development & moresophisticated evaluation.
7-211d2 Same as 7-113a3

513L1-3 513L2-2 541L2-5

Coding standards

513L2-2 541L2-5 541L3-2

Education & training for development

511L3-3

511L3-3 571L4-2

Contributing to international privacy
protection online
Contributing to international standards

511L3-3

Contributing to international standards

311L3-4 322L3-3 332L4-1

Contribution to international awarenessraising

412L4-4 511L3-3 551L4-1 551L4-2

Contribution to international awarenessraising
7-133g Assisting establishment of 'secure development' in countries 311L3-4 513L1-3 513L2-2 513L3-1 541L2-5 Contribution to international awarenesswhere Japanese corporates outsource software
raisingdevelopment.
7-133h Researching international standards & evaluation system for 133L3-1 511L3-3
Cybersecurity oriented risk
IoT systems.
management in CI
7-211a Same as 7-123b
Promotion of use of standards & bestpractices
223L2-4 223L2-4 513L1-3 513L2-2 541L2-5 Promotion of trust of e-commerce

7-211d3 Same as 7-113a4
7-211e Same as 7-113h
7-211f Supporting vulnerability management in organisations, by
541L2-1
promoting structured languages for vulnerability
information.
7-211g Promoting 'fuzz testing' for pro-active vulnerability
571L2-1
detection.
7-211h Upgrading "NICTER: Network Incident Analysis Center for 122L4-2
Tactical Emergency Response".
7-211i Continuing operation of "ACTIVE: Advanced Cyber Threat 221L2-2 221L2-3
Response Initiative" (assistance for users to disinfectmalwares from compromised PCs).
7-211j Continuing operation of "TSUBAME" (Asia & Pacific
122L4-2 123L4-2 124L4-4 431L2-1
region internet fixed point observation system).
7-211k Continuing operation of "Council of Anti-Phishing Japan". 221L2-2 431L3-3

Latest technical controls & patch
managements widely implemented

7-211l Promoting "icat: IPA Cyber Security Alert Service".

221L2-2 541L2-1

Promotion of online trust established7-211m Urging public Wi-Fi service providers to prevent
cybercrime & to enable effective tracking back.
7-211n Initiating Wi-Fi service providers & users to safer
communication.
7-211o Considering development of intelligence sharing platform
for government & private sectors.

221L2-2 432L2-2 541L2-4

Promotion of online trust established

213L2-1 221L2-1 221L2-2 541L2-4

Growing number of users have mindset
Information sharing establishedbetween CI & government

228

132L2-1 132L2-2 153L2-2 431L3-3

Established vulnerability disclosure
framework
Early warning capability
Promotion of online trust established

Early warning capability
Promotion of online trust establishedAppendix E
Allocation (Requirement Keyword)2
3
Lowering dependency on foreign
cybersecurity technologies
Security products complied toInternational standards
Standards & best practices widely used Promotion of use of standards & bestpractices
Sophisticated incident analysis

4Latest technical controls & patch
managements widely implemented

5Anti-malware softwares & network
firewalls

Exchange of information between
public & private sectors aboutcybercrimes
Promotion of use of standards & bestpractices
Promotion of use of standards & bestpractices

Contributing to international standards Regular review of relevance of
cryptographic controls
Internationally contributing to
responsible disclosure

International cooperation incybersecurity education

Cybersecurity trained professionals
internationally contributing

Coding standards

Education & training for development

Revision of cryptographic control
policies

Security consideration in all stages

Technical security controls based oninternational frameworks

Education & training for development

Technical security controls based oninternational frameworks

Contributing to international standards

Promotion of use of standards & bestpractices for procurement
Promotion of trust of e-commerce

Security consideration in all stages

Education & training for development

Technical security controls based oninternational frameworks
Regular review of technical security
controls

Technical security controls based oninternational frameworks

Coding standards

User assistance available

Regional coordination
Resources for information exchange
between public & private sectors
Latest technical controls & patch
managements widely implemented
Established informal cooperation
between ISPs & law enforcement
Growing number of users can use
internet securely
Formal & consistent information
sharing between CI & government

Regional coordination

Established ISPs' policies of technicalsecurity control
Promotion of online trust establishedIntelligence sharing between CI &defence

Established formal international
cooperation

Established ISPs' policies of technicalsecurity control
Resources for information exchange
between public & private sectors

229

Appendix E#

Action Item

7-212a Initiating users to security in cyber space.

Allocation (Requirement ID)
1
2
3
4
213L2-1 221L2-1

7-212b Initiating users to secure use of internet, protection fromcybercrimes, latest criminal techniques & safety on
smartphones.
7-212b2 Initiating educators & staff of local public entities toelimination of cyber environment that is harmful to youth.
7-212c Promoting use of electronic signature.

213L2-1 221L2-1 221L3-2 231L2-1

7-212d Initiating youth to secure use of internet & smartphones.

5

1
Growing number of users have mindset
Growing number of users have mindset

213L3-1 221L3-1 251L3-2

Most users have mind-set

221L2-2 551L2-1 551L2-2

Promotion of online trust established

213L3-1 221L3-1 221L3-2 251L3-2

Most users have mind-set

7-212e Continuing moral education for information usage at school. 213L3-1 221L3-1

Most users have mind-set

7-212f Continuing promotion of moral education for internet usage. 221L3-2 251L3-2

Users' ability to control providing
personal information
Growing number of users can secure
personal information online
Most users have mind-set

7-212g Promoting "Information Leakage Prevention Tool" (tool toprevent data exfiltration through file sharing softwares).
7-212h Arousing security awareness of youth.

231L2-1

7-212i Assisting local public entities to raise public awareness of
security.
7-212j Continuing "Safety Class" to raise public awareness of
secure internet usage.
7-212k Assisting local public entities to raise public awareness of
security.
7-212l Supporting SMEs (small-to medium-sized enterprises) toenhance security by training security personnel in SMEs &counsellors for SMEs.
7-212m Providing public & SMEs (small-to medium-sizedenterprises) with intelligence of security incidents &countermeasures.
7-212n Supporting incident response of public & SMEs (small-to
medium-sized enterprises) through "Information Security
Consultation Counter" & "APT Special Consultation
Counter".

213L2-1 221L2-1

213L3-1

213L3-1 221L3-1 221L3-2 231L2-1

Growing number of users have mindset
Most users have mind-set

212L3-1

Growing number of users have mindset
Mind-set spread in private sector

123L3-3 541L2-1

Information sharing across sectors

123L3-1 241L2-2

Subnational / sectorial incident
response organisations

213L2-1 221L2-1

7-212o Collecting, analysing & reporting cybersecurity information. 123L3-3

Information sharing across sectors

7-212p Urging universities to enhance information security.

212L3-1

Mind-set spread in private sector

7-212q Taking course of action to implement newly effected"Amended Act on the Protection of Personal Information".

412L3-1

Cybersecurity legal framework alignedwith international best practices

7-213a Strengthening capability of investigation of cybercrime.

421L3-2 421L3-3

Advanced investigative capabilities forcybercrimes
Statistics & analysis of cybercrime
investigations

7-213b Enhancing cooperation between public, private & academic 421L3-5 431L3-3
sectors, with "JC3: Japan Cybercrime Control Center"(Japanese version of NCFTA (National Cyber-Forensics &Training Alliance) playing the central role.
7-213c Strengthening capability of investigation of unauthorized
421L3-2 431L2-3 431L3-3
access, phishing & illegal acquisition/retention of third party
IDs.
7-213c2 Providing corporates with intelligence of latest criminal
431L3-3techniques, etc.
7-213d Supporting establishment of anti-cybercrime voluntary
213L2-1 221L2-1 221L2-2
corps.
7-213e Strengthening capability of investigation of crimes targeting 421L3-2 431L1-2
smartphone users.

Advanced investigative capabilities forcybercrimes

7-213f Training investigators specialized in cybercrime.

Specialised and continuous training forlaw enforcement officers
Promotion of online trust established

421L4-1

7-213g Collecting & disseminating information about phishing
221L2-2 431L3-3
through operation of "Council of Anti-Phishing Japan".
7-213h Making the most of High-Tech Crime Technology Division 421L4-2
to tackle complicated & diversified cybercrimes.
7-213i Training prosecutors for cybercrimes.
422L4-3
7-213j Taking a course of action against cybercrimes upon
effectuation of "Cyber Criminal Law".

417L3-1 418L3-2

Resources for information exchange
between public & private sectors
Growing number of users have mindset
Advanced investigative capabilities forcybercrimes

Sophisticated digital forensic tools
Specialised and continuous training forprosecutors
Exceeding minimum requirement ininternational agreements on cybercrime

7-213k Promoting "Guidelines Regarding the Protection of Personal 432L2-2
Information in the Telecommunications Business".

Established informal cooperation
between ISPs & law enforcement

7-213k2 Enhancing capabilities to analyse IoTs.

Advanced investigative capabilities forcybercrimes

230

421L3-2 421L4-2

Appendix E

2Growing number of users can use
internet securely
Growing number of users can use
internet securely
Most users can use internet securely
Cryptographic controls widely used
Most users can use internet securely

Allocation (Requirement Keyword)
3

Users' ability to control providing
personal information

4

5

Growing number of users can secure
personal information online

Frequent discussion on social media
security
Secure communication services
Users' ability to control providing
personal information

Frequent discussion on social media
security

Users' ability to control providing
personal information

Growing number of users can secure
personal information online

Most users can use internet securely
Frequent discussion on social media
security

Growing number of users can use
internet securely
Most users can use internet securely
Growing number of users can use
internet securely

Latest technical controls & patch
managements widely implemented
Promotion of incident reporting
channels

Regular training for law enforcement
officers
Resources for information exchange
between public & private sectors

Legislative requirements on
information exchange between public& private sectors

Resources for information exchange
between public & private sectors

Growing number of users can use
internet securely
Exchange of information between
public & private sectors aboutcybercrimes

Promotion of online trust established

Resources for information exchange
between public & private sectors

Exceeding minimum requirement ininternational agreements on cybercrime

Sophisticated digital forensic tools

231

Appendix E#

Action Item
1

Allocation (Requirement ID)
2
3
4

5

1

7-220a N/A
Promoting 5 action plans (specified below) based on "TheBasic Policy of Critical Information Infrastructure
Protection (3rd Edition)".
7-220b Considering & preparing for legislation of security
countermeasures for CIIs.
7-220b2 Monitoring & publishing improvement of security standards
annually.
7-220c Improving security standards for CIIs including risk
assessment, functionality assurance, BCPs & internal audit.
7-220c2 Researching for development of information sharing
platform for CIIs.
7-220d Improving countermeasures against interference in criticalwireless communication.
7-220e Improving stability of telecommunication by analysing
incidents in telecommunication.
7-220f Improving incident response ability of CII operators byperforming cross-sectional exercises.
7-220f2 Performing practical cyber defence exercise "CYDER" for
CIIs at "National Cyber Training Center".
7-220f3 Performing practical cyber defence exercises with CII
operators.
7-220f4 Performing cyber defence exercises in financial services
sector.
7-220g Establishing "ICSCoE: Industrial Cyber Security Center of
Excellence".
7-221a Extending action plans based on "The Basic Policy of
Critical Information Infrastructure Protection (4th Edition)"to SMEs (small-to medium-sized enterprises).
7-222a Enhancing information sharing mechanism for CIIs
specifically;
Considering introduction of severity grades for service
failure.
Diversifying communication method.
Establishing information sharing platform.

133L3-1 411L3-1

132L2-1 133L3-2 161L3-1

Information sharing establishedbetween CI & government

7-222b Increasing participants & enhancing shared information of"J-CSIP: Cyber Intelligence Sharing Initiative".
7-222c Assisting CII operators to respond cyber attacks fromabroad.
7-222d N/AIntra-government cooperation.
7-222e Enhancing analysis of targeted attacks by using proving
environment simulating large scale LAN.
7-222f Enhancing information gathering & analysis on cyberattacks & malwares.
7-222f2 Enhancing information gathering on cyber attacks.

132L2-2

Formal & consistent information
sharing between CI & government
Formal & consistent information
sharing between CI & government

7-222f3 Enhancing information sharing & cooperation with CII
operators.
7-222f4 Enhancing information sharing with CII operators through"Cyber Terrorism Council".
7-222g Enhancing security countermeasures of credit card
settlement system.
7-223a Supporting local public entities for their cybersecurity.

132L2-1

131L4-1 133L4-1 511L4-1

Cybersecurity oriented risk
management in CI
Regular review of CI risk priorities

133L2-2

Vulnerability & asset management of
CI assets
Formal & consistent information
sharing between CI & government
Risk management processes in CI

133L2-2

Risk management processes in CI

133L2-3 141L2-1 141L2-2 141L2-3

National CI incident response plan

133L3-1 141L3-1

Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI
Supply chain management of CI

131L3-2 131L4-1 132L4-1 133L4-1
132L2-2

133L3-1 141L3-1
133L3-1 141L3-1
133L3-1 322L3-4
132L3-3 511L2-6

132L2-2 132L2-4

121L3-2

Incident analysis

431L3-3

211L3-1 211L3-2

Resources for information exchange
between public & private sectors
Resources for information exchange
between public & private sectors
Information sharing establishedbetween CI & government
Information sharing establishedbetween CI & government
Cybersecurity oriented risk
management in CI
Mind-set spread in public sector

7-223b Supporting local public entities to educate & train theirpersonnel for security by holding seminars & e-learning.
7-223b2 Supporting local public entities to revise security policies.

211L3-1

Mind-set spread in public sector

211L3-2

7-223c Providing local public entities with intelligence of security
incidents & countermeasures through "LGWAN: Local
Government Wide Area Network".
7-223d Providing local public entities with services of vulnerability
scanning & malware detection.
7-223d2 Providing local public entities with tools for incident
response exercises.
7-223e Establishing integrated cybersecurity network monitoring
for government & local public entities.
7-223e2 Supporting local public entities to enhance cybersecurity of
their ICTs & to establish cloud network with FY2017
budget.

123L3-1 123L3-3

Mind-set based strategy in public
sectorSubnational / sectorial incident
response organisations

232

431L3-3

132L2-1
133L3-1 541L3-2

541L2-1
141L2-1
123L3-1 541L2-1
123L3-1 541L2-1

Latest technical controls & patch
managements widely implemented
National incident exercise done
Subnational / sectorial incident
response organisations
Subnational / sectorial incident
response organisations

Appendix E

2Regular review of cybersecurity legal
framework
Regular audit of CI
Regular review of CI risk priorities

National incident exercise done

Allocation (Requirement Keyword)
3

4

Regular review of adoption ofstandards & best practices
Ability to adjust of CI protection

Regular audit of CI

Appropriate resources for national
incident exercise

Roles in national incident exercise
defined5High-level scenario of national incident
exerciseHigh-level scenario of national incident
exerciseHigh-level scenario of national incident
exercise
CoE in cybersecurity
Standards & best practices used by CI
supply chains
Regular review of impact analysis ofCI

Redundant communications for key
stakeholders

Government engagement in CI
protection

Regular review of technical security
controls
Mind-set based strategy in public
sectorInformation sharing across sectors

Latest technical controls & patch
managements widely implemented
Latest technical controls & patch
managements widely implemented

233

Appendix E#

Action Item

7-223e3 Urging local public entities to isolate "My Number"(Japanese version of Social Security Number) related
systems/networks from internet.
7-223e4 Urging local public entities to comply with "Guidelines for
Proper Handling of Specific Personal Information".
7-223f Promoting collaboration of public & private sectors on
authentication using "My Number Portal".
7-223g Incorporating vulnerability information for control systems
into existing operation of reporting & dissemination systemfor vulnerability information.
7-223h Performing practical exercises for control systems of CIIs.

Allocation (Requirement ID)
1
2
3
4
222L3-2 541L2-1

Privacy-by-default in e-gov

222L3-2

Privacy-by-default in e-gov

133L3-1 571L2-1 571L2-2

Cybersecurity oriented risk
management in CI

133L3-1 141L3-1

Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI
Continual revision of strategy

Promotion of use of standards & bestpractices
Security consideration in all stages
Regular review of procurement
Standards & best practices for
procurement widely used & complied

124L3-2

124L3-2 124L3-4

Sophisticated incident analysis

123L3-1 124L2-2 124L3-3

Subnational / sectorial incident
response organisations
Subnational / sectorial incident
response organisations
Subnational / sectorial incident
response organisations
High-level scenario of national incident
exercise

512L3-1 512L3-2 551L3-2
541L2-1 541L3-1
541L2-1 541L3-1

123L3-1 124L2-2 124L3-3
123L3-1 124L2-2 124L3-3

7-231m2 Supporting national universities to enhance cybersecurity by 311L3-1 331L2-4
training security personnel.
7-231n Considering to enhance "NATIONAL 318 (CYBER)
124L3-1 331L3-2
EKIDEN" (CTF for government agencies).
7-231o Training digital forensics professionals.
124L3-2 124L3-4 331L3-2

234

Latest technical controls & patch
managements widely implemented
Adequate resources for incident
response

Standards & best practices for
procurement widely used & complied
Standards & best practices for
procurement widely used & complied
Latest technical controls & patch
managements widely implemented
Latest technical controls & patch
managements widely implemented
Sophisticated incident analysis

512L3-1 512L3-2

7-231l3 Performing practical cyber defence exercise "CYDER" for 141L3-1
government agencies with "National Cyber Training
Center".
7-231l4 Performing "NATIONAL 318 (CYBER) EKIDEN" (CTF
124L3-1 331L3-2
for government agencies).
7-231m Sharing cybersecurity intelligence with national universities. 431L1-2

7-231p Promoting "Guidelines for Risk Assessment of Advanced
Cyber Attacks Measurements".
7-232a Performing audit of all government agencies & related
agencies during 2 years based on "Common Standards
Group for Information Security Measures for Government
Agencies and Related Agencies".

1
Privacy-by-default in e-gov

222L3-2

7-223i Promoting security assessment & certification for control
133L3-1 511L2-4 511L2-5
systems.
7-230a Preparing for next revision of "Common Standards Group
111L4-1 113L4-1 511L4-1
for Information Security Measures for Government
Agencies and Related Agencies".
7-231a Monitoring & analysing ICT networks of government
541L2-1
agencies @24/7.
7-231b Strengthening incident response capabilities of government 122L3-2 123L3-1 123L3-3
agencies by enhancing cooperation between CSIRT of
public organisations.
7-231c Urging government agencies to adopt 'security by design' in 511L2-4 512L1-2 513L3-1
procurement.
7-231c2 Urging government agencies to consider security upon
513L3-1
utilisation of cloud network.
7-231d Reviewing "List of Requirements for Ensuring Security in
512L3-2
Procurement of IT Products".
7-231d2 Disseminating information including PP (protection profiles) 512L3-1 512L3-2
to procurement professionals of government agencies.
7-231e Reviewing & promoting "JISEC: Japan Information
Technology Security and Certification Scheme".
7-231f Promoting "JCMVP: Japan Cryptographic Module
Validation Program".
7-231g Performing penetration testing to ICT systems ofgovernment agencies.
7-231h Performing vulnerability scanning & examining
cybersecurity measures of government agencies.
7-231i Speeding up detecting & informing incidents to government
agencies by enhancing GSOC censors/systems.
Considering next generation system of GSOC.
7-231j Reviewing policies for obtaining & storing ICT systems
logs to enhance incident response capabilities.
7-231k Examining CSIRT of government agencies & urging themto enhance incident response capabilities.
7-231l Performing cybersecurity exercises for incident response
personnel of government agencies.
7-231l2 Performing cybersecurity exercises for CYMAT members.

5

511L2-4 541L3-2
123L3-1 511L2-5 541L3-2

Training & accreditation for CSIRT
members establishedExchange of information between
public & private sectors aboutcybercrimes
Sector specific programmes ofawareness raising
Training & accreditation for CSIRT
members established
Sophisticated incident analysis
Promotion of use of standards & bestpractices
Subnational / sectorial incident
response organisations

Appendix E

2Latest technical controls & patch
managements widely implemented

Established vulnerability disclosure
framework

Allocation (Requirement Keyword)
3

4

5

Established processes against
vulnerability information

High-level scenario of national incident
exercise
Promotion of use of standards & best Metrics of compliance of standards &practicesbest practices
Continual revision of strategy
Regular review of adoption ofstandards & best practices

Subnational / sectorial incident
response organisations

Information sharing across sectors

Promotion of use of standards & bestpractices for procurement

Security consideration in all stages

Regular review of procurement

Regular review of procurement
Regular review of procurement

Regular review of cryptographic
control policies

User side security controls
User side security controls

Forensics
Regular training for CSIRT members
Regular training for CSIRT members
Regular training for CSIRT members

Regular review of incident response
processes
Regular review of incident response
processes
Regular review of incident response
processes

Cybersecurity training aligned withnational strategy

Cybersecurity training programmes for
non-professionals
Cybersecurity training aligned withnational strategy
Forensics
Cybersecurity training aligned withnational strategy
Regular review of technical security
controls
Metrics of compliance of standards & Regular review of technical security
best practices
controls

235

Appendix E#

Action Item

7-232b Training cybersecurity personnel & experts based on"General Policy for Cybersecurity Human Resources
Development".
Each government agency establishes own plan for build
security & IT human resources.
7-232c Continuing information sharing in cybersecurity community
across government.
7-232d Supporting government agencies to develop cybersecurity
human resources by training non-security personnel &providing with educational materials.
7-232e Reviewing & reconstructing education & training systems
for IT human resources.
7-233a Researching & developing security measures for cloudservices, standardising if necessary.
7-233b Promoting 'security-by-design' in obtainment of new ICT
systems for administrative operation.
7-234a Performing audit of related agencies (besides government
agencies) on cybersecurity.
7-310a Performing initial response exercises in preparation forpotential large-scale cyber attack.
7-310b Enhancing resources for collection & analysis of cyberattack intelligence from homeland & abroad.
7-311a Enhancing counter-intelligence capabilities.

Allocation (Requirement ID)
1
2
3
4
123L3-1 124L2-2 331L3-2

123L3-1 211L2-1 331L2-4

Evaluating effectiveness of CSIRT
members training
Established standards & best practices

124L4-2 331L3-4 332L3-1
511L2-1 541L2-1

141L2-1

Promotion of use of standards & bestpractices for procurement
Metrics of compliance of standards &best practices
National incident exercise done

153L3-1

Analytical capability in cyber defence

512L1-2 513L1-2 513L3-1
511L2-5 541L1-2 541L3-2

Not allocated7-311d Considering education & training of highly professional
331L3-2
human resources.
7-311e Enhancing protection & analysis equipment & cyber
153L3-1
intelligence collection equipment.
7-311e2 Enhancing security of "DII: Defense Information
161L3-1
Infrastructure".
7-311f Performing practical exercises on environment simulating
141L3-1 161L3-1
defence information systems.
7-311g Training CSIRT members for response against highly
124L3-1 331L3-2
advanced attacks.
7-311h Preparing for penetration testing of defence information
161L3-1
network.
7-311i Researching contingency operation of defence information 161L3-1 161L4-1
infrastructures.
7-312a Implementing cybersecurity measures of supply chains of
132L3-3 511L2-6
defence equipment.
7-312b Backing-up National Research and Development Agencies 321L2-5 322L3-4
with leading technologies especially in information securityarea.
7-312b2 Supporting universities with leading technologies to
321L2-5 322L3-4 541L3-2
enhance countermeasures against information exfiltration by
cyber attacks.
7-313a Enhancing cooperation between MOD & defence industry. 132L3-3 511L2-6

236

1
Subnational / sectorial incident
response organisations

Subnational / sectorial incident
response organisations
Subnational / sectorial incident
response organisations

123L3-1

7-311b N/A
Not referring to specific action plans.
7-311c Enhancing capability of Cyber Force Center by performing 124L3-2 421L3-2
exercises & upgrading monitoring equipment.
7-311c2 Performing cybersecurity exercises for large-scale industrial 133L3-1 141L3-1
control systems.
7-311c3 Enhancing analytic capabilities of malwares.
421L3-2

7-320a Continuing operation of "TSUBAME" (Asia & Pacificregion internet fixed point observation system).
Extending observation points to other regions.
7-321a Positively contributing to international debate ofinternational laws, rules & codes for cyberspace.
7-321b Speeding up international assistance in investigation of
cybercrimes under treaty for mutual legal assistance.
Considering further conclusion of treaty.
7-321c Exchanging information with law enforcement of thosecountries who are related to Japanese cybercrime
circumstances.
7-321c2 Positively contributing to international framework forcooperation of anti-cybercrime.
7-321c3 Enhancing relationship with neighbouring countries byholding Asian Pacific Regional Cyber Crime Investigation
Technical Conferences.

5

122L4-2 123L4-2 124L4-4 431L2-1

Sophisticated incident analysis
Cybersecurity oriented risk
management in CI
Advanced investigative capabilities forcybercrimes
Cybersecurity training aligned withnational strategy
Analytical capability in cyber defence
Redundant communications for key
stakeholders
High-level scenario of national incident
exerciseTraining & accreditation for CSIRT
members established
Redundant communications for key
stakeholders
Redundant communications for key
stakeholders
Supply chain management of CI
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Supply chain management of CI
Early warning capability

151L4-1 152L4-1 153L4-1 417L4-1 418L4-1 Rules of engagement in cyberspace
431L2-2 431L3-2 431L4-1

Mutual legal assistance & extradition

431L2-1 432L1-3

Established formal international
cooperation

417L4-1 418L4-1

Contributing to international
cybercrime treaties
Established formal international
cooperation

431L2-1 432L1-3

Appendix E

2Regular training for CSIRT members

Allocation (Requirement Keyword)3
Cybersecurity training aligned withnational strategy

Most officials have mind-set

Cybersecurity training programmes for
non-professionals

Metrics of effectiveness ofcybersecurity training
Latest technical controls & patch
managements widely implemented
Promotion of use of standards & bestpractices for development
Latest technical security controls
promoted

Review of cybersecurity training
programmes

45

Security consideration in all stages
Regular review of technical security
controls

Advanced investigative capabilities forcybercrimes
High-level scenario of national incident
exercise

Redundant communications for key
stakeholders
Cybersecurity training aligned withnational strategy

Optimised for extended outages
Standards & best practices used by CI
supply chains
CoE in cybersecurity

CoE in cybersecurity

Regular review of technical security
controls

Standards & best practices used by CI
supply chains
Regional coordination
Regional coordination

Cross-border response ability
Strategically expanding international
cooperation

Leading international debate aboutcyber defence
Regular review of international
cooperation

Established formal international
cooperation
Contributing to international
cybercrime treaties

Contributing to international
cybercrime treaties

Informal international cooperation inlaw enforcement
Contributing to international
cybercrime treaties
Informal international cooperation inlaw enforcement237

Appendix E#

Action Item

7-321d Positively contributing to promotion of "Budapest
Convention on Cybercrime" (the first international treaty
seeking to address Internet and computer crime byharmonizing national laws), improving investigativetechniques, & increasing cooperation among nations.

Allocation (Requirement ID)
1
2
3
4
417L2-2 418L2-2 431L2-1

51Participation to international
agreements on cybercrime7-322a Contributing to UN effort to establish international rules to 151L4-1 152L4-1 153L4-1
prevent contingencies from arising out of cyber attacks.
7-322a2 Sharing information about cyber threat & cybersecurity
153L4-2
strategies through bilateral meetings.
7-322b Enhancing international relationship & cooperation through 123L2-3 123L3-2 124L3-5 153L4-2
participating international conferences like "IWWN:International Watch and Warning Network" (established in
2004 to foster international collaboration on addressing
cyber threats, attacks, and vulnerabilities).

Rules of engagement in cyberspace

7-322c Continuing & enhancing international coordination &123L2-3 123L3-2 124L3-5
cooperation in incident responses,
7-323a Enhancing intelligence gathering & analysis of terrorism
151L3-2 152L3-1 153L3-1
activities in cyberspace under direction of Director of
Cabinet Intelligence.
7-323b Enhancing intelligence gathering & analysis of terrorism
153L3-1
activities in cyberspace.
7-324a Government agencies positively support other nations based 123L4-2 124L4-4
on "Basic Policy for Assistance of Cybersecurity Capacity
Building in Developing Counties".
Supporting ASEAN countries to build cybersecurity
capabilities through "ASEAN-Japan Information Security
Policy Meeting".

International cooperation in incident
response
Capturing landscape of national-level
threat7-324a2 Supporting countries in Asian Pacific region to build
cybersecurity capabilities through "Asian Pacific Regional
Cyber Crime Investigation Technical Conferences" &JICA's technical training programs.

Participation to international
cooperation agreements

411L4-2 417L4-1 418L4-1

Intelligence shared with allies
International cooperation in incident
response

Analytical capability in cyber defence
Regional coordination

7-324a3 Contributing to regional cybersecurity awareness raising
311L3-4
through "APT: Asia-Pacific Telecommunity", "ITU-D: ITU
Telecommunication Development Sector" & "Ministerial
Meeting on Telecommunications and Information Industryof APEC: Asia Pacific Economic Cooperation".

Contribution to international awarenessraising7-324a4 Supporting ASEAN countries to build cybersecurity
capabilities through "Asian Pacific Regional Cyber Crime
Investigation Technical Conferences" & "UNODC: United
Nations Office on Drugs and Crime".

123L4-2 124L4-4

Regional coordination

7-324a5 Supporting ASEAN countries to build cybersecurity
capabilities by holding seminars of ISMS & CSMS.
7-324a6 Supporting countries in Asian Pacific & Africa to build &operate national CSIRTs.
7-324a7 Holding seminars for 'secure development' for foreign
software suppliers.
7-325a Encouraging personnel of government agencies & related
agencies to attend international conferences, international
CTFs & foreign schools.
7-330a N/A
Not a specific action.
7-330b Enhancing coordination & cooperation of G7 through "IseShima Cyber Group".
7-330c Continuing & extending international cooperation throughbilateral meetings.
7-330d Enhancing intelligence sharing with foreign governments.

123L4-2 124L4-4

Regional coordination

123L4-2 124L4-4

Regional coordination

332L4-1 511L2-6

Cybersecurity trained professionals
internationally contributing
International coordination

7-330e Contributing to international effort to raise cybersecurity
awareness.
7-330f Enhancing intelligence sharing with foreign law
enforcement & legal communities.
7-330g Researching technologies for measuring cyber health ofcountries/regions ("Cyber Green Project").
7-330h Enhancing information sharing with foreign agencies for
information security like NIST.
7-330i Same as 7-324a, 7-324b

311L3-4

123L3-2 124L3-5 331L3-1

123L2-3 123L3-2 124L3-5
123L2-3 123L3-2 124L3-5
153L4-2

International cooperation in incident
response
International cooperation in incident
response
Intelligence shared with allies

511L3-3

Contribution to international awarenessraising
Established formal international
cooperation
Contributing to international standards

511L3-3

Contributing to international standards

7-330j Considering possible cooperation in cyberspace between
MOD/JSDF & foreign forces.
7-331a Same as 7-324c

123L3-2 124L3-5 152L4-1

International coordination

7-331a2 Building regional confidence measures through "ARF:
ASEAN Regional Forum".

123L4-2 124L4-4

Regional coordination

238

431L2-1 431L3-2 432L1-3

Appendix E

2Participation to international
agreements on cybercrime

Allocation (Requirement Keyword)3
Established formal international
cooperation

Cross-border response ability

Leading international debate aboutcyber defence

International coordination

International coordination

International coordination

International coordination

Advanced capabilities & situationalawareness

Analytical capability in cyber defence

45Intelligence shared with allies

Regional coordination

Contributing to international
cybercrime treaties

Contributing to international
cybercrime treaties

Regional coordination

Regional coordination
Regional coordination
Standards & best practices used by CI
supply chains
International coordination
Cybersecurity training aligned withinternational best practices

International coordination

International coordination

International coordination

International coordination

Strategically expanding international
cooperation

Informal international cooperation inlaw enforcement

International coordination

Cross-border response ability

Regional coordination

239

Appendix E#

Action Item
1

Allocation (Requirement ID)
2
3
4

5
7-331b Supporting countries in Asian Pacific region to establish
Not allocatedcybercrime jurisdiction.
7-331c Establishing cooperation with South-East Asian countries & 123L4-2 124L4-4Australia in cybersecurity.
7-332a Enhancing coordination & cooperation with US through123L2-3 123L3-2 124L3-5"Japan-U.S. Cyber Dialogues".
7-332a2 Enhancing cyber defence cooperation with European
152L4-1 153L4-2
countries through "Japan-UK Bilateral Consultations on
Cyberspace", "Japan-NATO Staff Talks on Cyber defence"& participation in exercises held by NATO.

1

Regional coordination
International cooperation in incident
response
Cross-border response ability

7-332b Enhancing information sharing with US based on "U.S.Japan Policy Cooperation Dialogue on the Internet
Economy".
7-332b2 Promoting cooperation between Japan's ICT-ISAC & US
IT-ISAC.
7-332c Enhancing cyber defence cooperation with US through"U.S.-Japan Cyber defence Policy Working Group".
7-333a Enhancing cooperation through bilateral meetings.

153L4-2

Intelligence shared with allies

431L2-1 432L3-2
152L4-1 153L4-2

Established formal international
cooperation
Cross-border response ability

152L4-1

Cross-border response ability

7-333b Gathering information on latest technologies throughconsultation with "JIWG: Joint Industry Working Group".
7-334a Enhancing cooperation through bilateral meetings.

541L3-2

Regular review of technical security
controls
International cooperation in incident
response
Research & development incybersecurity promoted
Regular review of relevance of
cryptographic controls
Regular review of technical security
controls
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Cybersecurity oriented risk
management in CI
Cybersecurity oriented risk
management in CI
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Regular review of relevance of
cryptographic controls
Revision of cryptographic control
policies

123L2-3

7-410a Establishing "Strategy for Research & Development of
321L2-5
Cybersecurity".
7-410b Researching security assessment of cryptographic algorisms 551L4-1& protocols.
7-411a Researching technologies for countermeasures against cyber 541L3-2
attacks.
7-411a2 Building up large scale reservoir of cybersecurity related
321L2-5
information.
7-411a3 Improving R&D environment by establishing security
321L2-5validation platform.
7-411b Researching technologies for detection & prediction of
133L3-1 541L3-2
cyber attacks on control systems.
7-411b2 Researching technologies for vulnerability management on 133L3-1 541L2-1 541L3-2
control systems without interruption of services.
7-411c Providing with "NONSTOP" (R&D platform for secure
321L2-5
handling of malware samples).
7-411d Researching technologies for data analysis & resilience
321L2-5 541L3-2
against cyber attacks.
7-412a Same as 7-410a2
321L2-5 321L4-1 322L4-1
7-412b Researching technologies for creation of cyber-physicalsystem.
7-412c Promoting researching of advanced AI infrastructure & its
practical research for cybersecurity area.
7-413a Researching for quantum cryptography communication.

321L2-5 321L4-1 322L4-1

7-413b Promoting "The List of Ciphers that should be Referred toin the Procurement for the e-Government System" by"CRYPTREC: Cryptography Research and Evaluation
Committees".

551L4-2

7-413b2 Researching technologies for secure cryptography.

551L4-1

7-413b3 Promoting use of secure cryptography.

551L2-1

321L2-5 321L4-1 322L4-1
551L4-1

Regular review of relevance of
cryptographic controls
Cryptographic controls widely used

7-413c Researching innovative & advanced technologies for
133L3-1 541L4-1
balancing security & efficiency of IoTs.
7-414a Positively contributing to international debate of standards 511L3-3
for information security by participating ITU-T SG17.
7-415a Researching technologies for monitoring & analysis of
133L3-1 521L4-3 521L4-4 541L4-1
control & communication systems through "Cyber-Security
for Critical Infrastructure" of "SIP: Cross-ministerial
Strategic Innovation Promotion Program".

Cybersecurity oriented risk
management in CI
Contributing to international standards

7-420a Promoting human resources development based on"Cybersecurity Human Resources Development Program".
7-421a Promoting practical exercise & PBL (problem basedlearning) on cybersecurity by collaboration of multiple
universities and/or academia-industry.
7-421b Promoting collaboration of industry, government &academia on practical cyber exercises.
7-421c Developing human resources with hybrid careers.

Cybersecurity training aligned withnational strategy
Cybersecurity education adapting tochanging needs

240

331L3-2 332L3-1
321L4-3 322L4-2 322L4-3

322L4-2 331L4-1 331L4-2 332L3-2
322L4-3 331L3-3 331L4-3

Cybersecurity oriented risk
management in CI

Cooperation between all stakeholders
in cybersecurity education
Cybersecurity education aligned withpractical problems

Appendix E

2Allocation (Requirement Keyword)3

4

5

Regional coordination
International coordination

International coordination

Intelligence shared with allies

Cooperation between foreign ISPs &law enforcement
Intelligence shared with allies

Regular review of technical security
controls
Latest technical controls & patch
managements widely implemented

Regular review of technical security
controls
Internationally forerunning incybersecurity education
Internationally forerunning incybersecurity education
Internationally forerunning incybersecurity education

Regular review of technical security
controls

International CoE in cybersecurity
International CoE in cybersecurity
International CoE in cybersecurity

Continuous assess of technical security
controls

Controlled acquisition of criticaltechnologies

Independency & persistence of internet Continuous assess of technical security
infrastructure technologies
controls

Review of cybersecurity training
programmes
Cooperation between all stakeholders
in cybersecurity education

Cybersecurity education aligned withpractical problems

Collaboration between public &private in cybersecurity training
Communication skills in cybersecurity
training

Coordination between cybersecurity
training & education
Incentives for cybersecurity trained
workforce

Coordination of cybersecurity training
across sectors

241

Appendix E#

Action Item

Allocation (Requirement ID)
1
2
3
4
321L3-5 321L4-3 322L4-3

7-421d Enhancing cybersecurity education at colleges oftechnology ("Kosen") based on needs from industry.
Providing with cyber ranges
7-421e Promoting cybersecurity education for working adults at
322L4-2 322L4-3
universities.
7-421f Incorporating cybersecurity education into public vocational 331L2-4 331L4-1
training.
7-422a Promoting education at elementary, middle & high schools 213L3-1 213L4-1 311L4-3 321L3-5
about IT, information security & information moral basedon individual ability of use of IT.
7-422b Training teachers for IT skills & information moral
213L3-1 213L4-1 311L4-3 321L3-5
7-423a Continuing to hold "Security Camp" to raise awareness ofyouth & to discover prominent human resources.
7-423b Jointly promoting CTFs with "JNSA: Japan Network
Security Association".
7-423c Conducting "MITOU Program: Exploratory IT Human
Resources Project" to discover innovative talents.
7-424a Promoting "Information Technology Engineers
Examination" to develop highly skilled IT human resources.

1
Cybersecurity education from primary
to post-graduate
Cooperation between all stakeholders
in cybersecurity education
Cybersecurity training programmes for
non-professionals
Most users have mind-set

Most users have mind-set

213L3-1 321L3-5

Most users have mind-set

332L3-2

Coordination of cybersecurity training
across sectors
Cybersecurity specific degree

321L3-3 321L4-1
331L2-1 331L2-2 332L2-1

7-424b Promoting "Information Security Management Examination" 331L1-2(a subject of "Information Technology Engineers
Examination").
7-424c Supporting young engineers & student to design their career 322L2-3
pass in IT industry.
7-424d Promoting new national qualification "Registered
331L2-2 331L3-2 332L2-3
Information Security Specialist".
7-424e Training youth to cybersecurity expert at "National Cyber
321L3-5 331L4-2
Training Center".
7-425a Sending officials to study at graduate schools.
124L3-1 322L4-3 331L4-1
7-425b Performing upgraded practical cyber defence exercise
141L3-1"(New) CYDER" at "National Cyber Training Center".
7-425c Establishing practical exercise environment of
161L3-1
communication system of JSDF.
7-425d Enhancing cooperation between MOD/JSDF & defence
132L3-3
industry.
7-425d2 Enhancing cooperation between MOD/JSDF & operators of 153L2-1 153L2-2
infrastructures affecting operation.

242

5

Structured cybersecurity training
programmes
Cybersecurity training for general IT
staff
Attractiveness of cybersecurity career
Security professional certification
Cybersecurity education from primary
to post-graduate
Training & accreditation for CSIRT
members establishedHigh-level scenario of national incident
exercise
Redundant communications for key
stakeholders
Supply chain management of CI
Coordination between CI & defenceAppendix E

2
Cybersecurity education adapting tochanging needs
Cybersecurity education aligned withpractical problems
Collaboration between public &private in cybersecurity training
Users' mind-set reducing threat

Users' mind-set reducing threat

Allocation (Requirement Keyword)3
Cybersecurity education aligned withpractical problems

4

Entire society involved in awarenessraising

Cybersecurity education from primary
to post-graduate

Entire society involved in awarenessraising

Cybersecurity education from primary
to post-graduate

5

Cybersecurity education from primary
to post-graduate

Internationally forerunning incybersecurity education
Security professional certification

Cybersecurity training aligned withnational strategy
Coordination between cybersecurity
training & education
Cybersecurity education aligned withpractical problems

Cybersecurity trained & certified
employees

Job creation in cybersecurity

Collaboration between public &private in cybersecurity training

Intelligence sharing between CI &defence243

Appendix F

Appendix F Japanese Action Items Mapping Result by Requirement#

Category

111 Cybersecurity Policy andStrategy

112 Cybersecurity Policy andStrategy

Subcategory
National Cybersecurity
Strategy

National Cybersecurity
Strategy

Capacity area
Strategy Development

Organisation

Level 1
ID
Keywords
111L1-1 Outline of strategy
111L1-2 Development process of strategy

Level 2ID
Nb.
0 111L2-1
0 111L2-2

111L1-3 Stakeholders involved in strategy
development

0

111L2-3

112L1-1 Cybersecurity programme underdevelopment

0112L2-1

112L2-2
112L2-3

113 Cybersecurity Policy andStrategy

National Cybersecurity
StrategyContent

113L1-1 Risk priorities of cybersecurity
defined in strategy

0112L2-4
113L2-1
113L2-2

121 Cybersecurity Policy andStrategy
122 Cybersecurity Policy andStrategy

123 Cybersecurity Policy andStrategy

Incident Response

Identification of Incidents

121L1-1 Recording incidents

0

121L2-1

Incident Response

Organisation

122L1-1 Key incident response organisations inprivate sector identified
122L1-2 N/A

0

122L2-1

0

122L2-2

122L1-3 Ad-hoc responses
123L1-1 Leading incident responseorganisation designated00

123L2-1

Incident Response

Coordination

123L2-2
123L2-3
124 Cybersecurity Policy andStrategy

Incident Response

Mode of Operation

124L1-1 Key incident response processes

0

124L2-1

124L1-2 CSIRT member training

0

124L2-2
124L2-3

131 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Identification
Protection

131L1-1 List of CI assets

0

131L2-1
131L2-2

132 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Organisation
Protection

132L1-1 Informal information sharing between
CI & government

0132L2-1
132L2-2
132L2-3
132L2-4

133 Cybersecurity Policy andStrategy

141 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Risk Management andProtection
Response

Crisis Management

Crisis Management

133L1-1 Access control implemented in CI

0

133L2-1

133L1-2 Basic capacity against cyber threat in
CI
133L1-3 Data security policy in CI

0

133L2-2

0

133L2-3

141L1-1 Assessment of exercise of national
incident
141L1-2 Exercise planning organisation
designated for national incident
141L1-3 Stakeholders' participation in national
incident exercise

0

141L2-1

0

141L2-2

0

141L2-3
141L2-4
141L2-5
141L2-6244

Appendix F
Nb. = Number of Related Action Items
Level 2
Keywords
Strategy established
Stakeholders' consultation in strategy

Level 3ID
Keywords
Nb.
0 111L3-1 Reviewing process of strategy
0 111L3-2 Cyber exercises considered in strategy

Implementation of strategy0

Cybersecurity programme agreed0

Coordinating body of cybersecurity
programme
Goals & measurement ofcybersecurity programme
Discrete budget for cybersecurity
National objectives of cybersecurity
defined in strategy
Minimum coverage of strategy
contents
Central registry of incidents0National CSIRT

0

Roles & responsibilities of national
CSIRT

0

Coordination established0

Communication lines for crisis
International cooperation in incident
response
Incident response processes & tools
established
Regular training for CSIRT members

06

Limited response to national level
incidents

0111L3-3 Measurement of cybersecurity definedin strategy
111L3-4 Capacity building & investment
considered in strategy
112L3-1 PDCA processes of cybersecurity
programme

Level 4ID
Keywords
Nb.
0 111L4-1 Continual revision of strategy
0 111L4-2 Contributing to international debate ofstrategy
0

Nb.
1
0

0
0

112L4-1 Reassignment & reallocation of
resources for cybersecurity programme

0

112L3-2 Consolidated budget for cybersecurity

0

112L4-2 Dissemination & feedbacks aboutcybersecurity programme

0

113L3-1 Measurement of cybersecurity definedin strategy
113L3-2 Protection of critical infrastructures
defined in strategy
121L3-1 Regular revision of incident registry
121L3-2 Incident analysis
122L3-1 Formal roles & responsibilities
allocated
122L3-2 Adequate resources for incident
response

0

113L4-1 Continual revision of strategy

1

0

113L4-2 Contributing to international
cooperation
121L4-1 Adapted analysis of incidents

0

0

1

122L4-1 Sustainability of incident response
capability
122L4-2 Early warning capability

123L3-1 Subnational / sectorial incident
response organisations
123L3-2 International coordination
123L3-3 Information sharing across sectors

13

122L4-3 Capability to manage threat landscape
123L4-1 Coordinating all levels / sectors

0
0

7
4

123L4-2 Regional coordination

8

124L3-1 Training & accreditation for CSIRT
members established
124L3-2 Sophisticated incident analysis

4

2

124L3-3 Regular review of incident response
processes
124L3-4 Forensics
124L3-5 International coordination
131L3-1 Priority of CI risks
131L3-2 Vulnerability & asset management of
CI assets
132L3-1 Centralised management of CI
protection
132L3-2 Public awareness campaign of CI
protection
132L3-3 Supply chain management of CI

3

124L4-1 Scenario testing of incident response
processes
124L4-2 Evaluating effectiveness of CSIRT
members training
124L4-3 Tools against zero-day vulnerabilities

2
7
0
2

124L4-4 Regional coordination

8

131L4-1 Regular review of CI risk priorities

20

132L4-1 Ability to adjust of CI protection

1

0

132L4-2 Trust between CI & government

0133L3-1 Cybersecurity oriented risk
management in CI
133L3-2 Regular review of impact analysis ofCI
133L3-3 Regular review of CI incident responseplans
133L3-4 Regular review of resource allocation
for CI protection
133L3-5 Insider threat detection in CI
141L3-1 High-level scenario of national incident
exercise
141L3-2 Trust between participants of national
incident exercise
141L3-3 SMART objectives & KPI of national
incident exercise
141L3-4 Evaluation of national incident exercise
informing investment
141L3-5 National crisis management alignedwith international best practices
141L3-6 Tailored reports of national incident
exercise18

133L4-1 Regular audit of CI

2

1

133L4-2 Indirect costs inclusive in impact
analysis of CI incidents

0

141L4-1 Peer observance of national incident
exercise
141L4-2 National incident exercise contributing
to international challenges
141L4-3 Internationally shared result of national
incident exercise
141L4-4 National crisis management established

0

0
0
0
0
0

0
4

Audit of CI assets
CI assets audit list

00Information sharing establishedbetween CI & government
Formal & consistent information
sharing between CI & government
Point of contact
Government engagement in CI
protection
Standards & best practices in CI

8

Risk management processes in CI

2

National CI incident response plan

1

7
3
2
0

National incident exercise done3

Appropriate resources for national
incident exercise
Roles in national incident exercise
defined
Incentives to participate in national
incident exercise
Trained monitors of national incident
exercise
Evaluation of national incident
exercise

1
1
0
0
0

0
1
0

5

1

4

1
0

4

0
0
0
12
0
0
0

0
0
0

0
0

245

Appendix F

151 Cybersecurity Policy andStrategy

Cyber Defence

Strategy

Level 1
ID
Keywords
151L1-1 National-level threats identified

152 Cybersecurity Policy andStrategy
153 Cybersecurity Policy andStrategy

Cyber Defence

Organisation

152L1-1 Dispersed cyber operations

0

152L2-1

Cyber Defence

Coordination

153L1-1 Cyber defence capability requirements
agreed0

153L2-1#

Category

Subcategory

Capacity area

Level 2ID
Nb.
0 151L2-1

153L2-2
161 Cybersecurity Policy andStrategy

Communications
RedundancyCommunications
Redundancy

161L1-1 Gaps in emergency communication
identified
161L1-2 Emergency procedures established0

161L2-1

0

161L2-2
161L2-3

211 Cyber Culture and Society Cybersecurity Mind-set

Government

211L1-1 Leading agencies only have mind-set

0

211L2-1

212 Cyber Culture and Society Cybersecurity Mind-set

Private Sector

212L1-1 Leading firms only have mind-set

0

212L2-1

212L1-2 Materials for best practices available

0

213L1-1 Limited users only have mind-set

0

213L2-1

213 Cyber Culture and Society Cybersecurity Mind-set

Users

221 Cyber Culture and Society Trust and Confidence on
the Internet

User Trust and Confidence 221L1-1 A few users can use internet securely
on the Internet
221L1-2 Promotion of online trust exists

0

221L2-1

0

221L2-2

User Trust in E-government 222L1-1 Government's recognition of needs forServices
security in e-gov
222L1-2 Stakeholders' recognition of needs forsecurity in e-gov
222L1-3 A few users can use e-gov securely
222L1-4 Security measures in e-gov

0

221L2-3
222L2-1

0

222L2-2

0
0

222L2-3
222L2-4

User Trust in E-commerce
Services

223L1-1 Limited e-commerce provided

0

222L2-5
223L2-1

223L1-2 Private sectors' recognition of need for
security in e-commerce
223L1-3 A few users can use e-commerce
securely
223L1-4 Security measures in e-commerce

0

223L2-2

0

223L2-3

0

223L2-4
223L2-5

222 Cyber Culture and Society Trust and Confidence on
the Internet

223 Cyber Culture and Society Trust and Confidence on
the Internet

231 Cyber Culture and Society User Understanding of
Personal Information
Protection Online

User Understanding of
Personal Information
Protection Online

231L1-1 Users have only general knowledge
about personal information protection
231L1-2 Discussions on protecting personal
information

0

231L2-1

0

231L2-2

241 Cyber Culture and Society Reporting Mechanisms

Reporting Mechanisms

241L1-1 Reporting channels of incidents

0241L2-1
241L2-2

251 Cyber Culture and Society Media and Social MediaMedia and Social Media

251L1-1 Media coverage of cybersecurity0

251L2-1

251L1-2 Discussion on social media security0

251L2-2
251L2-3

246

Appendix F
Level 2
Keywords
Cyber defence strategy exists

Level 3ID
Keywords
Nb.
0 151L3-1 Dedicated resources for cyber defence
151L3-2 Capturing landscape of national-level
threat151L3-3 Cyber defence strategy meets
objectives
0 152L3-1 Advanced capabilities & situationalawareness
1 153L3-1 Analytical capability in cyber defence

Level 4ID
Keywords
Nb.
0 151L4-1 Rules of engagement in cyberspace
1 151L4-2 Military doctrine in cyberspaceIntelligence sharing between CI &defence
Emergency response assets hardwired

3

Communication between emergency
response functions distributed
Testing, training, drills of emergency
response

01

153L3-2 Strengths & weaknesses of cyberdefence understood
161L3-1 Redundant communications for key
stakeholders
161L3-2 Interoperability & functionality undercompromised situation
161L3-3 Evaluation of national incident exercise
informing investment
161L3-4 Contribution to international
communications' redundancy
211L3-1 Mind-set spread in public sector

20

211L3-2 Mind-set based strategy in public
sector212L3-1 Mind-set spread in private sector

1

6

212L3-2 Mind-set based strategy in private
sector213L3-1 Most users have mind-set

Defined responsibility of cyberdefence organisation
Coordination between CI & defence

Most officials have mind-set

Most private sector actors have mindset

0

0

Nb.
2
0

0
1

152L4-1 Cross-border response ability

6

4

2

0

153L4-1 Leading international debate aboutcyber defence
153L4-2 Intelligence shared with allies

6

161L4-1 Optimised for extended outages

1

0

161L4-2 Assisting neighbours

0

211L4-1 Mind-set commonplace in public
sector0

212L4-1 Mind-set commonplace in private
sector1

9

213L4-1 Users' mind-set reducing threat

2
0

6

0
0
2

3

Growing number of users have mindset
Growing number of users can use
internet securely
Promotion of online trust established6

221L3-1 Most users can use internet securely

5

11

4

User assistance available
E-gov established

1
0

0
0

222L4-1 Promotion of e-gov revised0

Risk reduction in e-gov

0

221L3-2 Users' ability to control providing
personal information
221L3-3 Promotion of online trust evaluated222L3-1 Disclosures of activities of government
agencies
222L3-2 Privacy-by-default in e-gov

221L4-1 Users can evaluate risk & adjust
behaviour
221L4-2 Promotion of online trust revised

3

222L4-2 Data protection measures of e-gov

0

Promotion of e-gov
Growing number of users can use egov securely
Incident disclosure in e-gov
E-commerce established

00

222L3-3 Most users can use e-gov securely
222L3-4 User feedbacks for e-gov

0
0

0
0

223L3-1 Resource allocation for e-commerce00

Secure payment

00Growing number of users can use ecommerce securely
Promotion of trust of e-commerce
Terms & conditions of e-commerce
accessible
Growing number of users can secure
personal information online
Discussions on balance between
security & privacy

0

223L3-2 Most users can use e-commerce
securely
223L3-3 Investment for e-commerce

223L4-1 Continuous improvement of ecommerce
223L4-2 Clear terms & conditions of ecommerce
223L4-3 User feedbacks for e-commerce

231L3-1 Measures to protect personal
information online
231L3-2 Privacy rights

00

231L3-3 Security & privacy balanced

0

231L3-4 Privacy-by-default

0

241L3-1 Coordination of incident reporting
channels
241L3-2 Promotion of incident reporting
channels prioritised
241L3-3 Metrics of incident reporting
251L3-1 Media coverage of information aboutcybersecurity measures
251L3-2 Frequent discussion on social media
security

0

231L4-1 Users can adapt to changing
environments
231L4-2 Wide recognition about personal
information protection
231L4-3 Security & privacy balanced inchanging environment
231L4-4 Regular assessment of privacy
protection
241L4-1 Regular enhancement of incident
reporting
241L4-2 Coordination of response to reported
incidents
251L4-1 Discussion changing policy & society

0

0

0

0
0

2
0
3
0

Incident reporting mechanisms
established
Promotion of incident reporting
channels0

Cybersecurity as common subject inmedia
Wide range of issues of cybersecurity
in media
Broad discussion on social media
security

0

1

0

0

0
0
0

0
0
0
0
0

3

0

247

Appendix F#

Category

311 Cybersecurity Education,
Training and Skills

Subcategory
Awareness Raising

Capacity area
Awareness Raising
Programmes

Level 1
ID
Keywords
311L1-1 Awareness raising programmes
311L1-2 Awareness raising programmes
affected by international initiatives

Level 2ID
Nb.
0 311L2-1
0

311L2-2

311L2-3

312 Cybersecurity Education,
Training and Skills

Awareness Raising

Executive AwarenessRaising

312L1-1 Executives' awareness about generalcybersecurity issues
312L1-2 Executives of particular sectors haveawareness

0

312L2-1

0

312L2-2
312L2-3

321 Cybersecurity Education,
Training and Skills

Framework for Education

Provision

321L1-1 Qualification programme forcybersecurity educators
321L1-2 Professional cybersecurity educators

0

321L2-1

0

321L2-2

321L1-3 Educational courses for cybersecurity0

321L2-3

321L1-4 Demand exists for cybersecurity
education

0

321L2-4
321L2-5

322 Cybersecurity Education,
Training and Skills

Framework for Education

Administration

322L1-1 Cybersecurity education needs
recognised
322L1-2 Ad-hoc supply of resources forcybersecurity education

0322L2-1

0322L2-2
322L2-3

331 Cybersecurity Education,
Training and Skills

332 Cybersecurity Education,
Training and Skills

Framework for Professional Provision
Training

Framework for Professional Uptake
Training

331L1-1 Cybersecurity training needs
recognised
331L1-2 Cybersecurity training for general IT
staff
331L1-3 ICT certification with somecybersecurity issues
331L1-4 Training courses for cybersecurity0

331L2-1

1

331L2-2

0

331L2-3

0

331L2-4

332L1-1 Metrics of uptake of cybersecurity
trainings

0332L2-1
332L2-2

411 Legal and Regulatory
Frameworks

412 Legal and Regulatory
Frameworks

Legal Framework

Legal Framework

Legislative Framework for
ICT Security

Privacy, Freedom of
Speech & Other Human
Rights Online

411L1-1 Discussion of establishing
cybersecurity legal framework
411L1-2 Priorities identified in cybersecurity
legal framework

0332L2-3
411L2-1

0411L2-2

412L1-1 Partial privacy protection legislation

0412L2-1

412L1-2 Freedom of expression

0412L2-2

412L1-3 Discussion of establishing digital
human rights legislation

0412L2-3
412L2-4
412L2-5

413 Legal and Regulatory
Frameworks

414 Legal and Regulatory
Frameworks

248

Legal Framework

Legal Framework

Data Protection Legislation 413L1-1 Partial data protection legislation

0413L2-1

413L1-2 Stakeholders' participation in dataprotection legislation
414L1-1 Partial online child protection
legislation

0413L2-2

0414L2-1

414L1-2 Stakeholders' participation in online
child protection legislation

0414L2-2Child Protection Online

Appendix F
Level 2
Keywords
National programme of awarenessraising
Consultation with stakeholders innational programme of awarenessraising
Cybersecurity information portal

Level 3ID
Keywords
Nb.
1 311L3-1 Sector specific programmes ofawareness raising
0 311L3-2 Metrics for effectiveness of awarenessraising programmes

Level 4ID
Keywords
Nb.
1 311L4-1 Awareness raising programmes
adapted according to effectiveness
1 311L4-2 Revision of national awareness raisingprogramme

00Qualification for cybersecurity
educators established
University level courses forcybersecurity
Degrees in cybersecurity

00

311L3-3 Evolution of awareness raisingprogrammes
311L3-4 Contribution to international awarenessraising
312L3-1 Executives' understandings ofcybersecurity measures
312L3-2 Executives' ability to reallocate
resources
312L3-3 Executives' understanding of crisis
management plans
312L3-4 Mandatory cybersecurity education for
executives
321L3-1 Business experts' participation incybersecurity education
321L3-2 Mandatory cybersecutity courses forcomputer science degrees
321L3-3 Cybersecurity specific degree

Seminars for non-specialist

0321L3-4 Cybersecurity as focusing area

0

Research & development incybersecurity promoted
Broad discussion for enhancing
cybersecurity education
Budget for research & education forcybersecurity
Attractiveness of cybersecurity career

11

5

Structured cybersecurity training
programmes
Security professional certification

1

Cybersecurity training requirements
listedCybersecurity training programmes for
non-professionals
Cybersecurity trained & certified
employees
Knowledge transfer in cybersecurity0

321L3-5 Cybersecurity education from primary
to post-graduate
322L3-1 Cybersecurity education
demand/supply monitored
322L3-2 Adapted budget for cybersecurity
education
322L3-3 International cooperation incybersecurity education
322L3-4 CoE in cybersecurity
331L3-1 Cybersecurity training aligned withinternational best practices
331L3-2 Cybersecurity training aligned withnational strategy
331L3-3 Communication skills in cybersecurity
training
331L3-4 Metrics of effectiveness ofcybersecurity training
332L3-1 Review of cybersecurity training
programmes
332L3-2 Coordination of cybersecurity training
across sectors

Job creation in cybersecurity
Cybersecurity legal framework
established
Coverages of cybersecurity legal
framework1
0

411L3-1 Regular review of cybersecurity legal
framework

1

Executives' basic understandings ofcybersecurity
Limited executives' understandings ofcybersecurity's affectRaising programmes for awareness ofcrisis management

0
0
0

0

0
1
1

2

4
1
0

Nb.
0
0

311L4-3 Entire society involved in awarenessraising
311L4-4 Overall threat reduced by awarenessraising
312L4-1 Cybersecurity as common agenda inboard meetings
312L4-2 Executives' attitude as internationalrole model2

321L4-1 Internationally forerunning incybersecurity education
321L4-2 Balance between core components &adaptive processes
321L4-3 Cybersecurity education adapting tochanging needs

4

0

322L4-1 International CoE in cybersecurity

3

0

322L4-2 Cooperation between all stakeholders
in cybersecurity education
322L4-3 Cybersecurity education aligned withpractical problems

3

331L4-1 Collaboration between public &private in cybersecurity training
331L4-2 Coordination between cybersecurity
training & education
331L4-3 Incentives for cybersecurity trained
workforce

3

332L4-1 Cybersecurity trained professionals
internationally contributing

2

411L4-1 Balance between cybersecurity legal
framework & best practices
411L4-2 Participation to international
cooperation agreements
411L4-3 Exceeding minimum requirement ofinternational cooperation agreement
412L4-1 Amendment procedures forcybersecurity legal framework

0412L4-2 Internet access as human right0

412L4-3 Contributing to international digital
human rights
412L4-4 Contributing to international privacy
protection online

0413L4-1 Amendment procedures for dataprotection legislation

0

414L4-1 Amendment procedures for online
child protection legislation

0

5
6
0

0
0
0

2
0
0
0
1

1
3
1
9
2

0
2

5

2
1

1
2
2

0

Online privacy protected

0412L3-1 Cybersecurity legal framework alignedwith international best practices

1

Freedom of expression protected

0412L3-2 Exceeding minimum requirement ofinternational agreement0

Privacy protected during investigation0

Stakeholders' participation to discuss
digital human rights legislation
Participation to international
agreements
Data protection legislation established

0

Personal data protected0

Online child protection legislation
established0

Legal minors protected

0

1
0
0

1

0
0

413L3-1 Timeframe of storing personal data
during investigation
413L3-2 Data protection legislation aligned withinternational best practices
414L3-1 Online child protection legislationaligned with international bestpractices

0
0
0

249

Appendix F#

Category

415 Legal and Regulatory
Frameworks

416 Legal and Regulatory
Frameworks

417 Legal and Regulatory
Frameworks

Subcategory
Legal Framework

Legal Framework

Legal Framework

Capacity area
Consumer Protection
Legislation

Intellectual Property
Legislation

Substantive Cybercrime
Legislation

Level 1
ID
Keywords
ID
Nb.
415L1-1 Partial consumer protection legislation 0 415L2-1

415L1-2 Stakeholders' participation in
consumer protection legislation
416L1-1 Partial intellectual property legislation

0415L2-2

0416L2-1

416L1-2 Stakeholders' participation in
intellectual property legislation

0

417L1-1 Partial substantive cybercrime
legislation

0417L2-1

417L2-2
418 Legal and Regulatory
Frameworks

Legal Framework

Procedural Cybercrime
Legislation

418L1-1 Partial procedural cybercrime
legislation

0418L2-1
418L2-2

421 Legal and Regulatory
Frameworks

Criminal Justice System

Law Enforcement

421L1-1 Limited digital forensics capabilities inlaw enforcement
421L1-2 Training for law enforcement officers

0421L2-1

0421L2-2
421L2-3

422 Legal and Regulatory
Frameworks

423 Legal and Regulatory
Frameworks

431 Legal and Regulatory
Frameworks

Criminal Justice System

Criminal Justice System

Formal and Informal
Cooperation Frameworks
to Combat Cybercrime

Prosecution

CourtsFormal Cooperation

422L1-1 Limited capabilities to prosecutecybercrimes
422L1-2 Training for prosecutors

0422L2-1

423L1-1 Limited capabilities to judge
cybercrimes
423L1-2 Training for judges

0423L2-1

0423L2-2

431L1-1 Formal international cooperation
against cybercrimes
431L1-2 Exchange of information between
public & private sectors aboutcybercrimes

0431L2-1

3

431L2-2

0431L2-3

432 Legal and Regulatory
Frameworks

511 Standards, Organisations,and Technologies

Formal and Informal
Cooperation Frameworks
to Combat Cybercrime

Adherence to Standards

Informal Cooperation

ICT Security Standards

432L1-1 Exchange of information between
government & justice aboutcybercrimes
432L1-2 Cooperation between ISPs & law
enforcement
432L1-3 Informal international cooperation inlaw enforcement
511L1-1 Standards for information risk
management
511L1-2 Standards for information risk
management partly used
511L1-3 International standards & bestpractices implemented

0432L2-1

0432L2-2

3

432L2-3

0511L2-1

0

511L2-2

0511L2-3
511L2-4
511L2-5
511L2-6250

Level 2

Appendix F
Level 2
Keywords
Consumer protection legislation
established
Responsible agency designated for
consumer protection
Intellectual property legislation
established

Level 3ID
KeywordsNb.
0 415L3-1 Consumer protection legislationaligned with international bestpractices0

Level 4ID
KeywordsNb.
0 415L4-1 Amendment procedures for consumer
protection legislation

Nb.
0

0

416L3-1 Intellectual property legislation alignedwith international best practices

0416L4-1 Balance between intellectual property& open access policy

0416L3-2 Stakeholders' participation in
amendment of intellectual property
legislation
417L3-1 Exceeding minimum requirement ininternational agreements on cybercrime

01

417L4-1 Contributing to international
cybercrime treaties

3

417L3-2 Amendment procedures for substantive
cybercrime legislation
418L3-1 Procedural cybercrime legislation
enables cross-border investigation
418L3-2 Exceeding minimum requirement ininternational agreements on cybercrime

0417L4-2 Regular review of substantive
cybercrime legislation
418L4-1 Contributing to international
cybercrime treaties
418L4-2 Regular review of proceduralcybercrime legislation

00
421L4-1 Specialised and continuous training forlaw enforcement officers
421L4-2 Sophisticated digital forensic tools

1

421L4-3 Regular review of investigative
capabilities for cybercrimes

00423L3-2 Institutional structures of courts

0422L4-1 Prosecution of cross-bordercybercrimes
422L4-2 Dedicated prosecutorial resources forcybercrimes
422L4-3 Specialised and continuous training forprosecutors
423L4-1 Specialised and continuous training forjudges423L4-2 Regular review of court systemcapabilities to judge cybercrimes

00

418L3-3 Amendment procedures for proceduralcybercrime legislation
421L3-1 Dedicated investigative resources forcybercrimes
421L3-2 Advanced investigative capabilities forcybercrimes
421L3-3 Regular training for law enforcement
officers
421L3-4 Cross-border investigation of
cybercrimes
421L3-5 Statistics & analysis of cybercrime
investigations
422L3-1 Institutional structures in prosecution
services
422L3-2 Statistics & analysis of cybercrime
prosecutions
422L3-3 Exchange of best practices between
prosecutors & judges
423L3-1 Centralised judges for cybercrimes

423L3-3 Statistics & analysis of cybercrimeconvictions
431L3-1 Communication channels forinternational cooperation
431L3-2 Strategically expanding international
cooperation

0
431L4-1 Regular review of international
cooperation
431L4-2 Interoperability of formal & informalinternational cooperation

1

431L4-3 Regularly adjusted informationexchange between public & private
sectors
432L4-1 Adapted cooperation & exchange of
information

01

432L4-2 Adapted international cooperation

00

432L4-3 Interoperability of formal & informalinternational cooperation
511L4-1 Regular review of adoption ofstandards & best practices
511L4-2 Decision making of non-compliance tostandards & best practices
511L4-3 Risk-based decision making ofcompliance0

Substantive cybercrime legislation
exists0Participation to international
agreements on cybercrime
Procedural cybercrime legislation
existsParticipation to international
agreements on cybercrime1Comprehensive investigative
capabilities for cybercrimes
Established chain of custody of digital
evidence
Standards for training for law
enforcement officers

Comprehensive prosecutorial
capabilities for cybercrimes

Sufficient jurisdictional capabilities forcybercrimes
Specialised training for judges

0
1

0
0
0

0

0
1

0
6
1

0
0
0
0

Legislative requirements on
information exchange between public& private sectors
Established informal cooperation
between government & justice1

431L3-3 Resources for information exchange
between public & private sectors

10

0

0

Established informal cooperation
between ISPs & law enforcement
Informal international integration inlaw enforcement
Established standards & best practices

2Standards & best practices widely
used
Metrics of adoption of standards &best practices
Promotion of use of standards & bestpractices
Metrics of compliance of standards &best practices
Standards & best practices used by CI
supply chains2

432L3-1 Established relationship among
government, prosecutors, judges & law
enforcement
432L3-2 Cooperation between foreign ISPs &law enforcement
432L3-3 Joint international investigation &prosecution
511L3-1 Risk-based adoption of standards &best practices
511L3-2 Resource allocation based on standards

1

511L3-3 Contributing to international standards

9

8

2

1

7

0

0

0

Established formal international
cooperation
Mutual legal assistance & extradition

1

3

0
2

0
0

0
1
0
0

0

0

2
0
0

14
4
4

251

Appendix F#

Category

512 Standards, Organisations,and Technologies

Subcategory
Adherence to Standards

Capacity area
Standards in Procurement

Level 1
ID
Keywords
512L1-1 Standards & best practices for
procurement
512L1-2 Promotion of use of standards & bestpractices for procurement

Level 2ID
Nb.
0 512L2-1

6

512L2-2
512L2-3

513 Standards, Organisations,and Technologies

521 Standards, Organisations,and Technologies

Adherence to Standards

Internet Infrastructure
Resilience

Standards in Software
Development

Internet Infrastructure
Resilience

513L1-1 Standards & best practices fordevelopment
513L1-2 Promotion of use of standards & bestpractices for development
513L1-3 Coding standards
521L1-1 Limited internet infrastructures

0513L2-1

1

513L2-2

3
0521L2-1

521L1-2 Discussion on resilience of internet
infrastructures

0521L2-2
521L2-3

521L2-4
531 Standards, Organisations,and Technologies

541 Standards, Organisations,and Technologies

551 Standards, Organisations,and Technologies

Software Quality

531L1-1 Quality & functional requirement ofsoftware531L1-2 Catalogue of secure softwares

0531L2-1

0531L2-2

531L1-3 Software update policies underdevelopment
531L1-4 Software deficiencies information
Technical Security Controls Technical Security Controls 541L1-1 Technical security controls deployed

0531L2-3

00531L2-4
541L2-1

541L1-2 Latest technical security controls
promoted
541L1-3 Anti-malware services by ISPs

1

541L2-2

0541L2-3

541L1-4 ISPs' policies of technical security
control
541L1-5 IDS/IPS deployed

0541L2-4

0541L2-5

551L1-1 Cryptographic controls deployed0551L2-1

551L1-2 TLS deployed0551L2-2Cryptographic Controls

Software Quality

Cryptographic Controls

551L2-3

561 Standards, Organisations,and Technologies

562 Standards, Organisations,and Technologies

571 Standards, Organisations,and Technologies

Cybersecurity Marketplace Cybersecurity
Technologies

Cybersecurity Marketplace Cyber Insurance

Responsible Disclosure

Responsible Disclosure

561L1-1 Domestic security products market

0551L2-4
561L2-1

561L1-2 Cybersecurity consideration indevelopment
562L1-1 Needs for cybersecurity insurance
understood
562L1-2 Development of cybersecurity
insurance

0561L2-2

0562L2-1

0562L2-2

571L1-1 Information sharing of vulnerabilities

0571L2-1

571L1-2 Ability to address vulnerability reports

0571L2-2
571L2-3252

Appendix F
Level 2
Keywords
International standards & bestpractices for procurement
implemented
Metrics of adoption of standards &best practices for procurement
Metrics of compliance of standards &best practices for procurement

Level 3ID
KeywordsNb.
0 512L3-1 Standards & best practices for
procurement widely used & complied0

512L3-2 Regular review of procurement0

Level 4ID
Keywords
Nb.
4 512L4-1 Realtime monitoring of noncompliance to standards & bestpractices for procurement
4 512L4-2 Risk-based decision making of noncompliance0Metrics of adoption of standards &best practices for development
Education & training for development0

512L3-3 Wider resource planning inprocurement
512L3-4 Procurement skills benchmark
512L3-5 E-sourcing / e-tendering
513L3-1 Security consideration in all stages

4

513L3-2 Core development activities

0

Reliable internet infrastructures20
0

Established e-commerce & electronic
authentication
Internet infrastructures compliant tointernational standards & bestpractices
Internet infrastructures formallymanagedEstablished quality & functional
requirement of software
Softwares complying withinternational standards
Established software update processes

0513L3-3 Risk-based adoption of standards
521L3-1 Metrics of compliance to international
standards of internet infrastructures
521L3-2 Investment to new technologies ininternet infrastructures

Software classification
Latest technical controls & patch
managements widely implemented
Anti-malware softwares & network
firewalls
Physical security controls

0
14

Established ISPs' policies of technicalsecurity control
Technical security controls based oninternational frameworks
Cryptographic controls widely used2

Secure communication services

1

Cryptographic controls complied tointernational standards
TLS widespread
Domestic providers of security
products
Lowering dependency on foreign
cybersecurity technologies
Established cybersecurity insurance
marketCovering additional costs (ex.
Forensic investigation etc.)0Established vulnerability disclosure
framework
Established processes against
vulnerability information
Non legal action

0
0
9

0

0

0

Nb.
0

0

513L4-1 Risk-based decision making of noncompliance
513L4-2 Adopting standards throughout lifetime
513L4-3 Explicit requirements by contract
521L4-1 Controlled acquisition of
infrastructures
521L4-2 Optimised cost for internet
infrastructures
521L4-3 Controlled acquisition of criticaltechnologies

0

1

1
0
0
1
1

0

531L3-1 Monitoring software quality

00531L3-2 Review of software update policies &processes
531L3-3 Business benefit from improving
software quality
531L3-4 Software deficiency handling
541L3-1 User side security controls

0521L4-4 Independency & persistence of internet
infrastructure technologies
531L4-1 High performance, reliability &usability softwares
531L4-2 Automated service continuity

0531L4-3 Regular review of quality requirement02

541L3-2 Regular review of technical security
controls

13

541L4-1 Continuous assess of technical security
controls
541L4-2 Business impact by technical security
controls understood
541L4-3 Supplemental security services by ISPs

551L4-1 Regular review of relevance of
cryptographic controls
551L4-2 Revision of cryptographic control
policies

4

0

1

0
2

0

0
0

0
0

4
2

551L3-1 Risk-based use of cryptographic
controls
551L3-2 Regular review of cryptographic
control policies

01

561L4-1 Automated security functions

0

1

561L3-1 Security products complied toInternational standards
561L3-2 Risk-based product development

0561L4-2 Exporting superior security products

01

562L3-1 Covering various costs

0

0

0

562L3-2 Choice of coverages

0562L4-1 Innovative cybersecurity insurance
market562L4-2 Emerging risks & various cyber harm

0562L4-3 Premium discount for secure behaviour

0

2

1

0

571L3-3 Deadlines of update

0571L4-1 Regular review of vulnerability
disclosure policies
571L4-2 Internationally contributing to
responsible disclosure
571L4-3 Deadlines of update complied
571L4-4 Reviewing process of deadlines

01

562L3-3 Cybersecurity insurance products for
SMEs
571L3-1 Established responsible disclosure
processes
571L3-2 Analysis & dissemination processes

0
1

1

1

2

0

1
0
0

253

Appendix G

Appendix G U.K. Action Items Allocated to Tentative ANC3T
5105-1 Blocking known malware sources

Allocation (Requirement ID)
1
2
3
4
521L3-2 541L4-1 541L4-3

5105-2 Promoting email verification systems

541L3-1 541L3-2

5105-3 Promoting security best practices

511L2-4 511L3-3

5105-4 Implementing secure routing

521L3-2 541L4-1

5105-5 Enhancing capabilities against state-sponsored cyber
activities
5105-6 Promoting technical development

152L3-1 152L4-1

5106-1 Metrics

511L2-3 511L2-5

5205-1 Security settings by default

513L3-1 531L2-2 541L2-5

Promotion of use of standards & bestpractices
Investment to new technologies ininternet infrastructures
Advanced capabilities & situationalawareness
Continuous assess of technical security
controls
Metrics of adoption of standards &best practices
Security consideration in all stages

5205-2 Developing IP reputation informing service

222L2-2 222L4-2 521L3-2

Risk reduction in e-gov

5205-3 Software integrity assuarance

512L3-1 531L3-4

5205-4 Promoting out-of-date browsers filtering

222L2-2 222L4-2 511L2-4

Standards & best practices for
procurement widely used & complied
Risk reduction in e-gov

5205-5 Investing new technologies like TPM, FIDO

222L2-2 222L4-2 521L3-2 541L4-1 551L4-2 Risk reduction in e-gov

5206-1 Introducing security ratings for products

531L2-4 561L3-1

Software classification

5207-1 Metrics

513L2-1

5303-1 Promoting e-government
5303-2 'Security-by-default' in e-government
5304-1 Eliminating unsupported softwares in public sector

222L2-3
222L4-2 513L3-1
512L3-1 541L2-1

5305-1 Comprehensive knowledge about all public sector systems

511L2-2

Metrics of adoption of standards &best practices for development
Promotion of e-gov
Data protection measures of e-gov
Standards & best practices for
procurement widely used & complied
Standards & best practices widely used

5305-2 Promoting best practices in public sector

511L2-45305-3 Cyber exercise

111L3-2 124L2-1 141L2-1

5305-4 Participation of lower levels of public sector

123L3-1

5305-5 Automated vulnerability scan on e-government

222L4-2 541L2-1

5306-1 Awarenes raising in public sector

211L4-1 311L3-1

5306-2 Development of cyber expertise

311L3-1 331L3-2

5307-1 Developing new guidance

511L3-3 541L4-1

5307-2 Making cyber threat infomation easily available
5308-1 Improving highest classification networks

121L2-1 311l2-3
161L3-1

5309-1 Promoting new standards in health & care industries

511L2-4

5310-1 Awareness raising in Armed Forces

311L3-1

5310-2 Enhancing detection & reaction functions

152L3-1 152L4-1

5311-1 Metrics

311L3-2 331L3-4 511L2-5 512L2-3

5404-1 Awareness raising of board members

212L3-1 312L4-1

5404-2 Urging organisations & companies to invest in security

312L3-1 312L3-2 541L2-1 541L3-2#

Action Item

5404-3 Urging organisations & companies to excercise incident
response
5404-4 Cybersecurity in CNI
5405-1 Government to understand cybersecurity levels in CNI
5406-1 Sharing information with CNI

254

541L4-1

5

1
Investment to new technologies ininternet infrastructures
User side security controls

Promotion of use of standards & bestpractices
Cyber exercises considered in strategy
Subnational / sectorial incident
response organisations
Data protection measures of e-gov
Mind-set commonplace in public
sector
Sector specific programmes ofawareness raising
Contributing to international standards
Central registry of incidents
Redundant communications for key
stakeholders
Promotion of use of standards & bestpractices
Sector specific programmes ofawareness raising
Advanced capabilities & situationalawareness
Metrics for effectiveness of awarenessraising programmes
Mind-set spread in private sector

Executives' understandings ofcybersecurity measures
Cybersecurity training programmes for
331L2-4 332L2-1
non-professionals
131L3-2 132L3-3 133L3-1 133L3-2 133L3-3 Vulnerability & asset management of
CI assets
Regular review of CI risk priorities
131L4-1 132L4-2
Information sharing established
132L2-1
between CI & government

Appendix G

Allocation (Requirement Keyword)2
3
Continuous assess of technical security Supplemental security services by ISPs
controls
Regular review of technical security
controls
Contributing to international standards

4

5

Continuous assess of technical security
controls
Cross-border response ability

Metrics of compliance of standards &best practices
Softwares complying with international Technical security controls based onstandards
international frameworks
Data protection measures of e-gov
Investment to new technologies ininternet infrastructures
Software deficiency handling
Data protection measures of e-gov
Data protection measures of e-gov

Promotion of use of standards & bestpractices
Investment to new technologies ininternet infrastructures

Continuous assess of technical security Revision of cryptographic control
controls
policies

Security products complied toInternational standards

Security consideration in all stages
Latest technical controls & patch
managements widely implemented

Incident response processes & tools
established

National incident exercise done

Latest technical controls & patch
managements widely implemented
Sector specific programmes ofawareness raising
Cybersecurity training aligned withnational strategy
Continuous assess of technical security
controls
Cybersecurity information portal

Cross-border response ability
Metrics of effectiveness ofcybersecurity training
Cybersecurity as common agenda inboard meetings
Executives' ability to reallocate
resources
Cybersecurity trained & certified
employees
Supply chain management of CI

Metrics of compliance of standards &best practices

Metrics of compliance of standards &best practices for procurement

Latest technical controls & patch
managements widely implemented

Regular review of technical security
controls

Cybersecurity oriented risk
management in CI

Regular review of impact analysis ofCI

Regular review of CI incident response
plans

Trust between CI & government255

Appendix G#

Action Item

5406-2 Setting a new standard by collaborating with industries &
academia
5406-3 Encouraging investment in the latest technologies
5406-4 Exercising with CNI
5408-1 Private sector mind-set
5408-2 Flexible policies for private sector cybersecurity
5408-3 Promoting growth of cybersecurity industries
5408-4 Coordinating international legal framework
5409-1 Cybersecurity as a regulation
5410-1 Metrics

Allocation (Requirement ID)
1
2
3
4
132L4-1 511L3-3

5

1
Ability to adjust of CI protection

Regular review of resource allocation
for CI protection
High-level scenario of national incident
141L3-1
exercise
Mind-set commonplace in private
212L4-1
sectorBalance between cybersecurity legal
411L4-1framework & best practices
Continuous assess of technical security
541L4-1 561L3-1 561L4-2
controls
411L4-1 411L4-2 412L4-3 412L4-4 416L4-1 Balance between cybersecurity legal
framework & best practices
Balance between cybersecurity legal
411L4-1framework & best practices
Reassignment & reallocation of
112L4-1 131L4-1 132L4-1
resources for cybersecurity programme
133L3-4 141L3-4 161L3-3

5503-1 Public awareness raising

213L3-1 222L3-3 223L3-2 311L4-3

Most users have mind-set

5504-1 Using cybersecurity insurance for corporate awarenessraising
5505-1 Making information, education, tools easily available topublic & corporates
5505-2 Intelligence sharing between government & law
enforcement

562L4-1 562L4-3

5606-1 Enhancing cooperation in incident response between
government & private sector
5606-2 Performing inter-sectoral exercise
5607-1 Trust between government & private sector

123L3-3 123L4-1

Innovative cybersecurity insurance
marketMind-set commonplace in private
sectorEstablished relationship among
government, prosecutors, judges & law
enforcement
Information sharing across sectors

212L4-1 213L4-1 311L4-3 311L4-4
432L3-1

6205-5 Exchanging intelligence with industry

National incident exercise done
Trust between participants of national
incident exercise
Information sharing across sectors
123L3-3
Evaluation of national incident exercise
141L3-4 141L4-4 161L3-3
informing investment
Dedicated investigative resources for
421L3-1 422L4-2
cybercrimes
Advanced investigative capabilities for
421L3-2 421L3-5
cybercrimes
417L4-1 418L4-1 421L3-4 422L4-1 432L3-3 Contributing to international
cybercrime treaties
Entire society involved in awareness
311L4-3 311L4-4
raising
Information sharing across sectors
123L3-3 431L2-1

6205-6 New 24/7 reporting system

121L2-1 241L2-1 241L2-2

Central registry of incidents

6205-7 Reducing vulnerabilities in infrastructures

131L3-2 521L2-3 541L2-1

Vulnerability & asset management of
CI assets

6205-8 Making use of stolen credentials difficult in UK

411L3-1 415L4-1

6206-1 Metrics

417L4-2 418L4-2 421L4-3 423L4-2

6303-1 Applying international law in cyberspace

152L4-1 153L4-1

Regular review of cybersecurity legal
framework
Regular review of substantive
cybercrime legislation
Cross-border response ability

6303-2 Confidence building

111L4-26303-3 Enhancing NATO cooperation

141L4-2 153L4-2

6303-4 Understanding cyber activity of adversaries

151L3-2 152L3-1 153L3-1

6303-5 Generating all available options

152L3-1 153L3-1 153L3-2

6303-6 Intenational information sharing
6303-7 Attributing specific identities

153L4-2
153L4-1

6304-1 Metrics

151L3-36403-1 Enhancing detection of cyber terrorism

151L3-2 152L3-1 153L2-1 421L3-2

5608-1 Automated information sharing system5609-1 Metrics
6205-1 Enhancing law enforcement capability in national, regional& local levels
6205-2 Making UK inefficient cybercrime target based onunderstanding of cybercrime business model
6205-3 International juridical partnership
6205-4 Discouraging individuals being involved in cybercrime256

141L2-1
141L3-2

Contributing to international debate ofstrategy
National incident exercise contributing
to international challenges
Capturing landscape of national-level
threatAdvanced capabilities & situationalawareness
Intelligence shared with allies
Leading international debate aboutcyber defence
Cyber defence strategy meets
objectives
Capturing landscape of national-level
threatAppendix G

2Contributing to international standards

Allocation (Requirement Keyword)
3

4

5

Contributing to international privacy
protection online

Balance between intellectual property& open access policy

Evaluation of national incident exercise Evaluation of national incident exercise
informing investment
informing investment

Security products complied toInternational standards
Participation to international
cooperation agreements

Exporting superior security products

Regular review of CI risk priorities

Ability to adjust of CI protection

Most users can use e-gov securely

Most users can use e-commerce
securely

Entire society involved in awarenessraising

Entire society involved in awarenessraising

Overall threat reduced by awarenessraising

Contributing to international digital
human rights

Premium discount for secure behaviour
Users' mind-set reducing threat

Coordinating all levels / sectors

National crisis management established Evaluation of national incident exercise
informing investment
Dedicated prosecutorial resources forcybercrimes
Statistics & analysis of cybercrime
investigations
Contributing to international
Cross-border investigation ofProsecution of cross-bordercybercrime treaties
cybercrimes
cybercrimes
Overall threat reduced by awarenessraising
Established formal international
cooperation
Incident reporting mechanisms
Promotion of incident reporting
establishedchannelsInternet infrastructures compliant toLatest technical controls & patch
international standards & best practices managements widely implemented
Amendment procedures for consumer
protection legislation
Regular review of proceduralcybercrime legislation
Leading international debate aboutcyber defence

Regular review of investigative
capabilities for cybercrimes

Joint international investigation &prosecution

Regular review of court systemcapabilities to judge cybercrimes

Intelligence shared with allies
Advanced capabilities & situationalawareness
Analytical capability in cyber defence

Analytical capability in cyber defence

Advanced capabilities & situationalawareness

Coordination between CI & defence

Strengths & weaknesses of cyberdefence understood

Advanced investigative capabilities forcybercrimes

257Appendix G

6403-2 Enhancing investigation of cyber terrorism

Allocation (Requirement ID)
1
2
3
4
421L3-2 421L3-4

6403-3 International cooperation

153L4-2 431L3-1 432L3-3

6404-1 Metrics

421L4-3 431L4-1 432L4-2

6503-1 Enhancing development of cyber HR

321L3-4 322L3-2 322L4-2 322L4-3

6503-2 Developing offensive cyber capability

152L3-1 321L4-3 541L4-1 561L4-2

6503-3 Integrating offensive cyber capability to armed forces

152L3-1 152L4-1

6504-1 Metrics

151L3-3 541L4-1

6603-1 Creating new requirement of cryptography

551L4-1 551L4-2

6604-1 Metrics

551L4-1

7106-1 Including cybersecurity into computer science education

321L3-2 321L3-4

7107-1 Making clear rolls of government & private sector incybersecurity training
7107-2 Urging corporate management to train employees

331L3-2 331L4-1 332L3-2

7107-3 More attractive careers of cybersecurity professionals

331L4-37108-1 Inter-sectoral coordination of education/training

322L4-2 331L4-1 331L4-2

7109-1 Specialist education targeting 14-18 years

321L3-3 321L4-1

7109-2 Degree-level apprenticeship in energy, finance & transport

322L4-3 332L3-2

7109-3 Retraining funds

332L3-1

7109-4 Supporting high quality post graduate education
7109-5 Accredition of teachers

321L3-3
321L2-1

7109-6 Identifying excellent organisation

331L3-2 331L4-3

7109-7 Defence cyber academy to CoE

322L3-4 322L4-1 331L3-2

7109-8 Collaborating between government, forces, industry &academia
7109-9 CyberFirst: nurturing young talent programme

322L4-2 331L4-1

7109-10 Cybersecurity education from primary to postgraduate

321L3-5

7110-1 Metrics

321L4-3 331L3-4

7203-1 Supporting commercialisation of academic innovation

321L4-2 322L4-1 322L4-3 561L4-2

7203-2 Establishing innovation centres

321L4-2 322L4-1 322L4-3 561L4-2

7203-3 Allocating funds

322L4-2 561L4-2

7203-4 Providing testing facilities
7203-5 Enhancing cooperation between industry & government

561L4-2
322L4-2

7203-6 Supporting scaling-up
7203-7 Promoting international standards for easier market access

561L4-2
561L3-1 561L4-2

7204-1 Easier access to government procurement for start-ups

561L3-1 561L4-2

7205-1 Metrics

321L4-37303-1 Making research funding more effective

321L2-5 322L2-2 322L3-2 322L4-1

7303-2 Human & behavioural aspects of cyber science

321L2-5 322L2-2 322L3-2 322L4-1

7304-1 Enhancing 'secure-by-default'

513L3-1 561L3-1

7305-1 Establishing Cyber Science and Technology Strategy

321L2-5 322L2-2 322L3-2 322L4-1#

258

Action Item

331L3-2 332L3-2

321L3-551Advanced investigative capabilities forcybercrimes
Intelligence shared with allies
Regular review of investigative
capabilities for cybercrimes
Cybersecurity as focusing area
Advanced capabilities & situationalawareness
Advanced capabilities & situationalawareness
Cyber defence strategy meets
objectives
Regular review of relevance of
cryptographic controls
Regular review of relevance of
cryptographic controls
Mandatory cybersecutity courses forcomputer science degrees
Cybersecurity training aligned withnational strategy
Cybersecurity training aligned withnational strategy
Incentives for cybersecurity trained
workforce
Cooperation between all stakeholders
in cybersecurity education
Cybersecurity specific degree
Cybersecurity education aligned withpractical problems
Review of cybersecurity training
programmes
Cybersecurity specific degree
Qualification for cybersecurity
educators established
Cybersecurity training aligned withnational strategy
CoE in cybersecurity
Cooperation between all stakeholders
in cybersecurity education
Cybersecurity education from primary
to post-graduate
Cybersecurity education from primary
to post-graduate
Cybersecurity education adapting tochanging needs
Balance between core components &adaptive processes
Balance between core components &adaptive processes
Cooperation between all stakeholders
in cybersecurity education
Exporting superior security products
Cooperation between all stakeholders
in cybersecurity education
Exporting superior security products
Security products complied toInternational standards
Security products complied toInternational standards
Cybersecurity education adapting tochanging needs
Research & development incybersecurity promoted
Research & development incybersecurity promoted
Security consideration in all stages
Research & development incybersecurity promoted

Appendix G

2
Cross-border investigation of
cybercrimes
Communication channels forinternational cooperation
Regular review of international
cooperation
Adapted budget for cybersecurity
education
Cybersecurity education adapting tochanging needs
Cross-border response ability

Allocation (Requirement Keyword)
3

4

5

Joint international investigation &prosecution
Adapted international cooperation
Cooperation between all stakeholders Cybersecurity education aligned within cybersecurity education
practical problems
Continuous assess of technical security Exporting superior security products
controls

Continuous assess of technical security
controls
Revision of cryptographic control
policies

Cybersecurity as focusing area
Collaboration between public &Coordination of cybersecurity training
private in cybersecurity training
across sectors
Coordination of cybersecurity training
across sectors

Collaboration between public &Coordination between cybersecurity
private in cybersecurity training
training & education
Internationally forerunning incybersecurity education
Coordination of cybersecurity training
across sectors

Incentives for cybersecurity trained
workforce
International CoE in cybersecurity

Cybersecurity training aligned withnational strategy

Collaboration between public &private in cybersecurity training

Metrics of effectiveness ofcybersecurity training
International CoE in cybersecurity
International CoE in cybersecurity

Cybersecurity education aligned withpractical problems
Cybersecurity education aligned withpractical problems

Exporting superior security products

Adapted budget for cybersecurity
education
Adapted budget for cybersecurity
education

International CoE in cybersecurity

Adapted budget for cybersecurity
education

International CoE in cybersecurity

Exporting superior security products

Exporting superior security products

Exporting superior security products
Exporting superior security products

Budget for research & education forcybersecurity
Budget for research & education forcybersecurity
Security products complied toInternational standards
Budget for research & education forcybersecurity

International CoE in cybersecurity

259

Appendix G#

Action Item

7306-1 Supporting academic CoE, research institutes & doctral
training
7306-2 Establishing new research institute7307-1 Supporting PhD

Allocation (Requirement ID)
1
2
3
4
322L3-4 322L4-1
322L3-4 322L4-1
321L3-3 321L4-1

7308-1 Encouraging collaboration between government, industry & 322L4-2
academia
7309-1 Funding 'grand challenge'
321L2-5 322L2-2 322L3-2 322L4-1
7310-1 Metrics

321L4-37403-1 Promoting inter-disciplinary research for development ofhorizon scanning7403-2 Integration of cybersecurity & behavioural science

321L4-1

7403-3 Monitoring cyber criminal market

421L3-2 421L4-3

7403-4 Investigating new technologies

541L4-1

7403-5 -do-

541L4-1

7403-6 Early defence technology

122L4-2 541L4-1

7404-1 Including cybersecurity into any other research areas forhorizon scanning
7407-1 Metrics

321L4-1

84---184---284---384---484---584---684---784---884---984---1084---1184---1284---1385---185---285---386---1260

321L4-1

5

1
CoE in cybersecurity
CoE in cybersecurity
Cybersecurity specific degree
Cooperation between all stakeholders
in cybersecurity education
Research & development incybersecurity promoted
Cybersecurity education adapting tochanging needs
Internationally forerunning incybersecurity education
Internationally forerunning incybersecurity education
Advanced investigative capabilities forcybercrimes
Continuous assess of technical security
controls
Continuous assess of technical security
controls
Early warning capability

Internationally forerunning incybersecurity education
Cybersecurity education adapting to
321L4-3changing needs
Contributing to international debate of international law in 153L4-1
Leading international debate aboutcyber spacecyber defence-doLeading international debate about
153L4-1
cyber defence-doLeading international debate about
153L4-1
cyber defence
Confidence building measures
Contributing to international debate of
111L4-2
strategy
Cross-border prosecution
Contributing to international
417L4-1 418L4-1 422L4-1
cybercrime treaties
Enhancing law enforcement
Regular training for law enforcement
421L3-3 421L3-4 432L3-3
officers
Promoting international standards & best practices inContribution to international awareness
311L3-4 511L3-3
emerging technologies
raising
Cross-border cooperation in capabilities & newContribution to international
161L3-4 161L4-2 541L4-1
technologies
communications' redundancy
Assist other countries to build capabilities
123L3-2 123L4-2 124L3-5 124L4-4 161L4-2 International coordination
Assist other countries to enhance cybersecurity
123L3-2 123L4-2 124L3-5 124L4-4 161L4-2 International coordination
Enhancing NATO's capability in cyber space
National incident exercise contributing
141L4-2 153L4-2
to international challenges-doNational incident exercise contributing
141L4-2 153L4-2
to international challenges
Contributing international norm development in cyber space 111L4-2 153L4-1
Contributing to international debate ofstrategy
Enhancing cooperation with allies
National incident exercise contributing
141L4-2 153L4-2
to international challenges
Contributing to international oganisations
International coordination
123L3-2 124L3-5
Cooperating international non-government actors
Adapted international cooperation
432L4-2
Metrics
Continual revision of strategy
111L4-1 113L4-1 431L4-1 432L4-2

Appendix G

2International CoE in cybersecurity

Allocation (Requirement Keyword)
3

4

5

International CoE in cybersecurity
Internationally forerunning incybersecurity education

Budget for research & education forcybersecurity

Adapted budget for cybersecurity
education

International CoE in cybersecurity

Regular review of investigative
capabilities for cybercrimes

Continuous assess of technical security
controls

Contributing to international
cybercrime treaties
Cross-border investigation of
cybercrimes
Contributing to international standards

Prosecution of cross-bordercybercrimes
Joint international investigation &prosecution

Assisting neighbours

Continuous assess of technical security
controls
International coordination
Regional coordination
International coordination
Regional coordination

Regional coordination
Regional coordination
Intelligence shared with allies

Assisting neighbours
Assisting neighbours

Intelligence shared with allies
Leading international debate aboutcyber defenceIntelligence shared with allies
International coordination
Continual revision of strategy

Regular review of international
cooperation

Adapted international cooperation

261

Appendix H

Appendix H U.K. Action Items Mapping Result by Requirement#

Category

111 Cybersecurity Policy andStrategy

112 Cybersecurity Policy andStrategy

Subcategory
National Cybersecurity
Strategy

National Cybersecurity
Strategy

Capacity area
Strategy Development

Organisation

Level 1
ID
Keywords
111L1-1 Outline of strategy
111L1-2 Development process of strategy

Level 2ID
Nb.
0 111L2-1
0 111L2-2

111L1-3 Stakeholders involved in strategy
development

0

111L2-3

112L1-1 Cybersecurity programme underdevelopment

0112L2-1

112L2-2
112L2-3

113 Cybersecurity Policy andStrategy

National Cybersecurity
StrategyContent

113L1-1 Risk priorities of cybersecurity
defined in strategy

0112L2-4
113L2-1
113L2-2

121 Cybersecurity Policy andStrategy
122 Cybersecurity Policy andStrategy

123 Cybersecurity Policy andStrategy

Incident Response

Identification of Incidents

121L1-1 Recording incidents

0

121L2-1

Incident Response

Organisation

122L1-1 Key incident response organisations inprivate sector identified
122L1-2 N/A

0

122L2-1

0

122L2-2

122L1-3 Ad-hoc responses
123L1-1 Leading incident responseorganisation designated00

123L2-1

Incident Response

Coordination

123L2-2
123L2-3
124 Cybersecurity Policy andStrategy

Incident Response

Mode of Operation

124L1-1 Key incident response processes

0

124L2-1

124L1-2 CSIRT member training

0

124L2-2
124L2-3

131 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Identification
Protection

131L1-1 List of CI assets

0

131L2-1
131L2-2

132 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Organisation
Protection

132L1-1 Informal information sharing between
CI & government

0132L2-1
132L2-2
132L2-3
132L2-4

133 Cybersecurity Policy andStrategy

141 Cybersecurity Policy andStrategy

Critical Infrastructure (CI) Risk Management andProtection
Response

Crisis Management

Crisis Management

133L1-1 Access control implemented in CI

0

133L2-1

133L1-2 Basic capacity against cyber threat in
CI
133L1-3 Data security policy in CI

0

133L2-2

0

133L2-3

141L1-1 Assessment of exercise of national
incident
141L1-2 Exercise planning organisation
designated for national incident
141L1-3 Stakeholders' participation in national
incident exercise

0

141L2-1

0

141L2-2

0

141L2-3
141L2-4
141L2-5
141L2-6262

Appendix H
Nb. = Number of Related Action Items
Level 2
Keywords
Strategy established
Stakeholders' consultation in strategy

Level 3ID
Keywords
Nb.
0 111L3-1 Reviewing process of strategy
0 111L3-2 Cyber exercises considered in strategy

Implementation of strategy0

Cybersecurity programme agreed0

Coordinating body of cybersecurity
programme
Goals & measurement ofcybersecurity programme
Discrete budget for cybersecurity
National objectives of cybersecurity
defined in strategy
Minimum coverage of strategy
contents
Central registry of incidents0National CSIRT

0

Roles & responsibilities of national
CSIRT

0

Coordination established0

Communication lines for crisis
International cooperation in incident
response
Incident response processes & tools
established
Regular training for CSIRT members

00Limited response to national level
incidents

0111L3-3 Measurement of cybersecurity definedin strategy
111L3-4 Capacity building & investment
considered in strategy
112L3-1 PDCA processes of cybersecurity
programme

Level 4ID
Keywords
Nb.
0 111L4-1 Continual revision of strategy
1 111L4-2 Contributing to international debate ofstrategy
0

Nb.
1
3

0
0

112L4-1 Reassignment & reallocation of
resources for cybersecurity programme

1

112L3-2 Consolidated budget for cybersecurity

0

112L4-2 Dissemination & feedbacks aboutcybersecurity programme

0

113L3-1 Measurement of cybersecurity definedin strategy
113L3-2 Protection of critical infrastructures
defined in strategy
121L3-1 Regular revision of incident registry
121L3-2 Incident analysis
122L3-1 Formal roles & responsibilities
allocated
122L3-2 Adequate resources for incident
response

0

113L4-1 Continual revision of strategy

1

0

113L4-2 Contributing to international
cooperation
121L4-1 Adapted analysis of incidents

0

0

0

122L4-1 Sustainability of incident response
capability
122L4-2 Early warning capability

123L3-1 Subnational / sectorial incident
response organisations
123L3-2 International coordination
123L3-3 Information sharing across sectors

1

122L4-3 Capability to manage threat landscape
123L4-1 Coordinating all levels / sectors

0
1

3
3

123L4-2 Regional coordination

2

124L3-1 Training & accreditation for CSIRT
members established
124L3-2 Sophisticated incident analysis

00124L3-3 Regular review of incident response
processes
124L3-4 Forensics
124L3-5 International coordination
131L3-1 Priority of CI risks
131L3-2 Vulnerability & asset management of
CI assets
132L3-1 Centralised management of CI
protection
132L3-2 Public awareness campaign of CI
protection
132L3-3 Supply chain management of CI

0

124L4-1 Scenario testing of incident response
processes
124L4-2 Evaluating effectiveness of CSIRT
members training
124L4-3 Tools against zero-day vulnerabilities

0
3
0
2

124L4-4 Regional coordination

2

131L4-1 Regular review of CI risk priorities

20

132L4-1 Ability to adjust of CI protection

2

0

132L4-2 Trust between CI & government

1

133L3-1 Cybersecurity oriented risk
management in CI
133L3-2 Regular review of impact analysis ofCI
133L3-3 Regular review of CI incident responseplans
133L3-4 Regular review of resource allocation
for CI protection
133L3-5 Insider threat detection in CI
141L3-1 High-level scenario of national incident
exercise
141L3-2 Trust between participants of national
incident exercise
141L3-3 SMART objectives & KPI of national
incident exercise
141L3-4 Evaluation of national incident exercise
informing investment
141L3-5 National crisis management alignedwith international best practices
141L3-6 Tailored reports of national incident
exercise

1

133L4-1 Regular audit of CI

01

133L4-2 Indirect costs inclusive in impact
analysis of CI incidents

0

141L4-1 Peer observance of national incident
exercise
141L4-2 National incident exercise contributing
to international challenges
141L4-3 Internationally shared result of national
incident exercise
141L4-4 National crisis management established

0

0
0
0
0
2

1
0

Audit of CI assets
CI assets audit list

00Information sharing establishedbetween CI & government
Formal & consistent information
sharing between CI & government
Point of contact
Government engagement in CI
protection
Standards & best practices in CI

1

Risk management processes in CI

0

National CI incident response plan

0

0
0
0
0

National incident exercise done2

Appropriate resources for national
incident exercise
Roles in national incident exercise
defined
Incentives to participate in national
incident exercise
Trained monitors of national incident
exercise
Evaluation of national incident
exercise

0
0
0
0
0

0
0
0

0

0

1

0
0

1

1
1
0
1
1
0
2

4
0
1

0
0

263

Appendix H

151 Cybersecurity Policy andStrategy

Cyber Defence

Strategy

Level 1
ID
Keywords
151L1-1 National-level threats identified

152 Cybersecurity Policy andStrategy
153 Cybersecurity Policy andStrategy

Cyber Defence

Organisation

152L1-1 Dispersed cyber operations

0

152L2-1

Cyber Defence

Coordination

153L1-1 Cyber defence capability requirements
agreed0

153L2-1#

Category

Subcategory

Capacity area

Level 2ID
Nb.
0 151L2-1

153L2-2
161 Cybersecurity Policy andStrategy

Communications
RedundancyCommunications
Redundancy

161L1-1 Gaps in emergency communication
identified
161L1-2 Emergency procedures established0

161L2-1

0

161L2-2
161L2-3

211 Cyber Culture and Society Cybersecurity Mind-set

Government

211L1-1 Leading agencies only have mind-set

0

211L2-1

212 Cyber Culture and Society Cybersecurity Mind-set

Private Sector

212L1-1 Leading firms only have mind-set

0

212L2-1

212L1-2 Materials for best practices available

0

213L1-1 Limited users only have mind-set

0

213L2-1

213 Cyber Culture and Society Cybersecurity Mind-set

Users

221 Cyber Culture and Society Trust and Confidence on
the Internet

User Trust and Confidence 221L1-1 A few users can use internet securely
on the Internet
221L1-2 Promotion of online trust exists

0

221L2-1

0

221L2-2

User Trust in E-government 222L1-1 Government's recognition of needs forServices
security in e-gov
222L1-2 Stakeholders' recognition of needs forsecurity in e-gov
222L1-3 A few users can use e-gov securely
222L1-4 Security measures in e-gov

0

221L2-3
222L2-1

0

222L2-2

0
0

222L2-3
222L2-4

User Trust in E-commerce
Services

223L1-1 Limited e-commerce provided

0

222L2-5
223L2-1

223L1-2 Private sectors' recognition of need for
security in e-commerce
223L1-3 A few users can use e-commerce
securely
223L1-4 Security measures in e-commerce

0

223L2-2

0

223L2-3

0

223L2-4
223L2-5

222 Cyber Culture and Society Trust and Confidence on
the Internet

223 Cyber Culture and Society Trust and Confidence on
the Internet

231 Cyber Culture and Society User Understanding of
Personal Information
Protection Online

User Understanding of
Personal Information
Protection Online

231L1-1 Users have only general knowledge
about personal information protection
231L1-2 Discussions on protecting personal
information

0

231L2-1

0

231L2-2

241 Cyber Culture and Society Reporting Mechanisms

Reporting Mechanisms

241L1-1 Reporting channels of incidents

0241L2-1
241L2-2

251 Cyber Culture and Society Media and Social MediaMedia and Social Media

251L1-1 Media coverage of cybersecurity0

251L2-1

251L1-2 Discussion on social media security0

251L2-2
251L2-3264Appendix H
Level 2
Keywords
Cyber defence strategy exists

Level 3ID
Keywords
Nb.
0 151L3-1 Dedicated resources for cyber defence
151L3-2 Capturing landscape of national-level
threat151L3-3 Cyber defence strategy meets
objectives
0 152L3-1 Advanced capabilities & situationalawareness
1 153L3-1 Analytical capability in cyber defence

Level 4ID
Keywords
Nb.
0 151L4-1 Rules of engagement in cyberspace
2 151L4-2 Military doctrine in cyberspaceIntelligence sharing between CI &defence
Emergency response assets hardwired0

Communication between emergency
response functions distributed
Testing, training, drills of emergency
response

00

153L3-2 Strengths & weaknesses of cyberdefence understood
161L3-1 Redundant communications for key
stakeholders
161L3-2 Interoperability & functionality undercompromised situation
161L3-3 Evaluation of national incident exercise
informing investment
161L3-4 Contribution to international
communications' redundancy
211L3-1 Mind-set spread in public sector

00

211L3-2 Mind-set based strategy in public
sector212L3-1 Mind-set spread in private sector0

Growing number of users have mindset
Growing number of users can use
internet securely
Promotion of online trust established

0

212L3-2 Mind-set based strategy in private
sector213L3-1 Most users have mind-set

00User assistance available
E-gov established00Risk reduction in e-gov

Defined responsibility of cyberdefence organisation
Coordination between CI & defence

Nb.
0
0

2
7

152L4-1 Cross-border response ability

4

2

6

1

153L4-1 Leading international debate aboutcyber defence
153L4-2 Intelligence shared with allies

1

161L4-1 Optimised for extended outages

00

161L4-2 Assisting neighbours

3

211L4-1 Mind-set commonplace in public
sector1

212L4-1 Mind-set commonplace in private
sector2

1

213L4-1 Users' mind-set reducing threat1

221L3-1 Most users can use internet securely

0

0

0
0
0

222L4-1 Promotion of e-gov revised

03

221L3-2 Users' ability to control providing
personal information
221L3-3 Promotion of online trust evaluated222L3-1 Disclosures of activities of government
agencies
222L3-2 Privacy-by-default in e-gov

221L4-1 Users can evaluate risk & adjust
behaviour
221L4-2 Promotion of online trust revised

0

222L4-2 Data protection measures of e-gov

5

Promotion of e-gov
Growing number of users can use egov securely
Incident disclosure in e-gov
E-commerce established1
0

222L3-3 Most users can use e-gov securely
222L3-4 User feedbacks for e-gov

1
0

0
0

223L3-1 Resource allocation for e-commerce00

Secure payment

01

Growing number of users can use ecommerce securely
Promotion of trust of e-commerce
Terms & conditions of e-commerce
accessible
Growing number of users can secure
personal information online
Discussions on balance between
security & privacy

0

223L3-2 Most users can use e-commerce
securely
223L3-3 Investment for e-commerce

223L4-1 Continuous improvement of ecommerce
223L4-2 Clear terms & conditions of ecommerce
223L4-3 User feedbacks for e-commerce

231L3-1 Measures to protect personal
information online
231L3-2 Privacy rights

00

231L3-3 Security & privacy balanced

0

231L3-4 Privacy-by-default

0

241L3-1 Coordination of incident reporting
channels
241L3-2 Promotion of incident reporting
channels prioritised
241L3-3 Metrics of incident reporting
251L3-1 Media coverage of information aboutcybersecurity measures
251L3-2 Frequent discussion on social media
security

0

231L4-1 Users can adapt to changing
environments
231L4-2 Wide recognition about personal
information protection
231L4-3 Security & privacy balanced inchanging environment
231L4-4 Regular assessment of privacy
protection
241L4-1 Regular enhancement of incident
reporting
241L4-2 Coordination of response to reported
incidents
251L4-1 Discussion changing policy & society0

Most officials have mind-set

Most private sector actors have mindset

0

0

6

2
1
0

1

0

0

0
0

0
0
0
0

Incident reporting mechanisms
established
Promotion of incident reporting
channels

1

Cybersecurity as common subject inmedia
Wide range of issues of cybersecurity
in media
Broad discussion on social media
security

0

1

0

0

0
0
0

0
0
0
0
0

0

0

265

Appendix H#

Category

311 Cybersecurity Education,
Training and Skills

Subcategory
Awareness Raising

Capacity area
Awareness Raising
Programmes

Level 1
ID
Keywords
311L1-1 Awareness raising programmes
311L1-2 Awareness raising programmes
affected by international initiatives

Level 2ID
Nb.
0 311L2-1
0

311L2-2

311L2-3

312 Cybersecurity Education,
Training and Skills

Awareness Raising

Executive AwarenessRaising

312L1-1 Executives' awareness about generalcybersecurity issues
312L1-2 Executives of particular sectors haveawareness

0

312L2-1

0

312L2-2
312L2-3

321 Cybersecurity Education,
Training and Skills

Framework for Education

Provision

321L1-1 Qualification programme forcybersecurity educators
321L1-2 Professional cybersecurity educators

0

321L2-1

0

321L2-2

321L1-3 Educational courses for cybersecurity0

321L2-3

321L1-4 Demand exists for cybersecurity
education

0

321L2-4
321L2-5

322 Cybersecurity Education,
Training and Skills

Framework for Education

Administration

322L1-1 Cybersecurity education needs
recognised
322L1-2 Ad-hoc supply of resources forcybersecurity education

0322L2-1

0322L2-2
322L2-3

331 Cybersecurity Education,
Training and Skills

332 Cybersecurity Education,
Training and Skills

Framework for Professional Provision
Training

Framework for Professional Uptake
Training

331L1-1 Cybersecurity training needs
recognised
331L1-2 Cybersecurity training for general IT
staff
331L1-3 ICT certification with somecybersecurity issues
331L1-4 Training courses for cybersecurity0

331L2-1

0

331L2-2

0

331L2-3

0

331L2-4

332L1-1 Metrics of uptake of cybersecurity
trainings

0332L2-1
332L2-2

411 Legal and Regulatory
Frameworks

412 Legal and Regulatory
Frameworks

Legal Framework

Legal Framework

Legislative Framework for
ICT Security

Privacy, Freedom of
Speech & Other Human
Rights Online

411L1-1 Discussion of establishing
cybersecurity legal framework
411L1-2 Priorities identified in cybersecurity
legal framework

0332L2-3
411L2-1

0411L2-2

412L1-1 Partial privacy protection legislation

0412L2-1

412L1-2 Freedom of expression

0412L2-2

412L1-3 Discussion of establishing digital
human rights legislation

0412L2-3
412L2-4
412L2-5

413 Legal and Regulatory
Frameworks

414 Legal and Regulatory
Frameworks

266

Legal Framework

Legal Framework

Data Protection Legislation 413L1-1 Partial data protection legislation

0413L2-1

413L1-2 Stakeholders' participation in dataprotection legislation
414L1-1 Partial online child protection
legislation

0413L2-2

0414L2-1

414L1-2 Stakeholders' participation in online
child protection legislation

0414L2-2Child Protection Online

Appendix H
Level 2
Keywords
National programme of awarenessraising
Consultation with stakeholders innational programme of awarenessraising
Cybersecurity information portal

Level 3ID
KeywordsNb.
0 311L3-1 Sector specific programmes ofawareness raising
0 311L3-2 Metrics for effectiveness of awarenessraising programmes

Level 4ID
KeywordsNb.
3 311L4-1 Awareness raising programmes
adapted according to effectiveness
1 311L4-2 Revision of national awareness raisingprogramme

10Qualification for cybersecurity
educators established
University level courses forcybersecurity
Degrees in cybersecurity

1

0

311L3-3 Evolution of awareness raisingprogrammes
311L3-4 Contribution to international awarenessraising
312L3-1 Executives' understandings ofcybersecurity measures
312L3-2 Executives' ability to reallocate
resources
312L3-3 Executives' understanding of crisis
management plans
312L3-4 Mandatory cybersecurity education for
executives
321L3-1 Business experts' participation incybersecurity education
321L3-2 Mandatory cybersecutity courses forcomputer science degrees
321L3-3 Cybersecurity specific degree

Seminars for non-specialist

0321L3-4 Cybersecurity as focusing area

2

Research & development incybersecurity promoted
Broad discussion for enhancing
cybersecurity education
Budget for research & education forcybersecurity
Attractiveness of cybersecurity career

4

2

Structured cybersecurity training
programmes
Security professional certification

0

Cybersecurity training requirements
listedCybersecurity training programmes for
non-professionals
Cybersecurity trained & certified
employees
Knowledge transfer in cybersecurity0

321L3-5 Cybersecurity education from primary
to post-graduate
322L3-1 Cybersecurity education
demand/supply monitored
322L3-2 Adapted budget for cybersecurity
education
322L3-3 International cooperation incybersecurity education
322L3-4 CoE in cybersecurity
331L3-1 Cybersecurity training aligned withinternational best practices
331L3-2 Cybersecurity training aligned withnational strategy
331L3-3 Communication skills in cybersecurity
training
331L3-4 Metrics of effectiveness ofcybersecurity training
332L3-1 Review of cybersecurity training
programmes
332L3-2 Coordination of cybersecurity training
across sectors

Job creation in cybersecurity
Cybersecurity legal framework
established
Coverages of cybersecurity legal
framework

00411L3-1 Regular review of cybersecurity legal
framework

1

Executives' basic understandings ofcybersecurity
Limited executives' understandings ofcybersecurity's affectRaising programmes for awareness ofcrisis management

0
0
0

0

0
4
0

0

1
1
0

Nb.
0
0

311L4-3 Entire society involved in awarenessraising
311L4-4 Overall threat reduced by awarenessraising
312L4-1 Cybersecurity as common agenda inboard meetings
312L4-2 Executives' attitude as internationalrole model3

321L4-1 Internationally forerunning incybersecurity education
321L4-2 Balance between core components &adaptive processes
321L4-3 Cybersecurity education adapting tochanging needs

5

0

322L4-1 International CoE in cybersecurity

95

322L4-2 Cooperation between all stakeholders
in cybersecurity education
322L4-3 Cybersecurity education aligned withpractical problems

6

331L4-1 Collaboration between public &private in cybersecurity training
331L4-2 Coordination between cybersecurity
training & education
331L4-3 Incentives for cybersecurity trained
workforce

3

332L4-1 Cybersecurity trained professionals
internationally contributing

0

411L4-1 Balance between cybersecurity legal
framework & best practices
411L4-2 Participation to international
cooperation agreements
411L4-3 Exceeding minimum requirement ofinternational cooperation agreement
412L4-1 Amendment procedures forcybersecurity legal framework3

412L4-2 Internet access as human right0

412L4-3 Contributing to international digital
human rights
412L4-4 Contributing to international privacy
protection online

1

413L4-1 Amendment procedures for dataprotection legislation

0

414L4-1 Amendment procedures for online
child protection legislation

0

1
1
1

2
1
0

0
0
0
1
3

0
3
0
5
0

2
5

4

1
2

2
1
3

0

Online privacy protected

0412L3-1 Cybersecurity legal framework alignedwith international best practices0

Freedom of expression protected

0412L3-2 Exceeding minimum requirement ofinternational agreement0

Privacy protected during investigation0

Stakeholders' participation to discuss
digital human rights legislation
Participation to international
agreements
Data protection legislation established

0

Personal data protected0

Online child protection legislation
established0

Legal minors protected

0

1
0
0

1

0
0

413L3-1 Timeframe of storing personal data
during investigation
413L3-2 Data protection legislation aligned withinternational best practices
414L3-1 Online child protection legislationaligned with international bestpractices

0
0
0

267

Appendix H#

Category

415 Legal and Regulatory
Frameworks

416 Legal and Regulatory
Frameworks

417 Legal and Regulatory
Frameworks

Subcategory
Legal Framework

Legal Framework

Legal Framework

Capacity area
Consumer Protection
Legislation

Intellectual Property
Legislation

Substantive Cybercrime
Legislation

Level 1
ID
Keywords
ID
Nb.
415L1-1 Partial consumer protection legislation 0 415L2-1

415L1-2 Stakeholders' participation in
consumer protection legislation
416L1-1 Partial intellectual property legislation

0415L2-2

0416L2-1

416L1-2 Stakeholders' participation in
intellectual property legislation

0

417L1-1 Partial substantive cybercrime
legislation

0417L2-1

417L2-2
418 Legal and Regulatory
Frameworks

Legal Framework

Procedural Cybercrime
Legislation

418L1-1 Partial procedural cybercrime
legislation

0418L2-1
418L2-2

421 Legal and Regulatory
Frameworks

Criminal Justice System

Law Enforcement

421L1-1 Limited digital forensics capabilities inlaw enforcement
421L1-2 Training for law enforcement officers

0421L2-1

0421L2-2
421L2-3

422 Legal and Regulatory
Frameworks

423 Legal and Regulatory
Frameworks

431 Legal and Regulatory
Frameworks

Criminal Justice System

Criminal Justice System

Formal and Informal
Cooperation Frameworks
to Combat Cybercrime

Prosecution

CourtsFormal Cooperation

422L1-1 Limited capabilities to prosecutecybercrimes
422L1-2 Training for prosecutors

0422L2-1

423L1-1 Limited capabilities to judge
cybercrimes
423L1-2 Training for judges

0423L2-1

0423L2-2

431L1-1 Formal international cooperation
against cybercrimes
431L1-2 Exchange of information between
public & private sectors aboutcybercrimes

0431L2-1

0431L2-2

0431L2-3

432 Legal and Regulatory
Frameworks

511 Standards, Organisations,and Technologies

Formal and Informal
Cooperation Frameworks
to Combat Cybercrime

Adherence to Standards

Informal Cooperation

ICT Security Standards

432L1-1 Exchange of information between
government & justice aboutcybercrimes
432L1-2 Cooperation between ISPs & law
enforcement
432L1-3 Informal international cooperation inlaw enforcement
511L1-1 Standards for information risk
management
511L1-2 Standards for information risk
management partly used
511L1-3 International standards & bestpractices implemented

0432L2-1

0432L2-2

0432L2-3

0511L2-1

0

511L2-2

0511L2-3
511L2-4
511L2-5
511L2-6

268

Level 2

Appendix H
Level 2
Keywords
Consumer protection legislation
established
Responsible agency designated for
consumer protection
Intellectual property legislation
established

Level 3ID
KeywordsNb.
0 415L3-1 Consumer protection legislationaligned with international bestpractices0

Level 4ID
KeywordsNb.
0 415L4-1 Amendment procedures for consumer
protection legislation

Nb.
1

0

416L3-1 Intellectual property legislation alignedwith international best practices

0416L4-1 Balance between intellectual property& open access policy

1

416L3-2 Stakeholders' participation in
amendment of intellectual property
legislation
417L3-1 Exceeding minimum requirement ininternational agreements on cybercrime

00417L4-1 Contributing to international
cybercrime treaties

2

417L3-2 Amendment procedures for substantive
cybercrime legislation
418L3-1 Procedural cybercrime legislation
enables cross-border investigation
418L3-2 Exceeding minimum requirement ininternational agreements on cybercrime

0417L4-2 Regular review of substantive
cybercrime legislation
418L4-1 Contributing to international
cybercrime treaties
418L4-2 Regular review of proceduralcybercrime legislation

1

0
421L4-1 Specialised and continuous training forlaw enforcement officers
421L4-2 Sophisticated digital forensic tools

0421L4-3 Regular review of investigative
capabilities for cybercrimes

3

0

423L3-2 Institutional structures of courts

0422L4-1 Prosecution of cross-bordercybercrimes
422L4-2 Dedicated prosecutorial resources forcybercrimes
422L4-3 Specialised and continuous training forprosecutors
423L4-1 Specialised and continuous training forjudges423L4-2 Regular review of court systemcapabilities to judge cybercrimes

2

0

418L3-3 Amendment procedures for proceduralcybercrime legislation
421L3-1 Dedicated investigative resources forcybercrimes
421L3-2 Advanced investigative capabilities forcybercrimes
421L3-3 Regular training for law enforcement
officers
421L3-4 Cross-border investigation of
cybercrimes
421L3-5 Statistics & analysis of cybercrime
investigations
422L3-1 Institutional structures in prosecution
services
422L3-2 Statistics & analysis of cybercrime
prosecutions
422L3-3 Exchange of best practices between
prosecutors & judges
423L3-1 Centralised judges for cybercrimes

423L3-3 Statistics & analysis of cybercrimeconvictions
431L3-1 Communication channels forinternational cooperation
431L3-2 Strategically expanding international
cooperation

0
431L4-1 Regular review of international
cooperation
431L4-2 Interoperability of formal & informalinternational cooperation

2

431L4-3 Regularly adjusted informationexchange between public & private
sectors
432L4-1 Adapted cooperation & exchange of
information

00

432L4-2 Adapted international cooperation

3

3

432L4-3 Interoperability of formal & informalinternational cooperation
511L4-1 Regular review of adoption ofstandards & best practices
511L4-2 Decision making of non-compliance tostandards & best practices
511L4-3 Risk-based decision making ofcompliance0

Substantive cybercrime legislation
exists0Participation to international
agreements on cybercrime
Procedural cybercrime legislation
existsParticipation to international
agreements on cybercrime0Comprehensive investigative
capabilities for cybercrimes
Established chain of custody of digital
evidence
Standards for training for law
enforcement officers

Comprehensive prosecutorial
capabilities for cybercrimes

Sufficient jurisdictional capabilities forcybercrimes
Specialised training for judges

0
0

0
0
0

0

0
0

1
4
1

0
0
0
0

Legislative requirements on
information exchange between public& private sectors
Established informal cooperation
between government & justice0

431L3-3 Resources for information exchange
between public & private sectors

0

0

1

Established informal cooperation
between ISPs & law enforcement
Informal international integration inlaw enforcement
Established standards & best practices

0Standards & best practices widely
used
Metrics of adoption of standards &best practices
Promotion of use of standards & bestpractices
Metrics of compliance of standards &best practices
Standards & best practices used by CI
supply chains1

432L3-1 Established relationship among
government, prosecutors, judges & law
enforcement
432L3-2 Cooperation between foreign ISPs &law enforcement
432L3-3 Joint international investigation &prosecution
511L3-1 Risk-based adoption of standards &best practices
511L3-2 Resource allocation based on standards

1

511L3-3 Contributing to international standards

4

0

0

1

1

0

1

3

Established formal international
cooperation
Mutual legal assistance & extradition

0

2

1
0

0
0

1
0
0
1

0

0

0
0
0

4
2
0

269

Appendix H#

Category

512 Standards, Organisations,and Technologies

Subcategory
Adherence to Standards

Capacity area
Standards in Procurement

Level 1
ID
Keywords
512L1-1 Standards & best practices for
procurement
512L1-2 Promotion of use of standards & bestpractices for procurement

Level 2ID
Nb.
0 512L2-1

0

512L2-2
512L2-3

513 Standards, Organisations,and Technologies

521 Standards, Organisations,and Technologies

Adherence to Standards

Internet Infrastructure
Resilience

Standards in Software
Development

Internet Infrastructure
Resilience

513L1-1 Standards & best practices fordevelopment
513L1-2 Promotion of use of standards & bestpractices for development
513L1-3 Coding standards
521L1-1 Limited internet infrastructures

0513L2-1

0513L2-2

00521L2-1

521L1-2 Discussion on resilience of internet
infrastructures

0521L2-2
521L2-3

521L2-4
531 Standards, Organisations,and Technologies

541 Standards, Organisations,and Technologies

551 Standards, Organisations,and Technologies

Software Quality

531L1-1 Quality & functional requirement ofsoftware531L1-2 Catalogue of secure softwares

0531L2-1

0531L2-2

531L1-3 Software update policies underdevelopment
531L1-4 Software deficiencies information
Technical Security Controls Technical Security Controls 541L1-1 Technical security controls deployed

0531L2-3

00531L2-4
541L2-1

541L1-2 Latest technical security controls
promoted
541L1-3 Anti-malware services by ISPs

0541L2-2

0541L2-3

541L1-4 ISPs' policies of technical security
control
541L1-5 IDS/IPS deployed

0541L2-4

0541L2-5

551L1-1 Cryptographic controls deployed0551L2-1

551L1-2 TLS deployed0551L2-2Cryptographic Controls

Software Quality

Cryptographic Controls

551L2-3

561 Standards, Organisations,and Technologies

562 Standards, Organisations,and Technologies

571 Standards, Organisations,and Technologies

Cybersecurity Marketplace Cybersecurity
Technologies

Cybersecurity Marketplace Cyber Insurance

Responsible Disclosure

Responsible Disclosure

561L1-1 Domestic security products market

0551L2-4
561L2-1

561L1-2 Cybersecurity consideration indevelopment
562L1-1 Needs for cybersecurity insurance
understood
562L1-2 Development of cybersecurity
insurance

0561L2-2

0562L2-1

0562L2-2

571L1-1 Information sharing of vulnerabilities

0571L2-1

571L1-2 Ability to address vulnerability reports

0571L2-2
571L2-3270

Appendix H
Level 2
Keywords
International standards & bestpractices for procurement
implemented
Metrics of adoption of standards &best practices for procurement
Metrics of compliance of standards &best practices for procurement

Level 3ID
KeywordsNb.
0 512L3-1 Standards & best practices for
procurement widely used & complied0

512L3-2 Regular review of procurement

1

Level 4ID
KeywordsNb.
2 512L4-1 Realtime monitoring of noncompliance to standards & bestpractices for procurement
0 512L4-2 Risk-based decision making of noncompliance0Metrics of adoption of standards &best practices for development
Education & training for development1

512L3-3 Wider resource planning inprocurement
512L3-4 Procurement skills benchmark
512L3-5 E-sourcing / e-tendering
513L3-1 Security consideration in all stages

0

513L3-2 Core development activities

0

Reliable internet infrastructures000

Established e-commerce & electronic
authentication
Internet infrastructures compliant tointernational standards & bestpractices
Internet infrastructures formallymanagedEstablished quality & functional
requirement of software
Softwares complying withinternational standards
Established software update processes

0513L3-3 Risk-based adoption of standards
521L3-1 Metrics of compliance to international
standards of internet infrastructures
521L3-2 Investment to new technologies ininternet infrastructures

Software classification
Latest technical controls & patch
managements widely implemented
Anti-malware softwares & network
firewalls
Physical security controls

1
4

Established ISPs' policies of technicalsecurity control
Technical security controls based oninternational frameworks
Cryptographic controls widely used0

Secure communication services0

Cryptographic controls complied tointernational standards
TLS widespread
Domestic providers of security
products
Lowering dependency on foreign
cybersecurity technologies
Established cybersecurity insurance
marketCovering additional costs (ex.
Forensic investigation etc.)0Established vulnerability disclosure
framework
Established processes against
vulnerability information
Non legal action

0
0
3

4

1

0

Nb.
0

0

513L4-1 Risk-based decision making of noncompliance
513L4-2 Adopting standards throughout lifetime
513L4-3 Explicit requirements by contract
521L4-1 Controlled acquisition of
infrastructures
521L4-2 Optimised cost for internet
infrastructures
521L4-3 Controlled acquisition of criticaltechnologies

0

0

0
0
0
0
0

0

531L3-1 Monitoring software quality

01

531L3-2 Review of software update policies &processes
531L3-3 Business benefit from improving
software quality
531L3-4 Software deficiency handling
541L3-1 User side security controls

0521L4-4 Independency & persistence of internet
infrastructure technologies
531L4-1 High performance, reliability &usability softwares
531L4-2 Automated service continuity

0531L4-3 Regular review of quality requirement012

541L3-2 Regular review of technical security
controls

2

541L4-1 Continuous assess of technical security
controls
541L4-2 Business impact by technical security
controls understood
541L4-3 Supplemental security services by ISPs

551L4-1 Regular review of relevance of
cryptographic controls
551L4-2 Revision of cryptographic control
policies

2

0

0

1
1

0

0
0

0
1

1
0

551L3-1 Risk-based use of cryptographic
controls
551L3-2 Regular review of cryptographic
control policies

05

561L4-1 Automated security functions

00

561L3-1 Security products complied toInternational standards
561L3-2 Risk-based product development

0561L4-2 Exporting superior security products

90562L3-1 Covering various costs

0

1

0

562L3-2 Choice of coverages

0562L4-1 Innovative cybersecurity insurance
market562L4-2 Emerging risks & various cyber harm

0562L4-3 Premium discount for secure behaviour

1

0

0

0

571L3-3 Deadlines of update

0571L4-1 Regular review of vulnerability
disclosure policies
571L4-2 Internationally contributing to
responsible disclosure
571L4-3 Deadlines of update complied
571L4-4 Reviewing process of deadlines

00562L3-3 Cybersecurity insurance products for
SMEs
571L3-1 Established responsible disclosure
processes
571L3-2 Analysis & dissemination processes

0
0

0

0

2

0

0
0
0

271

Appendix I

Appendix I Provisional Assessment of Japanese Cybersecurity Capacity#

Dimension

FactorAspecty/nyyyFormative
Keywords
Outline of strategy
Development process of strategy
Stakeholders involved in strategy

y/n
y
y
y

111 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

Strategy Development

112 Cybersecurity Policy Nationaland Strategy
Cybersecurity
Strategy

Organisationy

Cybersecurity programme under

113 Cybersecurity Policy
and Strategy
121 Cybersecurity Policy
and Strategy
122 Cybersecurity Policy
and Strategy

ContentyRisk priorities of cybersecurity defined in

Identification of
Incidents
OrganisationyRecording incidents

y
y
y
y
y
y
y

y
y

Key incident response organisations in
Ad-hoc responsesyy

123 Cybersecurity Policy Incident Response
and Strategy

CoordinationyLeading incident response organisation

124 Cybersecurity Policy Incident Response
and Strategy

Mode of Operationyy

Key incident response processes
CSIRT member training

y
y
n
y
y
y

y

List of CI assetsyInformal information sharing between CI &133 Cybersecurity Policy Critical Infrastructure Risk Management
and Strategy(CI) Protection
and ResponseyyyAccess control implemented in CI
Basic capacity against cyber threat in CI
Data security policy in CI

141 Cybersecurity Policy Crisis Management
and Strategy

Crisis ManagementyyyAssessment of exercise of national incident
Exercise planning organisation designated for
Stakeholders' participation in national

151 Cybersecurity Policy Cyber Defence
and Strategy

StrategynNational-level threats identified

152 Cybersecurity Policy
153 Cybersecurity Policy
and Strategy
161 Cybersecurity Policy
and Strategy

Cyber Defence
Cyber Defence

Organisation
CoordinationynDispersed cyber operations
Cyber defence capability requirements

Communications
RedundancyCommunications
RedundancyyyGaps in emergency communication identified
Emergency procedures established

211 Cyber Culture andSociety
212 Cyber Culture andSociety
213 Cyber Culture and
221 Cyber Culture andSocietyy

Leading agencies only have mind-set

y

y
y
y
y
y

Leading firms only have mind-set
Materials for best practices available
Limited users only have mind-set
A few users can use internet securely
Promotion of online trust exists

y222 Cyber Culture andSociety

Cybersecurity Mind- Government
set
Cybersecurity Mind- Private Sector
set
Cybersecurity Mind- Users
Trust and Confidence User Trust andon the Internet
Confidence on theInternet
Trust and Confidence User Trust in Eon the Internet
government Services

y
y
y
y

Government's recognition of needs for
Stakeholders' recognition of needs for
A few users can use e-gov securely
Security measures in e-gov

223 Cyber Culture andSociety

Trust and Confidence User Trust in Eon the Internet
commerce Services

y
y
y
y

Limited e-commerce provided
Private sectors' recognition of need for
A few users can use e-commerce securely
Security measures in e-commerce

131 Cybersecurity Policy
and Strategy
132 Cybersecurity Policy
and Strategy

272

National
Cybersecurity
Incident Response
Incident Response

Critical Infrastructure Identification(CI) Protection
Critical Infrastructure Organisation(CI) Protection

y
y
y
y
y
y
p
p
p

y
y
y
y
y
y
n

y
n
p
n
n
n

y
y
y
y
y
y
y
y
n
y
y
y
y
p

Appendix I

Established
Keywords
Strategy established
Stakeholders' consultation in strategy
Implementation of strategy
Cybersecurity programme agreed
Coordinating body of cybersecurity
Goals & measurement of cybersecurity
Discrete budget for cybersecurity
National objectives of cybersecurity defined
Minimum coverage of strategy contents
Central registry of incidents
National CSIRT
Roles & responsibilities of national CSIRT
Coordination established
Communication lines for crisis
International cooperation in incident response
Incident response processes & tools
Regular training for CSIRT members
Limited response to national level incidents

Audit of CI assets
CI assets audit list
Information sharing established between CI
Formal & consistent information sharing
Point of contact
Government engagement in CI protection
Standards & best practices in CI
Risk management processes in CI
National CI incident response plan

National incident exercise done
Appropriate resources for national incident
Roles in national incident exercise defined
Incentives to participate in national incident
Trained monitors of national incident
Evaluation of national incident exercise
Cyber defence strategy exists

Defined responsibility of cyber defence
Coordination between CI & defenceIntelligence sharing between CI & defence
Emergency response assets hardwired
Communication between emergency
Testing, training, drills of emergency
Most officials have mind-set
Most private sector actors have mind-set
Growing number of users have mind-set
Growing number of users can use internet
Promotion of online trust established
User assistance available
E-gov established
Risk reduction in e-gov
Promotion of e-gov
Growing number of users can use e-gov
Incident disclosure in e-gov
E-commerce established
Secure payment
Growing number of users can use ePromotion of trust of e-commerce
Terms & conditions of e-commerce

y/n
y
y
y
y
y
y

Strategic
Keywords
Reviewing process of strategy
Cyber exercises considered in strategy
Measurement of cybersecurity defined in
Capacity building & investment considered
PDCA processes of cybersecurity
Consolidated budget for cybersecurity

y/n
y
n

Dynamic
Keywords
Continual revision of strategy
Contributing to international debate ofnnReassignment & reallocation of resources for
Dissemination & feedbacks about

y
y
n
p
y
n

Measurement of cybersecurity defined inProtection of critical infrastructures defined
Regular revision of incident registry
Incident analysis
Formal roles & responsibilities allocatedAdequate resources for incident responseynnContinual revision of strategy
Contributing to international cooperation
Adapted analysis of incidents

n
n
n
n
n

Sustainability of incident response capability
Early warning capability
Capability to manage threat landscape
Coordinating all levels / sectors
Regional coordination

y
n
p
y
p
y
p
n
p
n
n
p
n

Subnational / sectorial incident response
International coordination
Information sharing across sectors
Training & accreditation for CSIRT members
Sophisticated incident analysis
Regular review of incident response
Forensics
International coordination
Priority of CI risks
Vulnerability & asset management of CI
Centralised management of CI protection
Public awareness campaign of CI protection
Supply chain management of CI

n
n
n
n

Scenario testing of incident response
Evaluating effectiveness of CSIRT members
Tools against zero-day vulnerabilities
Regional coordinationnRegular review of CI risk prioritiesnp

Ability to adjust of CI protection
Trust between CI & government

p
p
p
n
p
n
p
n
p
p
y
n
n
n
n
p
p
n
n
p
n
y
p
y
p
n
y
p
n
p
p
y
y

Cybersecurity oriented risk management inRegular review of impact analysis of CI
Regular review of CI incident response plans
Regular review of resource allocation for CI
Insider threat detection in CI
High-level scenario of national incident
Trust between participants of national
SMART objectives & KPI of national
Evaluation of national incident exercise
National crisis management aligned with
Tailored reports of national incident exercise
Dedicated resources for cyber defence
Capturing landscape of national-level threat
Cyber defence strategy meets objectives
Advanced capabilities & situational
Analytical capability in cyber defence
Strengths & weaknesses of cyber defence
Redundant communications for key
Interoperability & functionality under
Evaluation of national incident exercise
Contribution to international communications'Mind-set spread in public sector
Mind-set based strategy in public sector
Mind-set spread in private sector
Mind-set based strategy in private sector
Most users have mind-set
Most users can use internet securely
Users' ability to control providing personal
Promotion of online trust evaluatedDisclosures of activities of government
Privacy-by-default in e-gov
Most users can use e-gov securely
User feedbacks for e-gov

pp

Regular audit of CI
Indirect costs inclusive in impact analysis of

n
n
n
n

Peer observance of national incident exercise
National incident exercise contributing toInternationally shared result of national
National crisis management establishednnRules of engagement in cyberspace
Military doctrine in cyberspace

n
n
n
n
n

Cross-border response ability
Leading international debate about cyberIntelligence shared with allies
Optimised for extended outages
Assisting neighbours

n

n
p
n

Mind-set commonplace in public sector
N/A (same as above)
Mind-set commonplace in private sector
N/A (same as above)
Users' mind-set reducing threat
Users can evaluate risk & adjust behaviour
Promotion of online trust revisednpPromotion of e-gov revised
Data protection measures of e-govyyyResource allocation for e-commerce
Most users can use e-commerce securely
Investment for e-commerceynyContinuous improvement of e-commerce
Clear terms & conditions of e-commerce
User feedbacks for e-commercen273

Appendix I#

Dimension

FactorAspecty/nyyFormative
Keywords
Users have only general knowledge about
Discussions on protecting personal

y/n
y
p

231 Cyber Culture andSocietyUser Understandingof Personal
Information
Protection Online

User Understandingof Personal
Information
Protection Online

241 Cyber Culture andSociety

Reporting
Mechanisms

Reporting
MechanismsyReporting channels of incidentspy

251 Cyber Culture andSocietyMedia and Social
Media

Media and Social
Media

y
y

Media coverage of cybersecurity
Discussion on social media security

311 Cybersecurity
Education, Training
and Skills

Awareness Raising

Awareness Raising
ProgrammesynAwareness raising programmes
Awareness raising programmes affected by

y
y
y
n
n
n

312 Cybersecurity
Education, Training
and Skills

Awareness Raising

Executive AwarenessRaisingyyExecutives' awareness about general
Executives of particular sectors haveyyy

321 Cybersecurity
Education, Training
and Skills

Framework for
Education

ProvisionyyyyQualification programme for cybersecurity
Professional cybersecurity educators
Educational courses for cybersecurity
Demand exists for cybersecurity education

322 Cybersecurity
Education, Training
and Skills

Framework for
Education

AdministrationyyCybersecurity education needs recognised
Ad-hoc supply of resources for cybersecurity

y
y
y
y
y
y
y
y

331 Cybersecurity
Education, Training
and Skills

Framework for
Provision
Professional Training

y
y
y
y
p

Cybersecurity training needs recognised
Cybersecurity training for general IT staff
ICT certification with some cybersecurity
Training courses for cybersecurity
Metrics of uptake of cybersecurity trainingsyyDiscussion of establishing cybersecurity legal
Priorities identified in cybersecurity legalyyyPartial privacy protection legislation
Freedom of expression
Discussion of establishing digital human

Data Protection
Legislation
Child Protection
OnlineConsumer Protection
Legislation
Intellectual Property
Legislation
Substantive
Cybercrime
Procedural
Cybercrime
Legislation
Law Enforcement

y
y
y
y
y
y
y
y
y

Partial data protection legislation
Stakeholders' participation in data protection
Partial online child protection legislation
Stakeholders' participation in online childPartial consumer protection legislation
Stakeholders' participation in consumer
Partial intellectual property legislation
Stakeholders' participation in intellectual
Partial substantive cybercrime legislationyPartial procedural cybercrime legislationyyLimited digital forensics capabilities in law
Training for law enforcement officers

yyn

422 Legal and Regulatory Criminal Justice
Frameworks
System

ProsecutionyyLimited capabilities to prosecute cybercrimes
Training for prosecutors

n423 Legal and Regulatory Criminal Justice
Frameworks
SystemCourtsyyLimited capabilities to judge cybercrimes
Training for judgesnn431 Legal and Regulatory Formal and Informal
Frameworks
Cooperation
Frameworks to
Cybercrime
432 Legal and Regulatory Combat
Formal andInformalFrameworks
Cooperation
Frameworks to
Combat Cybercrime

Formal CooperationypFormal international cooperation against
Exchange of information between public &Informal CooperationnyyExchange of information between
Cooperation between ISPs & law
Informal international cooperation in law

n
y
n
n
y
n

332 Cybersecurity
Framework for
UptakeEducation, Training Professional Training
and Skills
411 Legal and Regulatory Legal Framework
Legislative
Frameworks
Framework for ICT
Security
412 Legal and Regulatory Legal Framework
Privacy, Freedom of
Frameworks
Speech & Other
Human Rights Online

413 Legal and Regulatory Legal Framework
Frameworks
414 Legal and Regulatory Legal Framework
Frameworks
415 Legal and Regulatory Legal Framework
Frameworks
416 Legal and Regulatory Legal Framework
Frameworks
417 Legal and Regulatory Legal Framework
Frameworks
418 Legal and Regulatory Legal Framework
Frameworks
421 Legal and Regulatory Criminal Justice
Frameworks
System

274

y
y
y
y
y
p
n
y
y
y
y
y
y
y
y
y
y
n
y
y
y
y
y
y
y

Appendix I
Established
Keywords
Growing number of users can secure
Discussions on balance between security &Incident reporting mechanisms established
Promotion of incident reporting channels
Cybersecurity as common subject in media
Wide range of issues of cybersecurity in
Broad discussion on social media security
National programme of awareness raising
Consultation with stakeholders in national
Cybersecurity information portal
Executives' basic understandings ofLimited executives' understandings ofRaising programmes for awareness of crisis
Qualification for cybersecurity educators
University level courses for cybersecurity
Degrees in cybersecurity
Seminars for non-specialist
Research & development in cybersecurity
Broad discussion for enhancing cybersecurity
Budget for research & education for
Attractiveness of cybersecurity career
Structured cybersecurity training
Security professional certification
Cybersecurity training requirements listed
Cybersecurity training programmes for nonCybersecurity trained & certified employees
Knowledge transfer in cybersecurity
Job creation in cybersecurity
Cybersecurity legal framework established
Coverages of cybersecurity legal framework
Online privacy protected
Freedom of expression protected
Privacy protected during investigation
Stakeholders' participation to discuss digitalParticipation to international agreements
Data protection legislation established
Personal data protected
Online child protection legislation established
Legal minors protected
Consumer protection legislation established
Responsible agency designated for consumer
Intellectual property legislation established
Substantive cybercrime legislation exists
Participation to international agreements on
Procedural cybercrime legislation exists
Participation to international agreements on
Comprehensive investigative capabilities for
Established chain of custody of digital
Standards for training for law enforcement

Comprehensive prosecutorial capabilities for

Sufficient jurisdictional capabilities forSpecialised training for judges
Established formal international cooperation
Mutual legal assistance & extradition
Legislative requirements on information
Established informal cooperation between
Established informal cooperation between
Informal international integration in law

y/n
p
y
n
p
n
n
n
p
p

Strategic
Keywords
Measures to protect personal information
Privacy rights
Security & privacy balanced
Privacy-by-default
Coordination of incident reporting channels
Promotion of incident reporting channels
Metrics of incident reporting
Media coverage of information about
Frequent discussion on social media security

y/n
p
n
n
p
n
n

Dynamic
Keywords
Users can adapt to changing environments
Wide recognition about personal information
Security & privacy balanced in changing
Regular assessment of privacy protection
Regular enhancement of incident reporting
Coordination of response to reportednDiscussion changing policy & society

n
n
n
n
p
p
p
n
y
n
y
n
n
n
y
p
y
y
n
p
p
p
n

Sector specific programmes of awareness
Metrics for effectiveness of awareness
Evolution of awareness raising programmes
Contribution to international awareness
Executives' understandings of cybersecurity
Executives' ability to reallocate resources
Executives' understanding of crisis
Mandatory cybersecurity education for
Business experts' participation in
Mandatory cybersecutity courses for
Cybersecurity specific degree
Cybersecurity as focusing area
Cybersecurity education from primary to
Cybersecurity education demand/supply
Adapted budget for cybersecurity education
International cooperation in cybersecurity
CoE in cybersecurity
Cybersecurity training aligned with
Cybersecurity training aligned with national
Communication skills in cybersecurity
Metrics of effectiveness of cybersecurity
Review of cybersecurity training programmes
Coordination of cybersecurity training across

n
n
n
n
p
n

Awareness raising programmes adapted
Revision of national awareness raising
Entire society involved in awareness raisingOverall threat reduced by awareness raising
Cybersecurity as common agenda in board
Executives' attitude as international rolennpInternationally forerunning in cybersecurity
Balance between core components &Cybersecurity education adapting tonnpInternational CoE in cybersecurity
Cooperation between all stakeholders in
Cybersecurity education aligned withpppCollaboration between public & private in
Coordination between cybersecurity training
Incentives for cybersecurity trainedp

Cybersecurity trained professionalsyRegular review of cybersecurity legalyyCybersecurity legal framework aligned with
Exceeding minimum requirement of

n
p
n
y
y
y
n

Balance between cybersecurity legal
Participation to international cooperation
Exceeding minimum requirement of
Amendment procedures for cybersecurity
Internet access as human rightContributing to international digital humanContributing to international privacynnnTimeframe of storing personal data during
Data protection legislation aligned with
Online child protection legislation alignedyAmendment procedures for data protectionyAmendment procedures for online childyConsumer protection legislation aligned withy

Amendment procedures for consumer

y
y
n
y
n
n
y
y
n
n
n
n
y
n
n
n
y
n
y
n
n
n
n
n

Intellectual property legislation aligned with
Stakeholders' participation in amendment of
Exceeding minimum requirement in
Amendment procedures for substantive
Procedural cybercrime legislation enables
Exceeding minimum requirement in
Amendment procedures for procedural
Dedicated investigative resources for
Advanced investigative capabilities forRegular training for law enforcement officers
Cross-border investigation of cybercrimes
Statistics & analysis of cybercrime
Institutional structures in prosecution
Statistics & analysis of cybercrime
Exchange of best practices between
Centralised judges for cybercrimes
Institutional structures of courts
Statistics & analysis of cybercrime
Communication channels for international
Strategically expanding international
Resources for information exchange between
Established relationship among government,
Cooperation between foreign ISPs & law
Joint international investigation &nBalance between intellectual property &

p
n
p
n

Contributing to international cybercrime
Regular review of substantive cybercrime
Contributing to international cybercrime
Regular review of procedural cybercrimennnSpecialised and continuous training for law
Sophisticated digital forensic tools
Regular review of investigative capabilities

n
n
n
n
n

Prosecution of cross-border cybercrimes
Dedicated prosecutorial resources forSpecialised and continuous training forSpecialised and continuous training forRegular review of court system capabilities

n
n
n
n
n
n

Regular review of international cooperation
Interoperability of formal & informal
Regularly adjusted information exchange
Adapted cooperation & exchange of
Adapted international cooperation
Interoperability of formal & informal

275

Appendix I#

Dimension

FactorAspectFormative
Keywords
Standards for information risk management
Standards for information risk management
International standards & best practices

511 Standards,
Organisations, andTechnologies

Adherence toStandards

ICT Security
Standards

y/n
y
y
y

512 Standards,
Organisations, andTechnologies

Adherence toStandards

Standards in
ProcurementyyStandards & best practices for procurement
Promotion of use of standards & best

513 Standards,
Organisations, andTechnologies
521 Standards,
Organisations, andTechnologies

Adherence toStandards

Standards in Software
Development

y
y
y
y
y

Standards & best practices for development
Promotion of use of standards & best
Coding standards
Limited internet infrastructures
Discussion on resilience of internet

531 Standards,
Organisations, andTechnologies

Software Quality

Software Quality

541 Standards,
Organisations, andTechnologies

Technical Security
Controls

Technical Security
Controls

551 Standards,
Organisations, andTechnologies

Cryptographic
Controls

Cryptographic
Controls

y
y
y
y
y
y
y
y
y
y
y

Quality & functional requirement of software
Catalogue of secure softwares
Software update policies under development
Software deficiencies information
Technical security controls deployed
Latest technical security controls promoted
Anti-malware services by ISPs
ISPs' policies of technical security control
IDS/IPS deployed
Cryptographic controls deployed
TLS deployed561 Standards,
Organisations, and562 Standards,
Organisations, andTechnologies
571 Standards,
Organisations, andTechnologies

Cybersecurity
Marketplace
Cybersecurity
Marketplace

Cybersecurity
Technologies
Cyber Insurance

y
y
y
y

Domestic security products market
Cybersecurity consideration in development
Needs for cybersecurity insurance
Development of cybersecurity insurance

Responsible
Disclosure

Responsible
DisclosureyyInformation sharing of vulnerabilities
Ability to address vulnerability reports

Internet Infrastructure Internet Infrastructure
Resilience
Resilience

y/n
y
y
n
y
n
p
y
n
n

n
y
y
y
y
y
y
y
y
n
y
y
y
y
y
y
y
y
y
y
n
p
p
y
p
y

y: achieved, p:partly achieved, n: not achieved, y%: ratio of "y"Dimension
1
2
3
4
5
Total

276

y

p
67
49
34
63
61
274

23
16
16
4
29
88

Total
n
52
18
25
49
31
175

Total
142
83
75
116
121
537

y%
47.2%
59.0%
45.3%
54.3%
50.4%
51.0%

y

p
22
19
13
24
27
105

Formative
n
0
2
0
0
1
1
1
1
0
0
2
4

Total
24
19
15
26
27
111

y%
91.7%
100.0%
86.7%
92.3%
100.0%
94.6%

y
30
19
16
21
24
110

Appendix I
Established
Keywords
Established standards & best practices
Standards & best practices widely used
Metrics of adoption of standards & best
Promotion of use of standards & best
Metrics of compliance of standards & best
Standards & best practices used by CI supply
International standards & best practices for
Metrics of adoption of standards & best
Metrics of compliance of standards & best

Metrics of adoption of standards & best
Education & training for development
Reliable internet infrastructures
Established e-commerce & electronic
Internet infrastructures compliant toInternet infrastructures formally managed
Established quality & functional requirement
Softwares complying with international
Established software update processes
Software classification
Latest technical controls & patch
Anti-malware softwares & network firewalls
Physical security controls
Established ISPs' policies of technicalTechnical security controls based on
Cryptographic controls widely used
Secure communication services
Cryptographic controls complied to
TLS widespread
Domestic providers of security products
Lowering dependency on foreign
Established cybersecurity insurance market
Covering additional costs (ex. Forensic
Established vulnerability disclosure
Established processes against vulnerability
Non legal actionp

Established
n
4
6
3
1
1
4
0
9
4
7
12
27

Total
40
23
21
30
35
149

y%
75.0%
82.6%
76.2%
70.0%
68.6%
73.8%

y/n
p
p
y

Strategic
Keywords
Risk-based adoption of standards & best
Resource allocation based on standards
Contributing to international standards

p
p
p
n
y
p
p
p
y
y

Standards & best practices for procurement
Regular review of procurement
Wider resource planning in procurement
Procurement skills benchmark
E-sourcing / e-tendering
Security consideration in all stages
Core development activities
Risk-based adoption of standards
Metrics of compliance to international
Investment to new technologies in internet

n
n
p
p
y
p

Monitoring software quality
Review of software update policies &Business benefit from improving software
Software deficiency handling
User side security controls
Regular review of technical security controls

p
y

y
y
p
p
n
n
p
n

y

y/n
n
p
p

Dynamic
Keywords
Regular review of adoption of standards &Decision making of non-compliance to
Risk-based decision making of compliancennpMonitoring of use of standards & best
Realtime monitoring of non-compliance to
Risk-based decision making of non-

p
p
p
n
p
n
n
n
n
n

Risk-based decision making of nonAdopting standards throughout life-time
Explicit requirements by contract
Controlled acquisition of infrastructures
Optimised cost for internet infrastructures
Controlled acquisition of critical technologies
Independency & persistence of internet
High performance, reliability & usability
Automated service continuity
Regular review of quality requirementpppContinuous assess of technical security
Business impact by technical security
Supplemental security services by ISPs

Risk-based use of cryptographic controls
Regular review of cryptographic controlyyRegular review of relevance of cryptographic
Revision of cryptographic control policies

Security products complied to International
Risk-based product development
Covering various costs
Choice of coverages
Cybersecurity insurance products for SMEs
Established responsible disclosure processes
Analysis & dissemination processes
Deadlines of update

n
n
n
n
n
n
n
n
n

Automated security functions
Exporting superior security products
Innovative cybersecurity insurance market
Emerging risks & various cyber harm
Premium discount for secure behaviour
Regular review of vulnerability disclosure
Internationally contributing to responsible
Deadlines of update complied
Reviewing process of deadlines

p
13
9
5
12
8
47

16
9
7
0
15
47

Strategic
n
17
6
11
19
6
59

Total
46
24
23
31
29
153

y%
28.3%
37.5%
21.7%
38.7%
27.6%
30.7%

y

p
2
2
0
6
2
12

3
4
7
3
10
27

Dynamic
n
27
11
9
20
18
85

Total
32
17
16
29
30
124

y%
6.3%
11.8%
0.0%
20.7%
6.7%
9.7%

277

Appendix J

Appendix J ANC3DB
Ref.
0001
0002
0003
0004
0005
0006
0007
0008
0009
0010
0011
0012
0013
0014
0015
0016
0017
0018
0019
0020
0021
0022
0023
0024
0025
0026
0027
0028
0029
0030
0031
0032
0033
0034
0035
0036
0037
0038
0039
0040
0041
0042
0043
0044
0045
0046
0047
0048
0049
0050
0051
0052
0053
0054
0055
0056
0057
0058
0059
0060
0061
0062
0063
0064
0065
0066
0067
0068
0069
0070
0071
0072
0073

278

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-111a7-111a7-111a7-112a7-112a7-112a7-112a2
7-112b
7-112b
7-112b
7-113a7-113a2
7-113b
7-113b
7-113c7-113c7-113c7-113d7-113d7-114a7-114a7-114b7-114c7-114c7-114d7-114d7-114d7-114e7-114e7-114e7-121a7-121a7-121a7-121a7-121a7-121b7-121b7-121b7-121c7-121c7-121c7-121c7-122a7-122a7-122a7-122a7-122a7-123a7-123a7-123a7-123b2
7-123b2
7-123b2
7-123c7-123c7-123d7-123d7-123e7-123e7-123e27-123e27-123f7-123g7-123h7-123i
7-123i
7-123j7-123j7-123j7-123j7-123j7-123k7-123kSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Promoting 'Security-by-Design' in new business harnessing IoT systems.
Promoting 'Security-by-Design' in new business harnessing IoT systems.
Promoting 'Security-by-Design' in new business harnessing IoT systems.
Promoting 'Security-by-Design' in new & large scale business harnessing IoT systems.
Promoting 'Security-by-Design' in new & large scale business harnessing IoT systems.
Promoting 'Security-by-Design' in new & large scale business harnessing IoT systems.
Promoting secure IoT systems based on "General Framework for Secure IoT Systems".
Considering measures to exterminate 'bot-net'.
Considering measures to exterminate 'bot-net'.
Considering measures to exterminate 'bot-net'.
Promoting "IoT Security Guidelines".
Promoting "IoT Security Guidelines" as international standard.
Promoting "EDSA certification" (security certification for control systems).
Promoting "EDSA certification" (security certification for control systems).
Analysing open source information & warning organisations of vulnerable systems.
Analysing open source information & warning organisations of vulnerable systems.
Analysing open source information & warning organisations of vulnerable systems.
Continuing operation of reporting & dissemination system for vulnerability information.
Continuing operation of reporting & dissemination system for vulnerability information.
Researching innovative & advanced technologies.
Researching innovative & advanced technologies.
Researching technologies for security countermeasures for IoTs.
Developing technologies of threat analysis & risk evaluation for control systems.
Developing technologies of threat analysis & risk evaluation for control systems.
Researching & developing technologies for automotive security in "SIP: Cross-ministerial
Strategic Innovation
Promotion
Program".
Researching& developing
technologies
for automotive security in "SIP: Cross-ministerial
Strategic Innovation
Promotion
Program".
Researching& developing
technologies
for automotive security in "SIP: Cross-ministerial
Strategic Innovation
Promotion
Program".
Promotingcountermeasuresagainstvulnerable IoT products in the market based on "Policy
for IoT Security
Countermeasures
Promotingcountermeasuresagainstver.1.0".
vulnerable IoT products in the market based on "Policy
for IoT Security
Countermeasures
Promotingcountermeasuresagainstver.1.0".
vulnerable IoT products in the market based on "Policy
for IoT Security
Countermeasuresver.1.0".
Surveying& promoting
cybersecurity
measures of enterprises based on "Guidelines ofCybersecurity
for Corporate
Management".
Surveying& promoting
cybersecurity
measures of enterprises based on "Guidelines ofCybersecurity
for Corporate
Management".
Surveying& promoting
cybersecurity
measures of enterprises based on "Guidelines ofCybersecurity
for Corporate
Management".
Surveying& promoting
cybersecurity
measures of enterprises based on "Guidelines ofCybersecurity
for Corporate
Management".
Surveying& promoting
cybersecurity
measures of enterprises based on "Guidelines ofCybersecurity
for Corporate
Management".
Promoting"Cybersecurity
Management
Guidelines".
Promoting "Cybersecurity Management Guidelines".
Promoting "Cybersecurity Management Guidelines".
Promoting cybersecurity insurance & "Cybersecurity Management Guidelines" by requiringthem in nationaltenders. insurance & "Cybersecurity Management Guidelines" by requiring
Promotingcybersecurity
themin nationaltenders. insurance & "Cybersecurity Management Guidelines" by requiring
Promotingcybersecurity
them in nationaltenders. insurance & "Cybersecurity Management Guidelines" by requiring
Promotingcybersecurity
them in national
Promotinghumantenders.
resources development for each category - board members, bridge
personnel &humanworking-levelbased on "Cybersecurity
Human
Resources
Development
Promotingresources- development
for each category- boardmembers,
bridgepersonnel &humanworking-levelbased on "Cybersecurity
Human
Resources
Development
Promotingresources- development
for each category- boardmembers,
bridgepersonnel &humanworking-levelbased on "Cybersecurity
Human
Resources
Development
Promotingresources- development
for each category- boardmembers,
bridgepersonnel &humanworking-levelbased on "Cybersecurity
Human
Resources
Development
Promotingresources- development
for each category- boardmembers,
bridgepersonnel &'Security-by-Design'.
working-level - based on "Cybersecurity Human Resources Development
Promoting
Promoting 'Security-by-Design'.
Promoting 'Security-by-Design'.
Promoting "Cybersecurity Management Guidelines" to SMEs (small-to medium-sizedenterprises).
Promoting"Cybersecurity Management Guidelines" to SMEs (small-to medium-sizedenterprises).
Promoting"Cybersecurity Management Guidelines" to SMEs (small-to medium-sizedenterprises).rules & regulations so as to improve security of whole supply chains of IT
Reviewingdevelopment& operation.
Reviewingrules& regulations so as to improve security of whole supply chains of IT
development corporates& operation.
Encouraging
to establish CSIRT.
Encouraging corporates to establish CSIRT.
Performing practical cyber defence exercise "CYDER" at "National Cyber Training Center".
Performing practical cyber defence exercise "CYDER" at "National Cyber Training Center".
Performing cyber exercises assuming attacks against Tokyo Olympics/Paralympics in 2020,
employing large
exerciseenvironment
Performing
cyberscale
exercises
assuming
attacks"Cyber
againstColosseo".
Tokyo Olympics/Paralympics in 2020,
employing large
scaleAPT
exerciseenvironment "Cyber Colosseo".
Performing
practical
exercises.
Enhancing "J-CRAT: Cyber Rescue Team" (activity to assist organisational incident
responses). financial industry-wide cyber exercises.
Performing
Promoting "iLogScanner: Attack Indication Detecting Tool for Websites".
Promoting "iLogScanner: Attack Indication Detecting Tool for Websites".
Continuing & enhancing operation of "J-CSIP: Cyber Intelligence Sharing Initiative".
Continuing & enhancing operation of "J-CSIP: Cyber Intelligence Sharing Initiative".
Continuing & enhancing operation of "J-CSIP: Cyber Intelligence Sharing Initiative".
Continuing & enhancing operation of "J-CSIP: Cyber Intelligence Sharing Initiative".
Continuing & enhancing operation of "J-CSIP: Cyber Intelligence Sharing Initiative".
Continuing & enhancing operation of "ICT-ISAC" (expanded & reorganised from TelecomISAC).
Continuing & enhancing operation of "ICT-ISAC" (expanded & reorganised from TelecomISAC).

Appendix J

ID
Category
511L2-4 Standards, Organisations, andTechnologies
Organisations, and
512L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
512L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Culture and Society
221L2-2 Cyber
521L2-1 Standards, Organisations, andTechnologies
Organisations, and
541L2-1 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
511L3-3 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
511L2-4 Standards,
Technologies Policy and
122L4-2 Cybersecurity
Cybersecurity Policy and
131L3-2 Strategy
Strategy
Policy and
132L2-1 Cybersecurity
Strategy Organisations, and571L3-1 Standards,
Technologies
Organisations, and571L3-2 Standards,
Technologies Education,
321L2-5 Cybersecurity
Training and Skills
Education,
322L2-2 Cybersecurity
Training andSkillsOrganisations,and541L3-2 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
511L2-1 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
511L2-1 Standards,
Technologies
Organisations, and
541L3-2 Standards,
Technologies
Culture and Society
213L3-1 Cyber
221L2-2 Cyber Culture and Society
221L3-1 Cyber Culture and Society
311L3-2 Cybersecurity Education,
Training and Skills
Education,
312L3-1 Cybersecurity
Training andSkillsOrganisations,and
511L2-3 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
511L2-5 Standards,
Technologies
Culture and Society
212L3-1 Cyber
312L3-1 Cybersecurity Education,
Training andSkillsOrganisations,and
511L2-1 Standards,
Technologies Education,
312L3-1 Cybersecurity
Training andSkillsOrganisations,and
511L2-1 Standards,
Standards, Organisations, and
512L3-1 Technologies
Technologies
Organisations, and562L2-1 Standards,
Technologies Education,
312L3-1 Cybersecurity
Training and Skills
Education,
312L3-3 Cybersecurity
Training and Skills
Education,
331L2-4 Cybersecurity
Training and Skills
Education,
331L3-2 Cybersecurity
Training and Skills
Education,
331L3-3 Cybersecurity
Training andSkillsOrganisations,and
511L2-4 Standards,
Technologies
Organisations, and
512L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Culture and Society
212L4-1 Cyber
312L3-1 Cybersecurity Education,
Training andSkillsOrganisations,and
511L2-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
513L4-2 Standards,
Technologies
Culture and Society
212L3-2 Cyber
312L3-3 Cybersecurity Education,
Training and Skills
Policy and
124L4-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
124L4-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Culture and Society
221L2-2 Cyber
521L2-1 Standards, Organisations, andTechnologies Policy and
132L2-1 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
132L2-3 Cybersecurity
Strategy
Policy and
132L2-4 Cybersecurity
Strategy
Policy and
153L2-2 Cybersecurity
Strategy
Policy and
132L2-1 Cybersecurity
Cybersecurity Policy and
132L2-2 Strategy
Strategy

Categorization / Classification
Subcategory
Capacity area
Adherence to Standards
ICT Security Standards
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Software
Development
Adherence to Standards
ICT
Security Standards
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Software
Development
Adherence to Standards
ICT
Security Standards
Trust and Confidence on the User Trust and Confidence on
the Internet
Internet InfrastructureInternet
Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Critical Infrastructure (CI)
Risk Management andProtection to Standards
Response
Adherence
ICT
Security Standards
Incident Response
Organisation
Critical Infrastructure (CI)Identification
Protection
CriticalInfrastructure (CI)
Organisation
Protection Disclosure
Responsible
Responsible Disclosure
Responsible Disclosure
Responsible Disclosure
Framework for Education
Provision
Framework for Education
Administration
Technical Security Controls
Technical Security Controls
Critical Infrastructure (CI)
Risk Management andProtection to Standards
Response
Adherence
ICT
Security Standards
Critical Infrastructure (CI)
Risk Management andProtection to Standards
Response
Adherence
ICT
Security Standards
Technical Security Controls
Technical Security Controls
Cybersecurity Mind-set
Users
Trust and Confidence on the User Trust and Confidence on
Internet
the Internet
Trust
and Confidence on the User
Trust and Confidence on
Internet
the Internet Raising
Awareness
Raising
Awareness
Programmes
Awareness Raising
Executive
Awareness Raising
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Cybersecurity Mind-set
Private Sector
Awareness Raising
Executive Awareness Raising
Adherence to Standards
ICT Security Standards
Awareness Raising
Executive Awareness Raising
Adherence to Standards
ICT Security Standards
Adherence to Standards
Standards in Procurement
Cybersecurity Marketplace
Cyber Insurance
Awareness Raising
Executive Awareness Raising
Awareness Raising
Executive Awareness Raising
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Professional
Framework
Provision
Training to Standards
Adherence
ICT Security Standards
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Software
Development
Cybersecurity Mind-set
PrivateSectorAwareness Raising
Executive Awareness Raising
Adherence to Standards
ICT Security Standards
Adherence to Standards
Standards in Software
Development
Adherence to Standards
Standards
in Software
Development
Cybersecurity Mind-set
PrivateSectorAwareness Raising
Executive Awareness Raising
Incident Response
Mode of Operation
Crisis Management
Crisis Management
Incident Response
Mode of Operation
Crisis Management
Crisis Management
Crisis Management
Crisis Management
Incident Response
Coordination
Crisis Management
Crisis Management
Trust and Confidence on the User Trust and Confidence on
Internet Infrastructure
theInternet
Internet
Infrastructure
Resilience
Resilience
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
Cyber
Defence
Coordination
Critical Infrastructure (CI)
Organisation
Protection
Critical Infrastructure (CI)
Organisation
Protection

Level
2
1
3
2
1
3
2
2
2
2
2
3
3
2
4
3
2
3
3
2
2
3
3
2
3
2
3
3
2
3
3
3
2
2
2
3
3
2
3
2
3
2
3
3
2
3
3
2
1
3
4
3
2
3
4
3
3
4
3
4
3
3
3
3
2
2
2
2
2
2
2
2
2

Requirement (keyword)
Promotion of use of standards & bestpractices of use of standards & best
Promotionpracticesconsideration
for procurement
Securityin all stages
Promotion of use of standards & bestpractices of use of standards & best
Promotionpracticesconsideration
for procurement
Securityin all stages
Promotion of use of standards & bestpractices of online trust established
Promotion
Reliable internet infrastructures
Latest technical controls & patch
managements
widelyimplemented
Promotionof useof standards& bestpractices
Contributing
to international standards
Cybersecurity oriented risk management in CI
Promotion of use of standards & bestpracticesEarly
warning capability
Vulnerability & asset management of CI
assetsInformation
sharing established between CI &government responsible disclosure processes
EstablishedAnalysis & dissemination processes
Research & development in cybersecurity
promoted
Budgetfor research & education forcybersecurity
Regularreview of technical security controls
Cybersecurity oriented risk management in CI
Established standards & best practices
Cybersecurity oriented risk management in CI
Established standards & best practices
Regular review of technical security controls
Most users have mind-set
Promotion of online trust established
Most users can use internet securely
Metrics for effectiveness of awareness raisingprogrammesunderstandings of cybersecurity
Executives'
measuresof adoption of standards & best
Metrics
practices of use of standards & best
Promotionpracticesof compliance of standards & best
Metrics
practices spread in private sector
Mind-set
Executives' understandings of cybersecurity
measures standards & best practices
Established
Executives' understandings of cybersecurity
measures standards & best practices
EstablishedStandards & best practices for procurement
widely used cybersecurity& complied insurance market
Established
Executives' understandings of cybersecurity
measures understanding of crisis
Executives'
management plans
Cybersecurity
training programmes for nonprofessionals training aligned with national
Cybersecurity
strategy
Communication
skills in cybersecurity training
Promotion of use of standards & bestpractices of use of standards & best
Promotionpracticesconsideration
for procurement
Securityin all stages
Mind-set commonplace in private sector
Executives' understandings of cybersecurity
measures & best practices widely used
Standards
Security consideration in all stages
Adopting standards throughout life-time
Mind-set based strategy in private sector
Executives' understanding of crisis
management
plans
Scenario
testingof incident response
processes scenario of national incident
High-level
exercise testing of incident response
Scenario
processes scenario of national incident
High-level
exercise scenario of national incident
High-level
exercise
Subnational/ sectorial incident responseorganisations
High-level
scenario of national incident
exercise of online trust established
Promotion
Reliable internet infrastructures
Information sharing established between CI &government
Formal& consistent information sharing
between
CI & government
Pointof contact
Government engagement in CI protection
Intelligence sharing between CI & defence
Information sharing established between CI &government
Formal & consistent information sharing
between CI & government279

Appendix J
Ref.
0074
0075
0076
0077
0078
0079
0080
0081
0082
0083
0084
0085
0086
0087
0088
0089
0090
0091
0092
0093
0094
0095
0096
0097
0098
0099
0100
0101
0102
0103
0104
0105
0106
0107
0108
0109
0110
0111
0112
0113
0114
0115
0116
0117
0118
0119
0120
0121
0122
0123
0124
0125
0126
0127
0128
0129
0130
0131
0132
0133
0134
0135
0136
0137
0138
0139
0140
0141
0142
0143
0144
0145
0146
0147

280

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-123k7-123k7-123l7-123l7-123l7-123l7-131a7-131a7-131b7-131b7-131c7-131c7-131c7-131c7-131c7-131d7-131d7-132a7-132a7-132b7-132b7-132c7-132c7-132d7-133a7-133b7-133b7-133b7-133b7-133c7-133c7-133d7-133e7-133e7-133e7-133f7-133g7-133g7-133g7-133g7-133g7-133h7-133h7-211b
7-211b
7-211b
7-211c7-211c7-211c7-211c7-211c7-211c2
7-211c2
7-211c2
7-211d7-211d7-211d7-211f
7-211g7-211h7-211i7-211i7-211j7-211j7-211j7-211j7-211k
7-211k
7-211l7-211l7-211m7-211m7-211m7-211nSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Continuing & enhancing operation of "ICT-ISAC" (expanded & reorganised from TelecomISAC).
Continuing& enhancing operation of "ICT-ISAC" (expanded & reorganised from TelecomISAC).
Enhancing"Financial ISAC Japan".
Enhancing "Financial ISAC Japan".
Enhancing "Financial ISAC Japan".
Enhancing "Financial ISAC Japan".
Cultivating cybersecurity-related business to a growth industry by establishing certification
for security cybersecurity-related
services.
Cultivating
business to a growth industry by establishing certification
for security"Cloud
services.
Promoting
Security Guidelines" & "Cloud Audit System".
Promoting "Cloud Security Guidelines" & "Cloud Audit System".
Promoting security investment of SMEs (small-to medium-sized enterprises).
Promoting security investment of SMEs (small-to medium-sized enterprises).
Promoting security investment of SMEs (small-to medium-sized enterprises).
Promoting security investment of SMEs (small-to medium-sized enterprises).
Promoting security investment of SMEs (small-to medium-sized enterprises).
Reconsidering "Copyright Act" about reverse engineering for security purposes.
Reconsidering "Copyright Act" about reverse engineering for security purposes.
Continuing "Public & Private Sectors Forum for Trade Secret" to share information about
information "Public
exfiltration.
Continuing& Private Sectors Forum for Trade Secret" to share information about
information"Handbook
exfiltration.for Confidential Information Protection" & "Guide for Handbook for
PromotingConfidential
Information
Promoting"HandbookforProtection".
Confidential Information Protection" & "Guide for Handbook for
Confidential
Information
Protection".
Promoting guidelines
for deterrence/preventionof internal misconduct within organisations.
Promoting guidelines for deterrence/prevention of internal misconduct within organisations.
Communicating & negotiating with countries who apply 'Forced Localization Measures'.
Supporting international standardization in security through participation to ISO/IEC
JTC1/SC27,international
ITU-T SG17standardization
etc.
Supportingin cryptography, certification for cryptograph &security products.
Supportinginternational standardization in cryptography, certification for cryptograph &security products.
Supportinginternational standardization in cryptography, certification for cryptograph &security products.
Supportinginternational standardization in cryptography, certification for cryptograph &security products.
Supportinginternational standardization in vulnerability management like SCAP, CVSS etc.
Supporting international standardization in vulnerability management like SCAP, CVSS etc.
Supporting international standardization in security evaluation like PP (Protection Profile)etc.
Assisting
ITPEC (IT Professionals Examination Council: organisation for a common IT
examinationin Asiancountries) by Examination'exporting' "Japan
Information-Technology
Engineers
Assisting
ITPEC(IT Professionals
Council:organisation for a commonITexaminationin Asiancountries) by Examination'exporting' "Japan
Information-Technology
Engineers
Assisting
ITPEC(IT Professionals
Council:organisation for a commonITexaminationin Asiancountries)inbyASEAN'exporting'"Japan Information-Technology Engineers
Assistingsecurity
management
countries.
Assisting establishment of 'secure development' in countries where Japanese corporates
outsource establishment
software development.
Assistingof 'secure development' in countries where Japanese corporates
outsource establishment
software development.
Assistingof 'secure development' in countries where Japanese corporates
outsource
software development.
Assisting establishment
of 'secure development' in countries where Japanese corporates
outsource establishment
software development.
Assistingof 'secure development' in countries where Japanese corporates
outsource softwaredevelopment.
Researchinginternational
standards & evaluation system for IoT systems.
Researching international standards & evaluation system for IoT systems.
Promoting 'Security-by-Design' in IoT & embedded systems.
Promoting 'Security-by-Design' in IoT & embedded systems.
Promoting 'Security-by-Design' in IoT & embedded systems.
Promoting "How to Secure Your Web Site".
Promoting "How to Secure Your Web Site".
Promoting "How to Secure Your Web Site".
Promoting "How to Secure Your Web Site".
Promoting "How to Secure Your Web Site".
Promoting "AppGoat" (training tool for secure development).
Promoting "AppGoat" (training tool for secure development).
Promoting "AppGoat" (training tool for secure development).
Researching technologies for securer development & more sophisticated evaluation.
Researching technologies for securer development & more sophisticated evaluation.
Researching technologies for securer development & more sophisticated evaluation.
Supporting vulnerability management in organisations, by promoting structured languages
for vulnerability
information.
Promoting'fuzz testing'for pro-active vulnerability detection.
Upgrading "NICTER: Network Incident Analysis Center for Tactical Emergency Response".
Continuing operation of "ACTIVE: Advanced Cyber Threat Response Initiative" (assistancefor users to operation
disinfect malwares
fromAdvanced
compromised
PCs).
Continuingof "ACTIVE:
Cyber
Threat Response Initiative" (assistancefor users to operation
disinfect malwares
from compromised
PCs).region internet fixed pointContinuing
of "TSUBAME"(Asia & Pacificobservationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationoperation
system). of "Council of Anti-Phishing Japan".
Continuing
Continuing operation of "Council of Anti-Phishing Japan".
Promoting "icat: IPA Cyber Security Alert Service".
Promoting "icat: IPA Cyber Security Alert Service".
Urging public Wi-Fi service providers to prevent cybercrime & to enable effective tracking
back.
Urging public Wi-Fi service providers to prevent cybercrime & to enable effective tracking
back. public Wi-Fi service providers to prevent cybercrime & to enable effective tracking
Urgingback.
Initiating
Wi-Fi service providers & users to safer communication.

Appendix J

ID
Category
132L2-3 Cybersecurity Policy andStrategy
and Regulatory
431L3-3 Legal
Frameworks Policy and
132L2-1 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
132L2-3 Cybersecurity
Strategy
and Regulatory
431L3-3 Legal
FrameworksOrganisations, and561L2-1 Standards,
Technologies
Organisations, and561L2-2 Standards,
Technologies
Organisations, and
511L2-1 Standards,
Technologies
Organisations, and561L3-1 Standards,
Technologies Education,
312L3-1 Cybersecurity
Training andSkillsOrganisations,and
511L2-2 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Standards, Organisations, and
541L2-2 Technologies
Technologies Policy and
121L4-1 Cybersecurity
Strategy
Policy and
124L3-2 Cybersecurity
Strategy
Education,
311L2-1 Cybersecurity
Training
SkillsandandRegulatory
431L1-2 Legal
FrameworksOrganisations, and
511L2-1 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Standards, Organisations, and
511L2-1 Technologies
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
521L4-2 Standards,
Technologies
Organisations, and
511L3-3 Standards,
Technologies
and Regulatory
412L4-4 Legal
FrameworksOrganisations, and
511L3-3 Standards,
Technologies
Organisations, and
551L4-1 Standards,
Technologies
Organisations, and
551L4-2 Standards,
Technologies
Organisations, and
511L3-3 Standards,
Technologies
Organisations, and
571L4-2 Standards,
Technologies
Organisations, and
511L3-3 Standards,
Technologies Education,
311L3-4 Cybersecurity
Training and Skills
Education,
322L3-3 Cybersecurity
Training and Skills
Education,
332L4-1 Cybersecurity
Training and Skills
Education,
311L3-4 Cybersecurity
Training and Skills
Education,
311L3-4 Cybersecurity
Training andSkillsOrganisations,and513L1-3 Standards,
Technologies
Organisations, and
513L2-2 Standards,
Standards, Organisations, and
513L3-1 Technologies
Technologies
Organisations, and
541L2-5 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
511L3-3 Standards,
Technologies
Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
512L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Cyber Culture and Society
223L2-4 Technologies
223L2-4 Cyber Culture and Society
513L1-3 Standards, Organisations, andTechnologies
Organisations, and
513L2-2 Standards,
Technologies
Organisations, and
541L2-5 Standards,
Technologies
Organisations, and
513L1-3 Standards,
Technologies
Organisations, and
513L2-2 Standards,
Technologies
Organisations, and
541L2-5 Standards,
Technologies
Organisations, and
513L2-2 Standards,
Technologies
Organisations, and
541L2-5 Standards,
Technologies
Organisations, and
541L3-2 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Technologies
Organisations, and571L2-1 Standards,
Technologies Policy and
122L4-2 Cybersecurity
Strategy
Culture and Society
221L2-2 Cyber
221L2-3 Cyber Culture and Society
122L4-2 Cybersecurity Policy andStrategy
Policy and
123L4-2 Cybersecurity
Strategy
Policy and
124L4-4 Cybersecurity
Strategy
and Regulatory
431L2-1 Legal
Frameworks
Culture and Society
221L2-2 Cyber
431L3-3 Legal and Regulatory
Frameworks
Culture and Society
221L2-2 Cyber
541L2-1 Standards, Organisations, andTechnologies
Culture and Society
221L2-2 Cyber
432L2-2 Legal and Regulatory
FrameworksOrganisations, and
541L2-4 Standards,
Technologies
Culture and Society
213L2-1 Cyber

Categorization / Classification
Subcategory
Capacity area
Level
Requirement (keyword)
Critical Infrastructure (CI)
Organisation
Point of contact
2
Protection
Formaland Informal
Formal Cooperation
Resources for information exchange between
3
Cooperation
Frameworks
public & private
sectors
CriticalInfrastructure(CI)toOrganisation
Information
sharingestablished between CI &2
Protection
government
CriticalInfrastructure (CI)
Organisation
Formal& consistent information sharing
2
Protection
between
CI & government
CriticalInfrastructure (CI)
Organisation
Pointof contact
2
Protection
Formaland Informal
Formal Cooperation
Resources for information exchange between
3
Cooperation Frameworks
public & private
sectors
Cybersecurity
Marketplaceto
Cybersecurity Technologies
Domestic
providersof security products
2
Cybersecurity Marketplace
Cybersecurity Technologies
Lowering dependency on foreign
2cybersecurity
technologies
Adherence to Standards
ICT Security Standards
Establishedstandards& best practices
2
Cybersecurity Marketplace
Cybersecurity Technologies
Security products complied to International
3
standards understandings of cybersecurity
Awareness Raising
Executive Awareness Raising
Executives'
3
measures & best practices widely used
Adherence to Standards
ICT Security Standards
Standards
2
Adherence to Standards
ICT Security Standards
Promotion of use of standards & best2
practices
Technical Security Controls
Technical Security Controls
Latesttechnical controls & patch2
managements
implemented
Technical Security Controls
Technical Security Controls
Anti-malware widely
softwares& network firewalls
2
Incident Response
Identification of Incidents
Adapted analysis of incidents
4
Incident Response
Mode of Operation
Sophisticated incident analysis
3
Awareness Raising
Awareness Raising
National programme of awareness raising2
Programmes
Formal and Informal
FormalCooperation
Exchange of information between public &1
CooperationtoFrameworks
private sectors
about cybercrimes
Adherence
Standards to
ICT Security Standards
Establishedstandards& best practices
2
Adherence to Standards
ICT Security Standards
Promotion of use of standards & best2
practices
Adherence to Standards
ICT Security Standards
Established standards & best practices
2
Adherence to Standards
ICT Security Standards
Promotion of use of standards & best2
practices cost for internet infrastructures
Internet InfrastructureInternet Infrastructure
Optimised
4
Resilience to Standards
Resilience
Adherence
ICT
Security Standards
Contributing to international standards
3
Legal Framework
Privacy, Freedom of Speech &Contributing to international privacy
4
OtherSecurity
HumanStandards
Rights Online
protection online
Adherence to Standards
ICT
Contributing
to international standards
3
Cryptographic Controls
Cryptographic Controls
Regular review of relevance of cryptographic
4
controls of cryptographic control policies
Cryptographic Controls
Cryptographic Controls
Revision
4
Adherence to Standards
ICT Security Standards
Contributing to international standards
3
Responsible Disclosure
Responsible Disclosure
Internationally contributing to responsible
4
disclosure to international standards
Adherence to Standards
ICT Security Standards
Contributing
3
Awareness Raising
Awareness Raising
Contribution to international awareness3
Programmes
raising
Framework for Education
Administration
International
cooperation in cybersecurity
3
education
Framework for Professional
UptakeCybersecurity
trained professionals
4
Training Raisinginternationallytocontributing
Awareness
Awareness Raising
Contribution
international awareness3
ProgrammesRaisingraising
Awareness Raising
Awareness
Contribution
to international awareness3
Programmes
raising standards
Adherence to Standards
Standards
in Software
Coding1
Development
Adherence to Standards
Standards
in Software
Education & training for development2
Development
Adherence to Standards
Standards in Software
Security consideration in all stages
3
Development
Technical Security Controls
Technical
Security Controls
Technical security controls based on
2international frameworks
Critical Infrastructure (CI)
Risk Management andCybersecurity
oriented risk management in CI
3
Protection to Standards
Response
Adherence
ICT
Security Standards
Contributing to international standards
3
Adherence to Standards
ICT Security Standards
Promotion of use of standards & best2
practices of use of standards & best
Adherence to Standards
Standards in Procurement
Promotion
1
practicesconsideration
for procurement
Adherence to Standards
Standards in Software
Securityin all stages
3
Trust and Confidence on the Development
User Trust in E-commerce
Promotion of trust of e-commerce
2
Internet
Services
Trustand Confidence on the User
Trust in E-commerce
Promotion of trust of e-commerce
2
Internet to Standards
Services in Software
Adherence
Standards
Coding standards
1
Development
Adherence to Standards
Standards
in Software
Education & training for development2
Development
Technical Security Controls
Technical
Security Controls
Technical security controls based on
2internationalframeworks
Adherence to Standards
Standards in Software
Codingstandards
1
Development
Adherence to Standards
Standards
in Software
Education & training for development2
Development
Technical Security Controls
Technical
Security Controls
Technical security controls based on
2international
Adherence to Standards
Standards in Software
Education& frameworks
training for development2
Development
Technical Security Controls
Technical
Security Controls
Technical security controls based on
2internationalframeworks
Technical Security Controls
Technical Security Controls
Regularreviewof technical security controls
3Technical Security Controls
Technical Security Controls
Latest technical controls & patch2
managements
widely implemented
Responsible Disclosure
Responsible Disclosure
Establishedvulnerability
disclosure
2
framework
Incident Response
Organisation
Early
warning capability
4
Trust and Confidence on the User Trust and Confidence on
Promotion of online trust established2Internet
the Internet
Trust
and Confidence on the User
Trust and Confidence on
User assistance available
2
Internet Response
the Internet
Incident
Organisation
Early warning capability
4
Incident Response
Coordination
Regional coordination
4
Incident Response
Mode of Operation
Regional coordination
4
Formal and Informal
Formal Cooperation
Established formal international cooperation
2
Cooperation
Frameworks
to
Trust
and Confidence
on theUser Trust and Confidence on
Promotion of online trust established2Internetand Informal
the Internet
FormalFormalCooperation
Resources for information exchange between
3
Cooperation
Frameworks
topublic & private
sectors
Trust
and Confidence
on theUser Trust and Confidence on
Promotionof online
trust established2Internet Security Controls
the InternetSecurity Controls
Technical
Technical
Latest technical controls & patch2
managements
widelytrust
implemented
Trust and Confidence on the User Trust and Confidence on
Promotionof online
established2Internet
the
Internet
Formal and Informal
InformalCooperation
Established informal cooperation between
2
Cooperation
Frameworks
to
ISPs & law enforcement
Technical
Security
Controls
Technical Security Controls
Established
ISPs' policies of technical security2
control number of users have mind-set
Cybersecurity Mind-set
Users
Growing2281

Appendix J
Ref.
0148
0149
0150
0151
0152
0153
0154
0155
0156
0157
0158
0159
0160
0161
0162
0163
0164
0165
0166
0167
0168
0169
0170
0171
0172
0173
0174
0175
0176
0177
0178
0179
0180
0181
0182
0183
0184
0185
0186
0187
0188
0189
0190
0191
0192
0193
0194
0195
0196
0197
0198
0199
0200
0201
0202
0203
0204
0205
0206
0207
0208
0209
0210
0211
0212
0213
0214
0215
0216
0217
0218
0219
0220
0221

282

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-211n7-211n7-211n7-211o7-211o7-211o7-211o7-212a7-212a7-212b7-212b7-212b7-212b7-212b2
7-212b2
7-212b2
7-212c7-212c7-212c7-212d7-212d7-212d7-212d7-212e7-212e7-212f7-212f7-212g7-212h7-212i7-212i7-212j7-212j7-212j7-212j7-212k
7-212k
7-212l7-212m7-212m7-212n7-212n7-212o7-212p7-212q
7-213a7-213a7-213b
7-213b
7-213c7-213c7-213c7-213c2
7-213d
7-213d
7-213d
7-213e7-213e7-213f
7-213g
7-213g
7-213h7-213i7-213j7-213j7-213k
7-213k2
7-213k2
7-220b7-220b7-220b2
7-220b2
7-220b2
7-220cSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Initiating Wi-Fi service providers & users to safer communication.
Initiating Wi-Fi service providers & users to safer communication.
Initiating Wi-Fi service providers & users to safer communication.
Considering development of intelligence sharing platform for government & private sectors.
Considering development of intelligence sharing platform for government & private sectors.
Considering development of intelligence sharing platform for government & private sectors.
Considering development of intelligence sharing platform for government & private sectors.
Initiating users to security in cyber space.
Initiating users to security in cyber space.
Initiating users to secure use of internet, protection from cybercrimes, latest criminal
techniquesusers& safetyon smartphones.
Initiating
to secureuse of internet, protection from cybercrimes, latest criminal
techniquesusers& safetyon smartphones.
Initiating
to secureuse of internet, protection from cybercrimes, latest criminal
techniquesusers& safetyon smartphones.
Initiating
to secureuse of internet, protection from cybercrimes, latest criminal
techniqueseducators& safety&
onstaff
smartphones.
Initiatingof local public entities to elimination of cyber environment that isharmfulyouth. & staff of local public entities to elimination of cyber environment that is
Initiatingtoeducators
harmful toeducators
youth. & staff of local public entities to elimination of cyber environment that is
Initiating
harmful to youth.
Promotinguse of electronic signature.
Promoting use of electronic signature.
Promoting use of electronic signature.
Initiating youth to secure use of internet & smartphones.
Initiating youth to secure use of internet & smartphones.
Initiating youth to secure use of internet & smartphones.
Initiating youth to secure use of internet & smartphones.
Continuing moral education for information usage at school.
Continuing moral education for information usage at school.
Continuing promotion of moral education for internet usage.
Continuing promotion of moral education for internet usage.
Promoting "Information Leakage Prevention Tool" (tool to prevent data exfiltration throughfile sharing
softwares).
Arousing
securityawareness of youth.
Assisting local public entities to raise public awareness of security.
Assisting local public entities to raise public awareness of security.
Continuing "Safety Class" to raise public awareness of secure internet usage.
Continuing "Safety Class" to raise public awareness of secure internet usage.
Continuing "Safety Class" to raise public awareness of secure internet usage.
Continuing "Safety Class" to raise public awareness of secure internet usage.
Assisting local public entities to raise public awareness of security.
Assisting local public entities to raise public awareness of security.
Supporting SMEs (small-to medium-sized enterprises) to enhance security by training
security personnel
SMEs(small-to& counsellors
for SMEs.
Providingpublic &inSMEs
medium-sizedenterprises) with intelligence of security
incidents
countermeasures.
Providing&public& SMEs (small-to medium-sized enterprises) with intelligence of security
incidents & incident
countermeasures.
Supporting
response of public & SMEs (small-to medium-sized enterprises) through"Informationincident
Security
Consultation
Counter"& "APT
SpecialConsultation
Counter".throughSupporting
responseof public& SMEs(small-to
medium-sizedenterprises)"Informationanalysing
Security&
Consultation
Counter" & "APTSpecial Consultation Counter".
Collecting,reporting cybersecurity
information.
Urging universities to enhance information security.
Taking course of action to implement newly effected "Amended Act on the Protection of
Personal Information".
Strengthening
capability of investigation of cybercrime.
Strengthening capability of investigation of cybercrime.
Enhancing cooperation between public, private & academic sectors, with "JC3: Japan
Cybercrimecooperation
Control Center"(Japanese
Cyber-Forensics
Enhancing
betweenpublic,version
private of& NCFTA
academic(National
sectors, with
"JC3: Japan &Cybercrime Control
Center"(Japanese versionof NCFTAaccess,(National
Cyber-Forensics
Strengthening
capabilityof investigationof unauthorizedphishing& illegal &acquisition/retentionof third
party IDs. of unauthorized access, phishing & illegal
Strengthening
capabilityof investigationacquisition/retentionof third
party IDs. of unauthorized access, phishing & illegal
Strengthening
capabilityof investigationacquisition/retention
third
party IDs.of latest criminal techniques, etc.
Providingcorporates ofwithintelligence
Supporting establishment of anti-cybercrime voluntary corps.
Supporting establishment of anti-cybercrime voluntary corps.
Supporting establishment of anti-cybercrime voluntary corps.
Strengthening capability of investigation of crimes targeting smartphone users.
Strengthening capability of investigation of crimes targeting smartphone users.
Training investigators specialized in cybercrime.
Collecting & disseminating information about phishing through operation of "Council of
Anti-Phishing
Japan".
Collecting& disseminating
information about phishing through operation of "Council of
Anti-Phishing
Japan".
Makingthe mostof High-Tech Crime Technology Division to tackle complicated &diversified
cybercrimes.
Training
prosecutors
for cybercrimes.
Taking a course of action against cybercrimes upon effectuation of "Cyber Criminal Law".
Taking a course of action against cybercrimes upon effectuation of "Cyber Criminal Law".
Promoting "Guidelines Regarding the Protection of Personal Information in the
Telecommunications
EnhancingcapabilitiesBusiness".
to analyse IoTs.
Enhancing capabilities to analyse IoTs.
Considering & preparing for legislation of security countermeasures for CIIs.
Considering & preparing for legislation of security countermeasures for CIIs.
Monitoring & publishing improvement of security standards annually.
Monitoring & publishing improvement of security standards annually.
Monitoring & publishing improvement of security standards annually.
Improving security standards for CIIs including risk assessment, functionality assurance,
BCPs & internal audit.

Appendix J

ID
Category
221L2-1 Cyber Culture and Society
221L2-2 Cyber Culture and Society
541L2-4 Standards, Organisations, andTechnologies Policy and
132L2-1 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
153L2-2 Cybersecurity
Strategy
and Regulatory
431L3-3 Legal
Frameworks
Culture and Society
213L2-1 Cyber
221L2-1 Cyber Culture and Society
213L2-1 Cyber Culture and Society
221L2-1 Cyber Culture and Society
221L3-2 Cyber Culture and Society
231L2-1 Cyber Culture and Society
213L3-1 Cyber Culture and Society
221L3-1 Cyber Culture and Society
251L3-2 Cyber Culture and Society
221L2-2 Cyber Culture and Society
551L2-1 Standards, Organisations, andTechnologies
Organisations, and
551L2-2 Standards,
Technologies
Culture and Society
213L3-1 Cyber
221L3-1 Cyber Culture and Society
221L3-2 Cyber Culture and Society
251L3-2 Cyber Culture and Society
213L3-1 Cyber Culture and Society
221L3-1 Cyber Culture and Society
221L3-2 Cyber Culture and Society
251L3-2 Cyber Culture and Society
231L2-1 Cyber Culture and Society
213L3-1 Cyber Culture and Society
213L2-1 Cyber Culture and Society
221L2-1 Cyber Culture and Society
213L3-1 Cyber Culture and Society
221L3-1 Cyber Culture and Society
221L3-2 Cyber Culture and Society
231L2-1 Cyber Culture and Society
213L2-1 Cyber Culture and Society
221L2-1 Cyber Culture and Society
212L3-1 Cyber Culture and Society
123L3-3 Cybersecurity Policy andStandards, Organisations, and
541L2-1 Strategy
Technologies Policy and
123L3-1 Cybersecurity
Strategy
Culture and Society
241L2-2 Cyber
123L3-3 Cybersecurity Policy andStrategy
Culture and Society
212L3-1 Cyber
412L3-1 Legal and Regulatory
Frameworks
and Regulatory
421L3-2 Legal
Legal and Regulatory
421L3-3 Frameworks
Frameworks
and Regulatory
421L3-5 Legal
Frameworks
and Regulatory
431L3-3 Legal
Frameworks
and Regulatory
421L3-2 Legal
Frameworks
and Regulatory
431L2-3 Legal
Frameworks
and Regulatory
431L3-3 Legal
Frameworks
and Regulatory
431L3-3 Legal
Frameworks
Culture and Society
213L2-1 Cyber
221L2-1 Cyber Culture and Society
221L2-2 Cyber Culture and Society
421L3-2 Legal and Regulatory
Frameworks
and Regulatory
431L1-2 Legal
Frameworks
and Regulatory
421L4-1 Legal
Frameworks
Culture and Society
221L2-2 Cyber
431L3-3 Legal and Regulatory
Frameworks
and Regulatory
421L4-2 Legal
Frameworks
and Regulatory
422L4-3 Legal
Frameworks
and Regulatory
417L3-1 Legal
Frameworks
and Regulatory
418L3-2 Legal
Frameworks
and Regulatory
432L2-2 Legal
Frameworks
and Regulatory
421L3-2 Legal
Frameworks
and Regulatory
421L4-2 Legal
Frameworks Policy and
133L3-1 Cybersecurity
Strategy
and Regulatory
411L3-1 Legal
Frameworks Policy and
131L4-1 Cybersecurity
Cybersecurity Policy and
133L4-1 Strategy
Strategy Organisations, and
511L4-1 Standards,
Technologies Policy and
131L3-2 Cybersecurity
Strategy

Categorization / Classification
Subcategory
Capacity area
Level
Requirement (keyword)
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely of online trust established
Trustand Confidence on the User
Trust and Confidence on
Promotion
2
Internet Security Controls
the InternetSecurity Controls
Technical
Technical
Established ISPs' policies of technical security2
control
Critical Infrastructure (CI)
Organisation
Information
sharing established between CI &2
Protection
government
CriticalInfrastructure (CI)
Organisation
Formal& consistent information sharing
2
Protection
between CI &government
Cyber
Defence
Coordination
Intelligencesharing
between CI & defence2
Formal and Informal
Formal Cooperation
Resources for information exchange between
3
Cooperation Frameworks
public & private
Cybersecurity
Mind-set toUsers
Growing
numbersectors
of users have mind-set
2
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely number of users have mind-set
Cybersecurity
Mind-set
Users
Growing2
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely
Trust
and Confidence on the User
Trust and Confidence on
Users'
ability to control providing personal
3
Internet
the Internet
information
User
Understanding of
User
Understanding ofGrowing
number of users can secure personal
2
Personal Information
Personal Information
information
onlineCybersecurity
Mind-setUsers
Mostusers havemind-set3
Trust and Confidence on the User Trust and Confidence on
Most users can use internet securely
3
Internetand Social Mediathe Internet
Media
Media
and Social MediaFrequent discussion on social media security
3
Trust and Confidence on the User Trust and Confidence on
Promotion of online trust established2Internet
the Internet Controls
Cryptographic
Controls
Cryptographic
Cryptographic controls widely used2
Cryptographic Controls
Cryptographic Controls
Secure communication services
2
Cybersecurity Mind-set
Users
Most users have mind-set
3
Trust and Confidence on the User Trust and Confidence on
Most users can use internet securely
3
Internet
Trust and Confidence on the the
UserInternet
Trust and Confidence on
Users' ability to control providing personal
3
Internetand Social Mediathe Internet
information
Media
Media
and Social MediaFrequent
discussion on social media security
3
Cybersecurity Mind-set
Users
Most users have mind-set
3
Trust and Confidence on the User Trust and Confidence on
Most users can use internet securely
3
Internet
the Internet
Trust
and Confidence on the User
Trust and Confidence on
Users' ability to control providing personal
3
Internetand Social Mediathe Internet
information
Media
Media
and Social MediaFrequent
discussion on social media security
3
User Understanding ofUser Understanding ofGrowing number of users can secure personal
2
Personal Information
Personal Information
information
onlineCybersecurity
Mind-setUsers
Mostusers havemind-set3
Cybersecurity Mind-set
Users
Growing number of users have mind-set
2
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely
Cybersecurity
Mind-setUsers
Mostusers have mind-set
3
Trust and Confidence on the User Trust and Confidence on
Most users can use internet securely
3
Internet
the Internet
Trust
and Confidence on the User
Trust and Confidence on
Users' ability to control providing personal
3
Internet
the Internet
information
User
Understanding of
User
Understanding ofGrowing
number of users can secure personal
2
Personal Information
Personal Information
information
onlineof users have mind-set
Cybersecurity
Mind-set
Users
Growing
number2
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely spread in private sector
Cybersecurity
Mind-set
PrivateSectorMind-set3
Incident Response
Coordination
Information sharing across sectors
3
Technical Security Controls
Technical Security Controls
Latest technical controls & patch2
managements/ sectorial
widely implemented
Incident Response
Coordination
Subnational
incident response3
organisations
Reporting Mechanisms
Reporting Mechanisms
Promotionof incident reporting channels
2
Incident Response
Coordination
Information sharing across sectors
3
Cybersecurity Mind-set
Private Sector
Mind-set spread in private sector
3
Legal Framework
Privacy, Freedom of Speech &Cybersecurity legal framework aligned with
3
OtherEnforcement
Human Rights Online
international
best practices
Criminal Justice System
Law
Advanced
investigative
capabilities for3cybercrimes
Criminal Justice System
Law Enforcement
Regular training for law enforcement officers
3
Criminal Justice System
Law Enforcement
Statistics & analysis of cybercrime3
investigations
Formal and Informal
Formal Cooperation
Resources
for information exchange between
3
Cooperation
Frameworks
public & private
sectorscapabilities for
Criminal
Justice
System to
Law Enforcement
Advanced
investigative3
cybercrimesrequirements on information
Formal and Informal
Formal Cooperation
Legislative2
Cooperation
Frameworks to
exchange between
public &exchange
private sectors
Formaland Informal
Formal Cooperation
Resources
for information
between3
Cooperation
Frameworks topublic & private
sectors exchange between
Formaland Informal
Formal Cooperation
Resources
for information
3
Cooperation Frameworks
public & private
Cybersecurity
Mind-set toUsers
Growing
numbersectors
of users have mind-set
2
Trust and Confidence on the User Trust and Confidence on
Growing number of users can use internet
2
Internet
the Internet
securely of online trust established
Trustand Confidence on the User
Trust and Confidence on
Promotion
2
Internet Justice System
the Internet
Criminal
Law
Enforcement
Advanced investigative capabilities for3cybercrimes
Formal and Informal
Formal Cooperation
Exchangeof information between public &1
Cooperation
Frameworks
private sectors
cybercrimes
Criminal
Justice
System to
Law Enforcement
Specialised
andabout
continuous
training for law
4
enforcement
Trust and Confidence on the User Trust and Confidence on
Promotion
ofofficers
online trust established2Internetand Informal
the Internet
FormalFormalCooperation
Resources for information exchange between
3
Cooperation
Frameworks
public & private
sectors
Criminal
Justice
System to
Law Enforcement
Sophisticateddigitalforensic tools
4
Criminal Justice System
Prosecution
Specialised and continuous training for
4
prosecutorsminimum requirement inLegal Framework
Substantive Cybercrime
Exceeding
3
Legislation Cybercrimeinternational
agreements
on cybercrime
Legal Framework
Procedural
Exceedingminimum
requirementin
3
Legislationinternationalinformal
agreements
on cybercrime
Formal and Informal
InformalCooperation
Establishedcooperation
between2
Cooperation
Frameworks
ISPs & lawinvestigative
enforcementcapabilities for
Criminal
Justice
System to
Law Enforcement
Advanced3
cybercrimes digital forensic tools
Criminal Justice System
Law Enforcement
Sophisticated4
Critical Infrastructure (CI)
Risk Management andCybersecurity oriented risk management in CI
3
Protection
Response Framework for
Legal
Framework
Legislative
Regular review of cybersecurity legal
3
ICT Security
framework
Critical Infrastructure (CI)Identification
Regularreview of CI risk priorities
4
Protection
Critical Infrastructure (CI)
Risk Management andRegular audit of CI
4
Protection to Standards
Response
Adherence
ICT
Security Standards
Regular review of adoption of standards &4
best practices & asset management of CI
Critical Infrastructure (CI)Identification
Vulnerability
3
Protection
assets283

Appendix J
Ref.
0222
0223
0224
0225
0226
0227
0228
0229
0230
0231
0232
0233
0234
0235
0236
0237
0238
0239
0240
0241
0242
0243
0244
0245
0246
0247
0248
0249
0250
0251
0252
0253
0254
0255
0256
0257
0258
0259
0260
0261
0262
0263
0264
0265
0266
0267
0268
0269
0270
0271
0272
0273
0274
0275
0276
0277
0278
0279
0280
0281
0282
0283
0284
0285
0286
0287
0288
0289
0290
0291
0292
0293
0294
0295

284

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-220c7-220c7-220c7-220c2
7-220d7-220e7-220f7-220f7-220f7-220f7-220f2
7-220f2
7-220f3
7-220f3
7-220f47-220f47-220g7-220g7-221a7-221a7-222a7-222a7-222a7-222b
7-222c7-222c7-222e7-222f7-222f2
7-222f3
7-222f4
7-222g7-222g7-223a7-223a7-223b7-223b2
7-223c7-223c7-223d7-223d2
7-223e7-223e7-223e27-223e27-223e37-223e37-223e47-223f
7-223g7-223g7-223g7-223h7-223h7-223i7-223i7-223i7-230a7-230a7-230a7-231a7-231b7-231b7-231b7-231c7-231c7-231c7-231c2
7-231d7-231d2
7-231d2
7-231e7-231e7-231fSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Improving security standards for CIIs including risk assessment, functionality assurance,
BCPs & internal
audit.
Improvingsecurity
standards for CIIs including risk assessment, functionality assurance,
BCPs & internal
audit.
Improvingsecurity
standards for CIIs including risk assessment, functionality assurance,
BCPs & internal
audit.
Researchingfor developmentof information sharing platform for CIIs.
Improving countermeasures against interference in critical wireless communication.
Improving stability of telecommunication by analysing incidents in telecommunication.
Improving incident response ability of CII operators by performing cross-sectional exercises.
Improving incident response ability of CII operators by performing cross-sectional exercises.
Improving incident response ability of CII operators by performing cross-sectional exercises.
Improving incident response ability of CII operators by performing cross-sectional exercises.
Performing practical cyber defence exercise "CYDER" for CIIs at "National Cyber Training
Center". practical cyber defence exercise "CYDER" for CIIs at "National Cyber Training
Performing
Center". practical cyber defence exercises with CII operators.
Performing
Performing practical cyber defence exercises with CII operators.
Performing cyber defence exercises in financial services sector.
Performing cyber defence exercises in financial services sector.
Establishing "ICSCoE: Industrial Cyber Security Center of Excellence".
Establishing "ICSCoE: Industrial Cyber Security Center of Excellence".
Extending action plans based on "The Basic Policy of Critical Information Infrastructure
Protection action(4th Edition)"to SMEs(small-to
enterprises).
Extendingplans basedon "TheBasic medium-sized
Policy of Critical
Information Infrastructure
Protection (4thEdition)"to SMEs(small-tofor
medium-sizedenterprises).
Enhancing
information
sharingmechanism
CIIs specifically;
Considering
introductionof severity
gradesfor
forCIIs
servicefailure.
Enhancing information
sharingmechanismspecifically;
Consideringinformation
introductionof severity
gradesfor
forCIIs
servicefailure.
Enhancingsharingmechanismspecifically;
Consideringparticipants
introduction
severity shared
grades information
for service failure.
Increasing& ofenhancingof "J-CSIP: Cyber Intelligence
Sharing Initiative".
Assisting
CII operators to respond cyber attacks from abroad.
Assisting CII operators to respond cyber attacks from abroad.
Enhancing analysis of targeted attacks by using proving environment simulating large scaleLAN.
Enhancing
information gathering & analysis on cyber attacks & malwares.
Enhancing information gathering on cyber attacks.
Enhancing information sharing & cooperation with CII operators.
Enhancing information sharing with CII operators through "Cyber Terrorism Council".
Enhancing security countermeasures of credit card settlement system.
Enhancing security countermeasures of credit card settlement system.
Supporting local public entities for their cybersecurity.
Supporting local public entities for their cybersecurity.
Supporting local public entities to educate & train their personnel for security by holding
seminars & local
e-learning.
Supporting
public entities to revise security policies.
Providing local public entities with intelligence of security incidents & countermeasuresthrough "LGWAN:
Local
Government
Wide Area
Network".
Providing
local public
entitieswith intelligenceof security
incidents & countermeasuresthrough"LGWAN:
Local
Government
WideofArea
Network".scanning & malware detection.
Providing
local public
entitieswith services
vulnerability
Providing local public entities with tools for incident response exercises.
Establishing integrated cybersecurity network monitoring for government & local public
entities.
Establishingintegrated cybersecurity network monitoring for government & local public
entities.
Supporting
local public entities to enhance cybersecurity of their ICTs & to establish cloud
network with
FY2017
Supporting
local
publicbudget.
entities to enhance cybersecurity of their ICTs & to establish cloud
networklocal
withpublic
FY2017budget.
Urgingentities
to isolate "My Number" (Japanese version of Social Security
Number)relatedsystems/networks
fromUrging local
publicentities to isolate"Myinternet.
Number" (Japanese version of Social Security
Number)relatedsystems/networks
frominternet.
Urginglocal
publicentities to comply
with"Guidelines for Proper Handling of Specific
Personal Information".
Promotingcollaboration of public & private sectors on authentication using "My Number
Portal".
Incorporating
vulnerability information for control systems into existing operation ofreporting & disseminationfor vulnerability
information.
Incorporating
vulnerabilitysystem
information
for control systems
into existing operation ofreporting & disseminationfor vulnerability
information.
Incorporating
vulnerabilitysystem
information
for control systems
into existing operation ofreporting & practicaldissemination
systemvulnerability
information.
Performing
exercises
for forcontrolsystems of
CIIs.
Performing practical exercises for control systems of CIIs.
Promoting security assessment & certification for control systems.
Promoting security assessment & certification for control systems.
Promoting security assessment & certification for control systems.
Preparing for next revision of "Common Standards Group for Information Security Measuresfor Government
Agencies
Related Agencies".
Preparingfor next
revisionandof "CommonStandards Group for Information Security Measuresfor Government
Agencies
Related Agencies".
Preparingfor next
revisionandof "CommonStandards Group for Information Security Measuresfor Government
AgenciesICT
andnetworks
Related Agencies".
Monitoring& analysingof government agencies @24/7.
Strengthening incident response capabilities of government agencies by enhancing
cooperation betweenof public
organisations.
Strengthening
incidentCSIRT
response
capabilitiesof government agencies by enhancing
cooperation betweenof public
organisations.
Strengthening
incidentCSIRT
response
capabilitiesof government agencies by enhancing
cooperation
betweenagencies
CSIRT ofpublic'security
organisations.
Urginggovernment
to adopt
by design' in procurement.
Urging government agencies to adopt 'security by design' in procurement.
Urging government agencies to adopt 'security by design' in procurement.
Urging government agencies to consider security upon utilisation of cloud network.
Reviewing "List of Requirements for Ensuring Security in Procurement of IT Products".
Disseminating information including PP (protection profiles) to procurement professionals ofgovernment agencies.
Disseminating
information including PP (protection profiles) to procurement professionals ofgovernment
Reviewing &agencies.
promoting "JISEC: Japan Information Technology Security and Certification
Scheme". & promoting "JISEC: Japan Information Technology Security and Certification
Reviewing
Scheme". "JCMVP: Japan Cryptographic Module Validation Program".
PromotingAppendix J

ID
Category
131L4-1 Cybersecurity Policy andStrategy
Policy and
132L4-1 Cybersecurity
Strategy
Policy and
133L4-1 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
133L2-2 Cybersecurity
Strategy
Policy and
133L2-2 Cybersecurity
Strategy
Policy and
133L2-3 Cybersecurity
Strategy
Policy and
141L2-1 Cybersecurity
Strategy
Policy and
141L2-2 Cybersecurity
Strategy
Policy and
141L2-3 Cybersecurity
Strategy
Policy and
133L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
133L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Cybersecurity Policy and
133L3-1 Strategy
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
133L3-1 Cybersecurity
Strategy
Education,
322L3-4 Cybersecurity
Training and Skills
Policy and
132L3-3 Cybersecurity
Strategy Organisations, and
511L2-6 Standards,
Technologies Policy and
132L2-1 Cybersecurity
Cybersecurity Policy and
133L3-2 Strategy
Strategy
Policy and
161L3-1 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
132L2-2 Cybersecurity
Strategy
Policy and
132L2-4 Cybersecurity
Strategy
Policy and
121L3-2 Cybersecurity
Strategy
and Regulatory
431L3-3 Legal
Frameworks
and Regulatory
431L3-3 Legal
Frameworks Policy and
132L2-1 Cybersecurity
Strategy
Policy and
132L2-1 Cybersecurity
Strategy
Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
541L3-2 Standards,
Technologies
Culture and Society
211L3-1 Cyber
211L3-2 Cyber Culture and Society
211L3-1 Cyber Culture and Society
211L3-2 Cyber Culture and Society
123L3-1 Cybersecurity Policy andStrategy
Policy and
123L3-3 Cybersecurity
Standards, Organisations, and
541L2-1 Strategy
Technologies Policy and
141L2-1 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Strategy Organisations, and
541L2-1 Standards,
Technologies Policy and
123L3-1 Cybersecurity
Strategy Organisations, and
541L2-1 Standards,
Technologies
Culture and Society
222L3-2 Cyber
541L2-1 Standards, Organisations, andTechnologies
Culture and Society
222L3-2 Cyber
222L3-2 Cyber Culture and Society
133L3-1 Cybersecurity Policy andStrategy Organisations, and571L2-1 Standards,
Technologies
Organisations, and571L2-2 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
511L2-5 Standards,
Technologies Policy and
111L4-1 Cybersecurity
Strategy
Policy and
113L4-1 Cybersecurity
Strategy Organisations, and
511L4-1 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Technologies Policy and
122L3-2 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
123L3-3 Cybersecurity
Strategy Organisations, and
511L2-4 Standards,
Technologies
Organisations, and
512L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
512L3-2 Standards,
Technologies
Organisations, and
512L3-1 Standards,
Technologies
Organisations, and
512L3-2 Standards,
Standards, Organisations, and
512L3-1 Technologies
Technologies
Organisations, and
512L3-2 Standards,
Technologies
Organisations, and
512L3-1 Standards,
Technologies

Categorization / Classification
Subcategory
Capacity area
Critical Infrastructure (CI)Identification
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Risk Management andProtection
Response
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Risk Management andProtection
Response
CriticalInfrastructure (CI)
RiskManagement andProtection
Response
CriticalInfrastructure (CI)
RiskManagement andProtection
Response
CrisisManagement
CrisisManagement
Crisis Management
Crisis Management
Crisis Management
Crisis Management
Critical Infrastructure (CI)
Risk Management andProtection
Response
CrisisManagement
CrisisManagement
Critical Infrastructure (CI)
Risk Management andProtection
Response
CrisisManagement
CrisisManagement
Critical Infrastructure (CI)
Risk Management andProtection
Response
CrisisManagement
CrisisManagement
Critical Infrastructure (CI)
Risk Management andProtection for Education
Response
Framework
Administration
Critical Infrastructure (CI)
Organisation
Protection to Standards
Adherence
ICT Security Standards
Critical Infrastructure (CI)
Organisation
Protection
Critical Infrastructure (CI)
Risk Management andProtection
Response
Communications
Redundancy Communications
Redundancy
Critical Infrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
Incident
Response
Identification of Incidents
Formal and Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Formal Cooperation
Cooperation
Frameworks
CriticalInfrastructure(CI)toOrganisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Risk Management andProtection Security Controls
Response Security Controls
Technical
Technical
Cybersecurity Mind-set
Government
Cybersecurity Mind-set
Government
Cybersecurity Mind-set
Government
Cybersecurity Mind-set
Government
Incident Response
Coordination
Incident Response
Coordination
Technical Security Controls
Technical Security Controls
Crisis Management
Crisis Management
Incident Response
Coordination
Technical Security Controls
Technical Security Controls
Incident Response
Coordination
Technical Security Controls
Technical Security Controls
Trust and Confidence on the User Trust in E-government
Internet
ServicesTechnical Security Controls
Technical Security Controls
Trust and Confidence on the User Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
Internet Infrastructure (CI)
Services
CriticalRiskManagement andProtection Disclosure
Response Disclosure
Responsible
Responsible
Responsible Disclosure
Responsible Disclosure
Critical Infrastructure (CI)
Risk Management andProtection
Response
CrisisManagement
CrisisManagement
Critical Infrastructure (CI)
Risk Management andProtection to Standards
Response
Adherence
ICT
Security Standards
Adherence to Standards
ICT Security Standards
National Cybersecurity
Strategy Development
Strategy Cybersecurity
National
Content
Strategy to Standards
Adherence
ICT Security Standards
Technical Security Controls
Technical Security Controls
Incident Response
Organisation
Incident Response
Coordination
Incident Response
Coordination
Adherence to Standards
ICT Security Standards
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Software
Development
Adherence to Standards
Standards
in Software
Development
Adherence to Standards
Standards
in Procurement
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Procurement

Level
4
4
4
2
2
2
2
2
2
2
3
3
3
3
3
3
3
3
3
2
2
3
3
2
2
2
3
3
3
2
2
3
3
3
3
3
3
3
3
2
2
3
2
3
2
3
2
3
3
3
2
2
3
3
3
2
2
4
4
4
2
3
3
3
2
1
3
3
3
3
3
3
3
3

Requirement (keyword)
Regular review of CI risk priorities
Ability to adjust of CI protection
Regular audit of CI
Formal & consistent information sharing
between
CI & government
Risk
management
processes in CI
Risk management processes in CI
National CI incident response plan
National incident exercise done
Appropriate resources for national incident
exerciseRoles
in national incident exercise defined
Cybersecurity oriented risk management in CI
High-level scenario of national incident
exercise
Cybersecurity
oriented risk management in CI
High-level scenario of national incident
exercise
Cybersecurity oriented risk management in CI
High-level scenario of national incident
exercise
Cybersecurity
oriented risk management in CI
CoE in cybersecurity
Supply chain management of CI
Standards & best practices used by CI supply
chainsInformation
sharing established between CI &government
Regular review of impact analysis of CI
Redundant communications for key
stakeholders
Formal& consistent information sharing
between&CIconsistent& government
Formalinformation sharing
between CI &engagement
governmentin CI protection
Government
Incident analysis
Resources for information exchange between
public & private
sectors exchange between
Resources
for information
public & private
sectors
Information
sharingestablished between CI &government sharing established between CI &Information
government oriented risk management in CI
Cybersecurity
Regular review of technical security controls
Mind-set spread in public sector
Mind-set based strategy in public sector
Mind-set spread in public sector
Mind-set based strategy in public sector
Subnational / sectorial incident responseorganisationssharing across sectors
Information
Latest technical controls & patch
managements
widelyimplemented
National
incident
exercisedone
Subnational / sectorial incident responseorganisations
Latesttechnical controls & patch
managements/ sectorial
widely implemented
Subnational
incident responseorganisations
Latesttechnical controls & patch
managements widely
Privacy-by-default
in implemented
e-gov
Latest technical controls & patch
managements widely
Privacy-by-default
in implemented
e-gov
Privacy-by-default in e-gov
Cybersecurity oriented risk management in CI
Established vulnerability disclosure
framework processes against vulnerability
Establishedinformation oriented risk management in CI
Cybersecurity
High-level scenario of national incident
exercise
Cybersecurity
oriented risk management in CI
Promotion of use of standards & bestpracticesof compliance of standards & best
Metrics
practices revision of strategy
ContinualContinual revision of strategy
Regular review of adoption of standards &best practices
Latesttechnical controls & patch
managements
widelyfor
implemented
Adequateresources
incident response
Subnational / sectorial incident responseorganisationssharing across sectors
Information
Promotion of use of standards & bestpractices of use of standards & best
Promotionpracticesconsideration
for procurement
Securityin all stages
Security consideration in all stages
Regular review of procurement
Standards & best practices for procurement
widely used
& complied
Regularreviewof procurement
Standards & best practices for procurement
widely used
& complied
Regularreviewof procurement
Standards & best practices for procurement
widely used & complied

285

Appendix J
Ref.
0296
0297
0298
0299
0300
0301
0302
0303
0304
0305
0306
0307
0308
0309
0310
0311
0312
0313
0314
0315
0316
0317
0318
0319
0320
0321
0322
0323
0324
0325
0326
0327
0328
0329
0330
0331
0332
0333
0334
0335
0336
0337
0338
0339
0340
0341
0342
0343
0344
0345
0346
0347
0348
0349
0350
0351
0352
0353
0354
0355
0356
0357
0358
0359
0360
0361
0362
0363
0364
0365
0366
0367
0368
0369

286

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-231f7-231f7-231g7-231g7-231h7-231h7-231i7-231j7-231j7-231k7-231k7-231k7-231l7-231l7-231l7-231l2
7-231l2
7-231l2
7-231l3
7-231l47-231l47-231m7-231m2
7-231m2
7-231n7-231n7-231o7-231o7-231o7-231p7-231p7-232a7-232a7-232a7-232b7-232b7-232b7-232c7-232d7-232d7-232d7-232e7-232e7-232e7-233a7-233a7-233b7-233b7-233b7-234a7-234a7-234a7-310a7-310b
7-311a7-311a7-311c7-311c7-311c2
7-311c2
7-311c3
7-311d7-311e7-311e27-311f
7-311f
7-311g7-311g7-311h7-311i
7-311i
7-312a7-312a7-312bSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Promoting "JCMVP: Japan Cryptographic Module Validation Program".
Promoting "JCMVP: Japan Cryptographic Module Validation Program".
Performing penetration testing to ICT systems of government agencies.
Performing penetration testing to ICT systems of government agencies.
Performing vulnerability scanning & examining cybersecurity measures of government
agencies. vulnerability scanning & examining cybersecurity measures of government
Performing
agencies. up detecting & informing incidents to government agencies by enhancing GSOC
Speeding
censors/systems.
Reviewing
policies for obtaining & storing ICT systems logs to enhance incident response
capabilities.policies for obtaining & storing ICT systems logs to enhance incident response
Reviewing
capabilities.CSIRT of government agencies & urging them to enhance incident response
Examiningcapabilities.CSIRT of government agencies & urging them to enhance incident response
Examiningcapabilities.CSIRT of government agencies & urging them to enhance incident response
Examiningcapabilities.cybersecurity exercises for incident response personnel of government agencies.
Performing
Performing cybersecurity exercises for incident response personnel of government agencies.
Performing cybersecurity exercises for incident response personnel of government agencies.
Performing cybersecurity exercises for CYMAT members.
Performing cybersecurity exercises for CYMAT members.
Performing cybersecurity exercises for CYMAT members.
Performing practical cyber defence exercise "CYDER" for government agencies with"National Cyber
Training Center".
Performing"NATIONAL
318 (CYBER) EKIDEN" (CTF for government agencies).
Performing "NATIONAL 318 (CYBER) EKIDEN" (CTF for government agencies).
Sharing cybersecurity intelligence with national universities.
Supporting national universities to enhance cybersecurity by training security personnel.
Supporting national universities to enhance cybersecurity by training security personnel.
Considering to enhance "NATIONAL 318 (CYBER) EKIDEN" (CTF for government
agencies). to enhance "NATIONAL 318 (CYBER) EKIDEN" (CTF for government
Considering
agencies).digital forensics professionals.
Training
Training digital forensics professionals.
Training digital forensics professionals.
Promoting "Guidelines for Risk Assessment of Advanced Cyber Attacks Measurements".
Promoting "Guidelines for Risk Assessment of Advanced Cyber Attacks Measurements".
Performing audit of all government agencies & related agencies during 2 years based on"Common Standards
for Information
Government
Agencies
Performing
audit of allGroup
government
agencies Security& relatedMeasuresagenciesfor
during
2 years basedon"Common Standards
for Information
Government
Agencies
Performing
audit of allGroup
government
agencies Security& relatedMeasuresagenciesfor
during
2 years basedon"Commoncybersecurity
Standards Groupfor Information
Security
for Government
Agencies
Training
personnel& experts basedon Measures"General Policy
for Cybersecurity
Human Resources
Development".
Training
cybersecurity
personnel & experts based on "General Policy for Cybersecurity
Human Resources
Development".
Training
cybersecurity
personnel & experts based on "General Policy for Cybersecurity
Human Resources
Development".
Continuing
information
sharing in cybersecurity community across government.
Supporting government agencies to develop cybersecurity human resources by training nonsecurity
personnel& providing
educational
materials.human resources by training nonSupporting
government
agencieswith
to develop
cybersecurity
security personnel& providing
educational
materials.human resources by training nonSupporting
government
agencieswith
to develop
cybersecurity
security personnel& providing
with educational
Reviewing& reconstructing
education& trainingmaterials.
systems for IT human resources.
Reviewing & reconstructing education & training systems for IT human resources.
Reviewing & reconstructing education & training systems for IT human resources.
Researching & developing security measures for cloud services, standardising if necessary.
Researching & developing security measures for cloud services, standardising if necessary.
Promoting 'security-by-design' in obtainment of new ICT systems for administrative
operation. 'security-by-design' in obtainment of new ICT systems for administrative
Promotingoperation. 'security-by-design' in obtainment of new ICT systems for administrative
Promotingoperation. audit of related agencies (besides government agencies) on cybersecurity.
Performing
Performing audit of related agencies (besides government agencies) on cybersecurity.
Performing audit of related agencies (besides government agencies) on cybersecurity.
Performing initial response exercises in preparation for potential large-scale cyber attack.
Enhancing resources for collection & analysis of cyber attack intelligence from homeland &abroad. counter-intelligence capabilities.
Enhancing
Enhancing counter-intelligence capabilities.
Enhancing capability of Cyber Force Center by performing exercises & upgrading
monitoring capability
equipment.of Cyber Force Center by performing exercises & upgrading
Enhancingmonitoring equipment.
Performing
cybersecurity exercises for large-scale industrial control systems.
Performing cybersecurity exercises for large-scale industrial control systems.
Enhancing analytic capabilities of malwares.
Considering education & training of highly professional human resources.
Enhancing protection & analysis equipment & cyber intelligence collection equipment.
Enhancing security of "DII: Defense Information Infrastructure".
Performing practical exercises on environment simulating defence information systems.
Performing practical exercises on environment simulating defence information systems.
Training CSIRT members for response against highly advanced attacks.
Training CSIRT members for response against highly advanced attacks.
Preparing for penetration testing of defence information network.
Researching contingency operation of defence information infrastructures.
Researching contingency operation of defence information infrastructures.
Implementing cybersecurity measures of supply chains of defence equipment.
Implementing cybersecurity measures of supply chains of defence equipment.
Backing-up National Research and Development Agencies with leading technologies
especially in information security area.

Appendix J

ID
Category
512L3-2 Standards, Organisations, andTechnologies
Organisations, and551L3-2 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Technologies
Organisations, and
541L3-1 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Technologies
Organisations, and
541L3-1 Standards,
Technologies Policy and
124L3-2 Cybersecurity
Strategy
Policy and
124L3-2 Cybersecurity
Strategy
Policy and
124L3-4 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
124L2-2 Cybersecurity
Strategy
Policy and
124L3-3 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
124L2-2 Cybersecurity
Cybersecurity Policy and
124L3-3 Strategy
Strategy
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
124L2-2 Cybersecurity
Strategy
Policy and
124L3-3 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
124L3-1 Cybersecurity
Strategy
Education,
331L3-2 Cybersecurity
SkillsLegal andand
Regulatory
431L1-2 Training
Frameworks Education,
311L3-1 Cybersecurity
Training and Skills
Education,
331L2-4 Cybersecurity
Training and Skills
Policy and
124L3-1 Cybersecurity
Strategy
Education,
331L3-2 Cybersecurity
Training and Skills
Policy and
124L3-2 Cybersecurity
Strategy
Policy and
124L3-4 Cybersecurity
Strategy
Education,
331L3-2 Cybersecurity
Training andSkillsOrganisations,and
511L2-4 Standards,
Technologies
Organisations, and
541L3-2 Standards,
Technologies Policy and
123L3-1 Cybersecurity
Strategy Organisations, and
511L2-5 Standards,
Technologies
Organisations, and
541L3-2 Standards,
Technologies Policy and
123L3-1 Cybersecurity
Strategy
Policy and
124L2-2 Cybersecurity
Strategy
Education,
331L3-2 Cybersecurity
Training and Skills
Policy and
123L3-1 Cybersecurity
Strategy
Policy and
123L3-1 Cybersecurity
Cyber Culture and Society
211L2-1 Strategy
331L2-4 Cybersecurity Education,
Training and Skills
Policy and
124L4-2 Cybersecurity
Strategy
Education,
331L3-4 Cybersecurity
Training and Skills
Education,
332L3-1 Cybersecurity
Training andSkillsOrganisations,and
511L2-1 Standards,
Technologies
Organisations, and
541L2-1 Standards,
Standards, Organisations, and
512L1-2 Technologies
Technologies
Organisations, and
513L1-2 Standards,
Technologies
Organisations, and
513L3-1 Standards,
Technologies
Organisations, and
511L2-5 Standards,
Technologies
Organisations, and
541L1-2 Standards,
Technologies
Organisations, and
541L3-2 Standards,
Technologies Policy and
141L2-1 Cybersecurity
Strategy
Policy and
153L3-1 Cybersecurity
Strategy
Policy and
152L3-2 Cybersecurity
Strategy
Policy and
152L4-2 Cybersecurity
Strategy
Policy and
124L3-2 Cybersecurity
Strategy
and Regulatory
421L3-2 Legal
Frameworks Policy and
133L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
and Regulatory
421L3-2 Legal
Frameworks Education,
331L3-2 Cybersecurity
Training and Skills
Policy and
153L3-1 Cybersecurity
Strategy
Policy and
161L3-1 Cybersecurity
Strategy
Policy and
141L3-1 Cybersecurity
Strategy
Policy and
161L3-1 Cybersecurity
Strategy
Policy and
124L3-1 Cybersecurity
Strategy
Education,
331L3-2 Cybersecurity
Training and Skills
Policy and
161L3-1 Cybersecurity
Strategy
Policy and
161L3-1 Cybersecurity
Strategy
Policy and
161L4-1 Cybersecurity
Cybersecurity Policy and
132L3-3 Strategy
Strategy Organisations, and
511L2-6 Standards,
Technologies Education,
321L2-5 Cybersecurity
Training and Skills

Categorization / Classification
Subcategory
Capacity area
Adherence to Standards
Standards in Procurement
Cryptographic Controls
Cryptographic Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Crisis Management
Crisis Management
Incident Response
Mode of Operation
Framework for Professional
Provision
Training
Formal and Informal
Formal Cooperation
CooperationRaising
Frameworks to
Awareness
Awareness Raising
Programmes
Framework for Professional
Provision
Training Response
Incident
Mode of Operation
Framework for Professional
Provision
Training Response
Incident
Mode of Operation
Incident Response
Mode of Operation
Framework for Professional
Provision
Training to Standards
Adherence
ICT Security Standards
Technical Security Controls
Technical Security Controls
Incident Response
Coordination
Adherence to Standards
ICT Security Standards
Technical Security Controls
Technical Security Controls
Incident Response
Coordination
Incident Response
Mode of Operation
Framework for Professional
Provision
Training Response
Incident
Coordination
Incident Response
Coordination
Cybersecurity Mind-set
Government
Framework for Professional
Provision
Training Response
Incident
Mode of Operation
Framework for Professional
Provision
Training for Professional
Framework
UptakeTraining to Standards
Adherence
ICT Security Standards
Technical Security Controls
Technical Security Controls
Adherence to Standards
Standards in Procurement
Adherence to Standards
Standards in Software
Development
Adherence to Standards
Standards
in Software
Development
Adherence to Standards
ICT
Security Standards
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Crisis Management
Crisis Management
Cyber Defence
Coordination
Cyber Defence
Organisation
Cyber Defence
Organisation
Incident Response
Mode of Operation
Criminal Justice System
Law Enforcement
Critical Infrastructure (CI)
Risk Management andProtection
Response
CrisisManagement
CrisisManagement
Criminal Justice System
Law Enforcement
Framework for Professional
Provision
Training
Cyber
Defence
Coordination
Communications Redundancy Communications Redundancy
Crisis Management
Crisis Management
Communications Redundancy Communications Redundancy
Incident Response
Mode of Operation
Framework for Professional
Provision
Training
Communications
Redundancy Communications RedundancyCommunications Redundancy Communications RedundancyCommunications Redundancy Communications Redundancy
Critical Infrastructure (CI)
Organisation
Protection to Standards
Adherence
ICT Security Standards
Framework for Education
Provision

Level
3
3
2
3
2
3
3
3
3
3
2
3
3
2
3
3
2
3
3
3
3
1
3
2
3
3
3
3
3
2
3
3
2
3
3
2
3
3
3
2
2
4
3
3
2
2
1
1
3
2
1
3
2
3
3
4
3
3
3
3
3
3
3
3
3
3
3
3
3
3
4
3
2
2

Requirement (keyword)
Regular review of procurement
Regular review of cryptographic control
policiestechnical controls & patch
Latestmanagements
widelyimplemented
Userside security
controls
Latest technical controls & patch
managements
widelyimplemented
Userside security
controls
Sophisticated incident analysis
Sophisticated incident analysis
Forensics
Subnational / sectorial incident responseorganisations
Regulartraining for CSIRT members
Regular review of incident response processes
Subnational / sectorial incident responseorganisations
Regulartraining for CSIRT members
Regular review of incident response processes
Subnational / sectorial incident responseorganisations
Regulartraining for CSIRT members
Regular review of incident response processes
High-level scenario of national incident
exercise & accreditation for CSIRT members
Training
established training aligned with national
Cybersecurity
strategy
Exchange of information between public &private specificsectors aboutcybercrimes
Sectorprogrammesof awarenessraising
Cybersecurity
training programmes for nonprofessionals
Training& accreditation for CSIRT members
established training aligned with national
Cybersecurity
strategy
Sophisticatedincident analysis
Forensics
Cybersecurity training aligned with national
strategy of use of standards & best
Promotionpracticesreview of technical security controls
RegularSubnational / sectorial incident responseorganisations
Metricsof compliance of standards & bestpracticesreview of technical security controls
RegularSubnational / sectorial incident responseorganisations
Regulartraining for CSIRT members
Cybersecurity training aligned with national
strategy
Subnational/ sectorial incident responseorganisations/ sectorial incident response
Subnationalorganisations
Most officials have mind-set
Cybersecurity training programmes for nonprofessionals
Evaluating
effectiveness of CSIRT members
training of effectiveness of cybersecurity
Metrics
training of cybersecurity training programmes
Review
Established standards & best practices
Latest technical controls & patch
managements
widelyimplemented
Promotion of useof standards& bestpractices for
Promotion
ofprocurement
use of standards & bestpracticesconsideration
for development
Securityin all stages
Metrics of compliance of standards & bestpractices
Latesttechnical security controls promoted
Regular review of technical security controls
National incident exercise done
Analytical capability in cyber defence
Counter-cyber intelligence activities
Established counter-cyber intelligencecapability
Sophisticatedincident analysis
Advanced investigative capabilities forcybercrimes oriented risk management in CI
Cybersecurity
High-level scenario of national incident
exercise investigative capabilities for
Advancedcybercrimes training aligned with national
Cybersecurity
strategy capability in cyber defence
Analytical
Redundant communications for key
stakeholders
High-level
scenario of national incident
exercise communications for key
Redundant
stakeholders
Training& accreditation for CSIRT members
established training aligned with national
Cybersecurity
strategy communications for key
Redundant
stakeholderscommunications for key
Redundant
stakeholders
Optimisedfor extended outages
Supply chain management of CI
Standards & best practices used by CI supply
chains & development in cybersecurity
Researchpromoted

287

Appendix J
Ref.
0370
0371
0372
0373
0374
0375
0376
0377
0378
0379
0380
0381
0382
0383
0384
0385
0386
0387
0388
0389
0390
0391
0392
0393
0394
0395
0396
0397
0398
0399
0400
0401
0402
0403
0404
0405
0406
0407
0408
0409
0410
0411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443

288

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-312b7-312b2
7-312b2
7-312b2
7-313a7-313a7-320a7-320a7-320a7-320a7-321a7-321a7-321a7-321a7-321a7-321b7-321b7-321b7-321c7-321c7-321c2
7-321c2
7-321c3
7-321c3
7-321d7-321d7-321d
7-322a7-322a7-322a7-322a2
7-322b
7-322b
7-322b
7-322b
7-322c7-322c7-322c7-323a7-323a7-323a7-323b
7-324a7-324a7-324a2
7-324a2
7-324a2
7-324a3
7-324a4
7-324a4
7-324a57-324a57-324a6
7-324a6
7-324a77-324a77-325a7-325a7-325a7-330b7-330b7-330b7-330c7-330c7-330c7-330d7-330e7-330f
7-330f
7-330f
7-330g7-330h7-330j7-330jSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Backing-up National Research and Development Agencies with leading technologies
especially inuniversities
informationwith
securityarea.
Supporting
leadingtechnologies to enhance countermeasures against
informationuniversities
exfiltration withby cyber
attacks.
Supporting
leadingtechnologies to enhance countermeasures against
informationuniversities
exfiltration withby cyber
attacks.
Supporting
leadingtechnologies to enhance countermeasures against
informationcooperation
exfiltration between
by cyber MOD
attacks.
Enhancing& defence industry.
Enhancing cooperation between MOD & defence industry.
Continuing operation of "TSUBAME" (Asia & Pacific region internet fixed point
observationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationoperation
system). of "TSUBAME" (Asia & Pacific region internet fixed pointContinuing
observationcontributing
system). to international debate of international laws, rules & codes for
Positively
cyberspace.
Positively
contributing to international debate of international laws, rules & codes forcyberspace.
Positively
contributing to international debate of international laws, rules & codes forcyberspace.
Positively
contributing to international debate of international laws, rules & codes forcyberspace.
Positively contributing to international debate of international laws, rules & codes forcyberspace.
Speeding
up international assistance in investigation of cybercrimes under treaty for mutual
legal assistance.
Speeding
up international assistance in investigation of cybercrimes under treaty for mutual
legal assistance.
Speeding
up international assistance in investigation of cybercrimes under treaty for mutual
legal assistance.
Exchanging
information with law enforcement of those countries who are related to Japanesecybercrime circumstances.
Exchanging
information with law enforcement of those countries who are related to Japanesecybercrimecontributing
circumstances.
Positively
to international framework for cooperation of anti-cybercrime.
Positively contributing to international framework for cooperation of anti-cybercrime.
Enhancing relationship with neighbouring countries by holding Asian Pacific Regional Cyber
Crime Investigation
Technical
Conferences.
Enhancing
relationshipwith neighbouring
countries by holding Asian Pacific Regional Cyber
Crime Investigation
Technical
Conferences.
Positively
contributing
to promotionof "Budapest Convention on Cybercrime" (the firstinternational
treaty seeking
to addressofInternet
andConvention
computer crimeby harmonizing
Positively
contributing
to promotion"Budapest
on Cybercrime"(the national
firstinternational
treaty seeking
to addressofInternet
andConvention
computer crimeby harmonizing
Positively
contributing
to promotion"Budapest
on Cybercrime"(the national
firstinternational treaty
address international
Internet and computer
crime byharmonizingfrom
national
Contributing
to UNseeking
effort totoestablish
rules to prevent
contingencies
arising out ofto
cyberContributing
UN attacks.
effort to establish international rules to prevent contingencies fromarising out ofto
cyberContributing
UN attacks.
effort to establish international rules to prevent contingencies fromarising out
of cyber attacks.
Sharing
information
about cyber threat & cybersecurity strategies through bilateral meetings.
Enhancing international relationship & cooperation through participating international
conferencesinternational
like "IWWN:International
Watch and Warning
Network" (establishedin 2004
Enhancing
relationship& cooperation
through participatinginternational
conferencesinternational
like "IWWN:International
Watch and Warning
Network" (establishedin 2004
Enhancing
relationship& cooperation
through participatinginternational
conferencesinternational
like "IWWN:International
Watch and Warning
Network" (establishedin 2004
Enhancing
relationship& cooperation
through participatinginternational
conferences&like"IWWN:international
Internationalcoordination
Watch and &Warning
Network"(establishedin 2004
Continuingenhancingcooperation
in incident
responses,
Continuing & enhancing international coordination & cooperation in incident responses,
Continuing & enhancing international coordination & cooperation in incident responses,
Enhancing intelligence gathering & analysis of terrorism activities in cyberspace under
direction
Director ofgathering
Cabinet Intelligence.
Enhancingofintelligence& analysis of terrorism activities in cyberspace under
direction ofintelligence
Director ofgathering
Cabinet Intelligence.
Enhancing& analysis of terrorism activities in cyberspace under
direction ofintelligence
Director ofgathering
Cabinet Intelligence.
Enhancing& analysis of terrorism activities in cyberspace.
Government agencies positively support other nations based on "Basic Policy for Assistanceof Cybersecurity
Capacity
Building
in Developing
Counties".
Government
agencies
positively
supportother nations
based on "Basic Policy for Assistanceof Cybersecurity
Capacity
Building
Developing
Counties".
Supporting
countries
in Asian
Pacificinregion
to build
cybersecurity capabilities through"Asian PacificRegional
CyberPacific
Crime region
Investigation
Conferences"& JICA's
Supporting
countries
in Asian
to buildTechnicalcybersecurity
capabilities
through"AsianPacific
Regional
CyberPacific
Crime region
Investigation
Conferences"& JICA's
Supporting
countries
in Asian
to buildTechnicalcybersecurity
capabilities
through"Asian PacifictoRegional
Crime Investigation
Technical
Conferences"& JICA's
Contributing
regional Cyber
cybersecurity
awareness raisingthrough"APT: Asia-PacificTelecommunity","ITU-D:
ITUtoTelecommunication
Sector""Asian& "Ministerial
Supporting
ASEAN
countries
build cybersecurityDevelopment
capabilities throughPacific
Regional Cyber
Crime
Investigation
Technical
Conferences"& "UNODC:
UnitedNations
Supporting
ASEAN
countries
to build
cybersecurity
capabilities
through "Asian
Pacific
Regional Cyber
Crime
Investigation
Technical
Conferences"& "UNODC:
Nations
Supporting
ASEAN
countries
to build
cybersecurity
capabilities
by holdingUnited
seminarsof
ISMS & CSMS.
Supporting
ASEAN countries to build cybersecurity capabilities by holding seminars of
ISMS & CSMS.
Supporting
countries in Asian Pacific & Africa to build & operate national CSIRTs.
Supporting countries in Asian Pacific & Africa to build & operate national CSIRTs.
Holding seminars for 'secure development' for foreign software suppliers.
Holding seminars for 'secure development' for foreign software suppliers.
Encouraging personnel of government agencies & related agencies to attend international
conferences, international
CTFs & foreignschools.
Encouraging
personnel of government
agencies& related agencies to attend international
conferences, international
CTFs & foreignschools.
Encouraging
personnel of government
agencies& related agencies to attend international
conferences,international& foreignschools.
Enhancingcoordination&CTFs
cooperationof G7
through "Ise-Shima Cyber Group".
Enhancing coordination & cooperation of G7 through "Ise-Shima Cyber Group".
Enhancing coordination & cooperation of G7 through "Ise-Shima Cyber Group".
Continuing & extending international cooperation through bilateral meetings.
Continuing & extending international cooperation through bilateral meetings.
Continuing & extending international cooperation through bilateral meetings.
Enhancing intelligence sharing with foreign governments.
Contributing to international effort to raise cybersecurity awareness.
Enhancing intelligence sharing with foreign law enforcement & legal communities.
Enhancing intelligence sharing with foreign law enforcement & legal communities.
Enhancing intelligence sharing with foreign law enforcement & legal communities.
Researching technologies for measuring cyber health of countries/regions ("Cyber Green
Project").
Enhancing information sharing with foreign agencies for information security like NIST.
Considering possible cooperation in cyberspace between MOD/JSDF & foreign forces.
Considering possible cooperation in cyberspace between MOD/JSDF & foreign forces.

Appendix J

ID
Category
322L3-4 Cybersecurity Education,
Training and Skills
Education,
321L2-5 Cybersecurity
Training and Skills
Education,
322L3-4 Cybersecurity
Training andSkillsOrganisations,and541L3-2 Standards,
Technologies Policy and
132L3-3 Cybersecurity
Strategy Organisations, and
511L2-6 Standards,
Technologies Policy and
122L4-2 Cybersecurity
Strategy
Policy and
123L4-2 Cybersecurity
Strategy
Policy and
124L4-4 Cybersecurity
Strategy
and Regulatory
431L2-1 Legal
Frameworks Policy and
151L4-1 Cybersecurity
Strategy
Policy and
152L4-1 Cybersecurity
Strategy
Policy and
153L4-1 Cybersecurity
Strategy
and Regulatory
417L4-1 Legal
Legal and Regulatory
418L4-1 Frameworks
Frameworks
and Regulatory
431L2-2 Legal
Frameworks
and Regulatory
431L3-2 Legal
Frameworks
and Regulatory
431L4-1 Legal
Frameworks
and Regulatory
431L2-1 Legal
Frameworks
and Regulatory
432L1-3 Legal
Frameworks
and Regulatory
417L4-1 Legal
Legal and Regulatory
418L4-1 Frameworks
Frameworks
and Regulatory
431L2-1 Legal
Frameworks
and Regulatory
432L1-3 Legal
Frameworks
and Regulatory
417L2-2 Legal
Frameworks
and Regulatory
418L2-2 Legal
Frameworks
and Regulatory
431L2-1 Legal
Frameworks Policy and
151L4-1 Cybersecurity
Strategy
Policy and
152L4-1 Cybersecurity
Strategy
Policy and
153L4-1 Cybersecurity
Strategy
Policy and
153L4-2 Cybersecurity
Strategy
Policy and
123L2-3 Cybersecurity
Strategy
Policy and
123L3-2 Cybersecurity
Strategy
Policy and
124L3-5 Cybersecurity
Strategy
Policy and
153L4-2 Cybersecurity
Strategy
Policy and
123L2-3 Cybersecurity
Strategy
Policy and
123L3-2 Cybersecurity
Strategy
Policy and
124L3-5 Cybersecurity
Strategy
Policy and
151L3-2 Cybersecurity
Cybersecurity Policy and
152L3-1 Strategy
Strategy
Policy and
153L3-1 Cybersecurity
Strategy
Policy and
153L3-1 Cybersecurity
Strategy
123L4-2 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
411L4-2 Legaland Regulatory
Frameworks
417L4-1 Legaland Regulatory
418L4-1 Frameworks
Legal and Regulatory
Frameworks Education,
311L3-4 Cybersecurity
Training and Skills
123L4-2 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
123L4-2 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
123L4-2 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
332L4-1 Cybersecurity
Education,
Training andSkills511L2-6 Standards,
Organisations,andTechnologies Policy and
123L3-2 Cybersecurity
Strategy
124L3-5 Cybersecurity
Policy andStrategy
331L3-1 Cybersecurity
Education,
Training and Skills
123L2-3 Cybersecurity
Policy andStrategy
123L3-2 Cybersecurity
Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
123L2-3 Cybersecurity
Policy andStrategy
123L3-2 Cybersecurity
Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
311L3-4 Cybersecurity
Education,
Training
Skills431L2-1 Legal
andandRegulatory
Frameworks
431L3-2 Legaland Regulatory
Frameworks
432L1-3 Legaland Regulatory
FrameworksOrganisations, and
511L3-3 Standards,
511L3-3 Technologies
Standards, Organisations, andTechnologies Policy and
123L3-2 Cybersecurity
Strategy
124L3-5 Cybersecurity
Policy andStrategy

Categorization / Classification
Subcategory
Capacity area
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Administration
Technical Security Controls
Technical Security Controls
Critical Infrastructure (CI)
Organisation
Protection to Standards
Adherence
ICT Security Standards
Incident Response
Organisation
Incident Response
Coordination
Incident Response
Mode of Operation
Formal and Informal
Formal Cooperation
Cooperation
Frameworks to
Cyber
Defence
Strategy
Cyber Defence
Organisation
Cyber Defence
Coordination
Legal Framework
Substantive Cybercrime
Legislation
Legal Framework
Procedural Cybercrime
Legislation
Formal and Informal
FormalCooperation
Cooperation
Frameworks toFormaland Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Informal Cooperation
Cooperation
Frameworks to
Legal
Framework
Substantive Cybercrime
Legislation
Legal Framework
Procedural Cybercrime
Legislation
Formal and Informal
FormalCooperation
Cooperation
Frameworks toFormaland Informal
Informal Cooperation
Cooperation
Frameworks to
Legal
Framework
Substantive Cybercrime
Legislation Cybercrime
Legal Framework
Procedural
Legislation
Formal and Informal
FormalCooperation
Cooperation
Frameworks to
Cyber
Defence
Strategy
Cyber Defence
Organisation
Cyber Defence
Coordination
Cyber Defence
Coordination
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Cyber Defence
Coordination
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Cyber Defence
Strategy
Cyber Defence
Organisation
Cyber Defence
Coordination
Cyber Defence
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Legal Framework
Legislative Framework for
ICT SecurityCybercrime
Legal Framework
Substantive
Legislation
Legal Framework
Procedural Cybercrime
Legislation Raising
Awareness Raising
Awareness
Programmes
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Mode of Operation
Framework for Professional
UptakeTraining to Standards
Adherence
ICT Security Standards
Incident Response
Coordination
Incident Response
Mode of Operation
Framework for Professional
Provision
Training Response
Incident
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Cyber Defence
Coordination
Awareness Raising
Awareness Raising
Programmes
Formal and Informal
FormalCooperation
Cooperation
Frameworks toFormaland Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Informal Cooperation
CooperationtoFrameworks
Adherence
Standards to
ICT Security Standards
Adherence to Standards
ICT Security Standards
Incident Response
Coordination
Incident Response
Mode of Operation

Level
3
2
3
3
3
2
4
4
4
2
4
4
4
4
4
2
3
4
2
1
4
4
2
1
2
2
2
4
4
4
4
2
3
3
4
2
3
3
3
3
3
3
4
4
4
4
4
3
4
4
4
4
4
4
4
2
3
3
3
2
3
3
2
3
3
4
3
2
3
1
3
3
3
3

Requirement (keyword)
CoE in cybersecurity
Research & development in cybersecurity
promoted
CoE
in cybersecurity
Regular review of technical security controls
Supply chain management of CI
Standards & best practices used by CI supply
chainswarning capability
Early
Regional coordination
Regional coordination
Established formal international cooperation
Rules of engagement in cyberspace
Cross-border response ability
Leading international debate about cyberdefence
Contributing
to international cybercrime
treaties
Contributing to international cybercrime
treaties legal assistance & extradition
MutualStrategically expanding international
cooperation
Regularreview of international cooperation
Established formal international cooperation
Informal international cooperation in law
enforcement to international cybercrime
Contributing
treaties
Contributing to international cybercrime
treaties
Establishedformal international cooperation
Informal international cooperation in law
enforcement to international agreements on
Participation
cybercrime to international agreements on
Participation
cybercrime formal international cooperation
Established
Rules of engagement in cyberspace
Cross-border response ability
Leading international debate about cyberdefenceIntelligenceshared with allies
International cooperation in incident response
International coordination
International coordination
Intelligence shared with allies
International cooperation in incident response
International coordination
International coordination
Capturing landscape of national-level threat
Advanced capabilities & situationalawareness capability in cyber defence
Analytical
Analytical capability in cyber defence
Regional coordination
Regional coordination
Participation to international cooperationagreements to international cybercrime
Contributing
treaties
Contributing to international cybercrime
treaties
Contribution
to international awarenessraising coordination
Regional
Regional coordination
Regional coordination
Regional coordination
Regional coordination
Regional coordination
Cybersecurity trained professionals
internationallycontributingStandards& bestpractices used by CI supply
chainsInternational
coordination
International coordination
Cybersecurity training aligned withinternational bestpracticesin incident response
International
cooperation
International coordination
International coordination
International cooperation in incident response
International coordination
International coordination
Intelligence shared with allies
Contribution to international awarenessraising
Establishedformal international cooperation
Strategically expanding international
cooperation
Informalinternational cooperation in law
enforcement to international standards
Contributing
Contributing to international standards
International coordination
International coordination

289

Appendix J
Ref.
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517

290

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan

National #7-330j7-331a27-331a27-331b7-331b7-331c7-331c7-332a7-332a7-332a7-332a2
7-332a2
7-332b
7-332b2
7-332b2
7-332c7-332c7-333a7-333b7-334a7-410a7-410b
7-411a7-411a2
7-411a3
7-411b
7-411b
7-411b2
7-411b2
7-411b2
7-411c7-411d7-411d
7-412a7-412a7-412a7-412b
7-412b
7-412b
7-412c7-412c7-412c7-413a7-413b
7-413b2
7-413b3
7-413c7-413c7-414a7-415a7-415a7-415a7-415a7-420a7-420a7-421a7-421a7-421a7-421b
7-421b
7-421b
7-421b
7-421c7-421c7-421c7-421d7-421d7-421d7-421e7-421e7-421f7-421f7-422a7-422aSourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017

Action Item
Considering possible cooperation in cyberspace between MOD/JSDF & foreign forces.
Building regional confidence measures through "ARF: ASEAN Regional Forum".
Building regional confidence measures through "ARF: ASEAN Regional Forum".
Supporting countries in Asian Pacific region to establish cybercrime jurisdiction.
Supporting countries in Asian Pacific region to establish cybercrime jurisdiction.
Establishing cooperation with South-East Asian countries & Australia in cybersecurity.
Establishing cooperation with South-East Asian countries & Australia in cybersecurity.
Enhancing coordination & cooperation with US through "Japan-U.S. Cyber Dialogues".
Enhancing coordination & cooperation with US through "Japan-U.S. Cyber Dialogues".
Enhancing coordination & cooperation with US through "Japan-U.S. Cyber Dialogues".
Enhancing cyber defence cooperation with European countries through "Japan-UK Bilateral
Consultations
on defence
Cyberspace","Japan-NATO
Staff Talks
on Cyberdefence"& participation
Enhancing
cybercooperation
with European
countries
through"Japan-UK
Bilateral
Consultations
on Cyberspace","Japan-NATO
Staff
Talks on Cyber& participation
Enhancing
information
sharing with
US based on"U.S.-Japan
Policydefence"
Cooperation
Dialogueon the Internet
Economy".
Promotingcooperation
between Japan's ICT-ISAC & US IT-ISAC.
Promoting cooperation between Japan's ICT-ISAC & US IT-ISAC.
Enhancing cyber defence cooperation with US through "U.S.-Japan Cyber defence Policy
Working Group".
Enhancing
cyber defence cooperation with US through "U.S.-Japan Cyber defence Policy
Working Group".
Enhancingcooperation through bilateral meetings.
Gathering information on latest technologies through consultation with "JIWG: Joint
Industry Working
Group".
Enhancingcooperation
through bilateral meetings.
Establishing "Strategy for Research & Development of Cybersecurity".
Researching security assessment of cryptographic algorisms & protocols.
Researching technologies for countermeasures against cyber attacks.
Building up large scale reservoir of cybersecurity related information.
Improving R&D environment by establishing security validation platform.
Researching technologies for detection & prediction of cyber attacks on control systems.
Researching technologies for detection & prediction of cyber attacks on control systems.
Researching technologies for vulnerability management on control systems without
interruption ofservices. for vulnerability management on control systems without
Researching
technologies
interruption ofservices. for vulnerability management on control systems without
Researching
technologies
interruptionof services.
Providingwith"NONSTOP" (R&D platform for secure handling of malware samples).
Researching technologies for data analysis & resilience against cyber attacks.
Researching technologies for data analysis & resilience against cyber attacks.
Same as 7-410a2
Same as 7-410a2
Same as 7-410a2
Researching technologies for creation of cyber-physical system.
Researching technologies for creation of cyber-physical system.
Researching technologies for creation of cyber-physical system.
Promoting researching of advanced AI infrastructure & its practical research forcybersecurity
area.
Promotingresearchingof advanced AI infrastructure & its practical research forcybersecurity
area.
Promotingresearchingof advanced AI infrastructure & its practical research forcybersecurityfor
area.
Researching
quantum cryptography communication.
Promoting "The List of Ciphers that should be Referred to in the Procurement for the eGovernment technologies
System" by "CRYPTREC:
Cryptography Research and Evaluation
Researchingfor secure cryptography.
Promoting use of secure cryptography.
Researching innovative & advanced technologies for balancing security & efficiency of
IoTs.
Researchinginnovative & advanced technologies for balancing security & efficiency of
IoTs.
Positively
contributing to international debate of standards for information security byparticipating technologies
ITU-T SG17.for monitoring & analysis of control & communication systems
Researching
through "Cyber-Security
Infrastructure"
Cross-ministerial
Strategic
Researching
technologiesfor
forCriticalmonitoring& analysis ofof"SIP:
control& communication
systems
through "Cyber-Security
Infrastructure"
Cross-ministerial
Strategic
Researching
technologiesfor
forCriticalmonitoring& analysis ofof"SIP:
control& communication
systems
through "Cyber-Security
Infrastructure"
Cross-ministerial
Strategic
Researching
technologiesfor
forCriticalmonitoring& analysis ofof"SIP:
control& communication
systems
through "Cyber-Security
for development
Critical Infrastructure"of "SIP: Cross-ministerial
Strategic
Promotinghuman resources
based on "Cybersecurity
Human Resources
Development
Program".
Promotinghuman
resources development based on "Cybersecurity Human Resources
Development
Program".
Promotingpractical
exercise & PBL (problem based learning) on cybersecurity bycollaborationof multiple
universities
and/or academia-industry.
Promotingpractical
exercise& PBL (problem
based learning) on cybersecurity bycollaborationof multiple
universities
and/or academia-industry.
Promotingpractical
exercise& PBL (problem
based learning) on cybersecurity bycollaborationof multiple ofuniversities
and/or academia-industry.
Promotingcollaborationindustry, government& academia on practical cyber exercises.
Promoting collaboration of industry, government & academia on practical cyber exercises.
Promoting collaboration of industry, government & academia on practical cyber exercises.
Promoting collaboration of industry, government & academia on practical cyber exercises.
Developing human resources with hybrid careers.
Developing human resources with hybrid careers.
Developing human resources with hybrid careers.
Enhancing cybersecurity education at colleges of technology ("Kosen") based on needs fromindustry. cybersecurity education at colleges of technology ("Kosen") based on needs from
Enhancingindustry. cybersecurity education at colleges of technology ("Kosen") based on needs from
Enhancingindustry. cybersecurity education for working adults at universities.
Promoting
Promoting cybersecurity education for working adults at universities.
Incorporating cybersecurity education into public vocational training.
Incorporating cybersecurity education into public vocational training.
Promoting education at elementary, middle & high schools about IT, information security &informationeducation
moral basedon individual
abilityuseschoolsof IT. about IT, information security &Promotingat elementary,
middle&ofhighinformation moral based on individual ability of use of IT.

Appendix J

ID
Category
152L4-1 Cybersecurity Policy andStrategy
123L4-2 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
411L4-4 Legaland Regulatory
Frameworks
432L4-4 Legaland Regulatory
Frameworks Policy and
123L4-2 Cybersecurity
Strategy
124L4-4 Cybersecurity
Policy andStrategy
123L2-3 Cybersecurity
Policy andStrategy
123L3-2 Cybersecurity
Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
152L4-1 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
431L2-1 Legaland Regulatory
432L3-2 Frameworks
Legal and Regulatory
Frameworks Policy and
152L4-1 Cybersecurity
Strategy
153L4-2 Cybersecurity
Policy andStrategy
152L4-1 Cybersecurity
Policy andStrategy Organisations, and
541L3-2 Standards,
Technologies Policy and
123L2-3 Cybersecurity
Strategy
321L2-5 Cybersecurity
Education,
andSkills551L4-1 Training
Standards,
Organisations,andTechnologies
541L3-2 Standards,
Organisations, andTechnologies Education,
321L2-5 Cybersecurity
Training and Skills
321L2-5 Cybersecurity
Education,
Training and Skills
133L3-1 Cybersecurity
Policy andStrategy Organisations, and
541L3-2 Standards,
Technologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
541L2-1 Standards,
Technologies
541L3-2 Standards,
Organisations, andTechnologies Education,
321L2-5 Cybersecurity
Training and Skills
321L2-5 Cybersecurity
Education,
Training andSkills541L3-2 Standards,
Organisations,andTechnologies Education,
321L2-5 Cybersecurity
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
321L2-5 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,and Skills
321L2-5 Training
Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training andSkills551L4-1 Standards,
Organisations,andTechnologies
551L4-2 Standards,
Organisations, andTechnologies
551L4-1 Standards,
Organisations, andTechnologies
551L2-1 Standards,
Organisations, and
133L3-1 Technologies
Cybersecurity Policy andStrategy Organisations, and
541L4-1 Standards,
Technologies
511L3-3 Standards,
Organisations, andTechnologies Policy and
133L3-1 Cybersecurity
Strategy Organisations, and
521L4-3 Standards,
Technologies
521L4-4 Standards,
Organisations, andTechnologies
541L4-1 Standards,
Organisations, andTechnologies Education,
331L3-2 Cybersecurity
Training and Skills
332L3-1 Cybersecurity
Education,
Training and Skills
321L4-3 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
331L4-2 Cybersecurity
Education,
Training and Skills
332L3-2 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
331L3-3 Cybersecurity
Education,
Training and Skills
331L4-3 Cybersecurity
Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training and Skills
321L4-3 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
331L2-4 Cybersecurity
Education,and Skills
331L4-1 Training
Cybersecurity
Education,
Training
and Skills
213L3-1 Cyber
Cultureand Society
213L4-1 Cyber Culture and Society

Categorization / Classification
Subcategory
Capacity area
Cyber Defence
Organisation
Incident Response
Coordination
Incident Response
Mode of Operation
Legal Framework
Legislative Framework for
ICT Security
Formal and Informal
InformalCooperation
Cooperation
Frameworks to
Incident
Response
Coordination
Incident Response
Mode of Operation
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Cyber Defence
Organisation
Cyber Defence
Coordination
Cyber Defence
Coordination
Formal and Informal
Formal Cooperation
Cooperation
Frameworks toFormal and Informal
Informal Cooperation
Cooperation
Frameworks to
Cyber
DefenceOrganisation
Cyber Defence
Coordination
Cyber Defence
Organisation
Technical Security Controls
Technical Security Controls
Incident Response
Coordination
Framework for Education
Provision
Cryptographic Controls
Cryptographic Controls
Technical Security Controls
Technical Security Controls
Framework for Education
Provision
Framework for Education
Provision
Critical Infrastructure (CI)
Risk Management andProtection Security Controls
Response Security Controls
Technical
Technical
Critical Infrastructure (CI)
Risk Management andProtection Security Controls
Response Security Controls
Technical
Technical
Technical Security Controls
Technical Security Controls
Framework for Education
Provision
Framework for Education
Provision
Technical Security Controls
Technical Security Controls
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Administration
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Critical Infrastructure (CI)
Risk Management andProtection Security Controls
Response Security Controls
Technical
Technical
Adherence to Standards
ICT Security Standards
Critical Infrastructure (CI)
Risk Management andProtection
Response
Internet
InfrastructureInternet
Infrastructure
Resilience
Resilience
Internet
InfrastructureInternet
Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Framework for Professional
Provision
Training for Professional
Framework
UptakeTraining for Education
Framework
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Professional
Framework
UptakeTraining for Education
Framework
Administration
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Education
Framework
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Professional
Provision
Training
Framework for Professional
Provision
Training
Cybersecurity
Mind-set
Users
Cybersecurity Mind-set
Users

Level
4
4
4
4
4
4
4
2
3
3
4
4
4
2
3
4
4
4
3
2
2
4
3
2
2
3
3
3
2
3
2
2
3
2
4
4
2
4
4
2
4
4
4
4
4
2
3
4
3
3
4
4
4
3
3
4
4
4
4
4
4
3
4
3
4
3
4
4
4
4
2
4
3
4

Requirement (keyword)
Cross-border response ability
Regional coordination
Regional coordination
International and/or regional cooperation of
establishing legislative
framework
International
and/or regional
cooperation of
establishing
cybercrime legislation
Regional
coordination
Regional coordination
International cooperation in incident response
International coordination
International coordination
Cross-border response ability
Intelligence shared with allies
Intelligence shared with allies
Established formal international cooperation
Cooperation between foreign ISPs & law
enforcement response ability
Cross-borderIntelligence shared with allies
Cross-border response ability
Regular review of technical security controls
International cooperation in incident response
Research & development in cybersecurity
promoted
Regular review of relevance of cryptographic
controls review of technical security controls
RegularResearch & development in cybersecurity
promoted & development in cybersecurity
Researchpromoted
Cybersecurity
oriented risk management in CI
Regular review of technical security controls
Cybersecurity oriented risk management in CI
Latest technical controls & patch
managements
implemented
Regularreviewwidelyof technicalsecurity controls
Research & development in cybersecurity
promoted & development in cybersecurity
Researchpromotedreview of technical security controls
RegularResearch & development in cybersecurity
promoted
Internationallyforerunning in cybersecurity
education CoE in cybersecurity
International
Research & development in cybersecurity
promoted
Internationallyforerunning in cybersecurity
education CoE in cybersecurity
International
Research & development in cybersecurity
promoted
Internationallyforerunning in cybersecurity
education CoE in cybersecurity
International
Regular review of relevance of cryptographic
controls of cryptographic control policies
Revision
Regular review of relevance of cryptographic
controls
Cryptographic
controls widely used
Cybersecurity oriented risk management in CI
Continuous assess of technical security
controls
Contributing
to international standards
Cybersecurity oriented risk management in CI
Controlled acquisition of critical technologies
Independency & persistence of internet
infrastructureassess
technologies
Continuousof technical security
controls
Cybersecurity
training aligned with national
strategy of cybersecurity training programmes
Review
Cybersecurity education adapting to changing
needs
Cooperation
between all stakeholders incybersecurity education
Cybersecurity
education aligned with practicalproblems
Cooperation
between all stakeholders incybersecurity education
Collaboration
between public & private incybersecurity between
training cybersecurity training
Coordination& education of cybersecurity training across
Coordination
sectors
Cybersecurity
education aligned with practicalproblems
Communication
skills in cybersecurity training
Incentives for cybersecurity trained workforce
Cybersecurity education from primary to postgraduate
Cybersecurity
education adapting to changing
needs
Cybersecurity
education aligned with practicalproblems
Cooperation
between all stakeholders incybersecurity education
Cybersecurity
education aligned with practicalproblems
Cybersecurity
training programmes for nonprofessionals
Collaboration between public & private incybersecurity
training
Mostusers havemind-set
Users' mind-set reducing threat291

Appendix J
Ref.
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591

292

Approaches
Nation
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
Japan
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.

National #7-422a7-422a7-422b
7-422b
7-422b
7-422b
7-423a7-423a7-423b
7-423c7-423c7-424a7-424a7-424a7-424b
7-424c7-424d7-424d7-424d7-424e7-424e7-425a7-425a7-425a7-425b
7-425c7-425d7-425d2
7-425d2
5105-15105-15105-15105-25105-25105-35105-35105-45105-45105-55105-55105-65106-15106-15205-15205-15205-15205-25205-25205-25205-35205-35205-45205-45205-45205-55205-55205-55205-55205-55206-15206-15207-15303-15303-25303-25304-15304-15305-15305-25305-35305-35305-35305-45305-5

SourceCybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Cybersecurity2017
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023

Year
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2017
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
Promoting education at elementary, middle & high schools about IT, information security &informationeducation
moral basedon individual
abilityuseschoolsof IT. about IT, information security &Promotingat elementary,
middle&ofhighinformation
moralforbased
on individual
ability moral
of use of IT.
Training
teachers
IT skills& information
Training teachers for IT skills & information moral
Training teachers for IT skills & information moral
Training teachers for IT skills & information moral
Continuing to hold "Security Camp" to raise awareness of youth & to discover prominenthuman resources.
Continuing
to hold "Security Camp" to raise awareness of youth & to discover prominenthuman resources.
Jointlypromoting CTFs with "JNSA: Japan Network Security Association".
Conducting "MITOU Program: Exploratory IT Human Resources Project" to discover
innovative talents.
Conducting"MITOU Program: Exploratory IT Human Resources Project" to discover
innovative talents.
Promoting"Information Technology Engineers Examination" to develop highly skilled IT
human resources.
Promoting"Information Technology Engineers Examination" to develop highly skilled IT
human resources.
Promoting"Information Technology Engineers Examination" to develop highly skilled IT
humanresources.
Promoting"Information Security Management Examination" (a subject of "Information
Technologyyoung
Engineers
Examination").
Supporting
engineers& student to design their career pass in IT industry.
Promoting new national qualification "Registered Information Security Specialist".
Promoting new national qualification "Registered Information Security Specialist".
Promoting new national qualification "Registered Information Security Specialist".
Training youth to cybersecurity expert at "National Cyber Training Center".
Training youth to cybersecurity expert at "National Cyber Training Center".
Sending officials to study at graduate schools.
Sending officials to study at graduate schools.
Sending officials to study at graduate schools.
Performing upgraded practical cyber defence exercise "(New) CYDER" at "National Cyber
Training Center".
Establishingpractical exercise environment of communication system of JSDF.
Enhancing cooperation between MOD/JSDF & defence industry.
Enhancing cooperation between MOD/JSDF & operators of infrastructures affecting
operation. cooperation between MOD/JSDF & operators of infrastructures affecting
Enhancing
operation.known malware sources
Blocking
Blocking known malware sources
Blocking known malware sources
Promoting email verification systems
Promoting email verification systems
Promoting security best practices
Promoting security best practices
Implementing secure routing
Implementing secure routing
Enhancing capabilities against state-sponsored cyber activities
Enhancing capabilities against state-sponsored cyber activities
Promoting technical development
Metrics
Metrics
Security settings by default
Security settings by default
Security settings by default
Developing IP reputation informing service
Developing IP reputation informing service
Developing IP reputation informing service
Software integrity assuarance
Software integrity assuarance
Promoting out-of-date browsers filtering
Promoting out-of-date browsers filtering
Promoting out-of-date browsers filtering
Investing new technologies like TPM, FIDO
Investing new technologies like TPM, FIDO
Investing new technologies like TPM, FIDO
Investing new technologies like TPM, FIDO
Investing new technologies like TPM, FIDO
Introducing security ratings for products
Introducing security ratings for products
Metrics
Promoting e-government'Security-by-default' in e-government'Security-by-default' in e-government
Eliminating unsupported softwares in public sector
Eliminating unsupported softwares in public sector
Comprehensive knowledge about all public sector systems
Promoting best practices in public sector
Cyber exercise
Cyber exercise
Cyber exercise
Participation of lower levels of public sector
Automated vulnerability scan on e-government

Appendix J

ID
Category
311L4-3 Cybersecurity Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training
and Skills
213L3-1 Cyber
Cultureand Society
213L4-1 Cyber Culture and Society
311L4-3 Cybersecurity Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training
and Skills
213L3-1 Cyber
Cultureand Society
321L3-5 Cybersecurity Education,
Training and Skills
332L3-2 Cybersecurity
Education,
Training and Skills
321L3-3 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
331L2-1 Cybersecurity
Education,
Training and Skills
331L2-2 Cybersecurity
Education,
Training and Skills
332L2-1 Cybersecurity
Education,and Skills
331L1-2 Training
Cybersecurity
Education,
Training and Skills
322L2-3 Cybersecurity
Education,
Training and Skills
331L2-2 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,
Training and Skills
332L2-3 Cybersecurity
Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training and Skills
331L4-2 Cybersecurity
Education,and Skills
124L3-1 Training
Cybersecurity
Policy andStrategy
322L4-3 Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
141L3-1 Cybersecurity
Policy andStrategy
161L3-1 Cybersecurity
Policy andStrategy
132L3-3 Cybersecurity
Policy andStrategy
153L2-1 Cybersecurity
Policy andStrategy
153L2-2 Cybersecurity
Policy andStrategy Organisations, and521L3-2 Standards,
Technologies
541L4-1 Standards,
Organisations, andTechnologies
541L4-3 Standards,
Organisations, andTechnologies
541L3-1 Standards,
Organisations, andTechnologies
541L3-2 Standards,
Organisations, andTechnologies
511L2-4 Standards,
Organisations, andTechnologies
511L3-3 Standards,
Organisations, andTechnologies
521L3-2 Standards,
Organisations, andTechnologies
541L4-1 Standards,
Organisations, andTechnologies Policy and
152L3-1 Cybersecurity
152L4-1 Strategy
Cybersecurity Policy andStrategy Organisations, and
541L4-1 Standards,
Technologies
511L2-3 Standards,
Organisations, andTechnologies
511L2-5 Standards,
Organisations, andTechnologies
513L3-1 Standards,
Organisations, andTechnologies
531L2-2 Standards,
Organisations, andTechnologies
541L2-5 Standards,
Organisations, and222L2-2 Technologies
Cyber Culture and Society
222L4-2 Cyber Culture and Society
521L3-2 Standards, Organisations, andTechnologies
512L3-1 Standards,
Organisations, andTechnologies
531L3-4 Standards,
Organisations, andTechnologies
222L2-2 Cyber
Culture and Society
222L4-2 Cyber Culture and Society
511L2-4 Standards, Organisations, andTechnologies
222L2-2 Cyber
Culture and Society
222L4-2 Cyber Culture and Society
521L3-2 Standards, Organisations, andTechnologies
541L4-1 Standards,
Organisations, andTechnologies
551L4-2 Standards,
Organisations, andTechnologies
531L2-4 Standards,
Organisations, andTechnologies
561L3-1 Standards,
Organisations, andTechnologies
513L2-1 Standards,
Organisations, andTechnologies
222L2-3 Cyber
Culture and Society
222L4-2 Cyber Culture and Society
513L3-1 Standards, Organisations, andTechnologies
512L3-1 Standards,
Organisations, andTechnologies
541L2-1 Standards,
Organisations, andTechnologies
511L2-2 Standards,
Organisations, andTechnologies
511L2-4 Standards,
Organisations, andTechnologies Policy and
111L3-2 Cybersecurity
Strategy
124L2-1 Cybersecurity
Policy and
141L2-1 Strategy
Cybersecurity Policy andStrategy
123L3-1 Cybersecurity
Policy andStrategy
222L4-2 Cyber
Culture and Society

Categorization / Classification
Subcategory
Capacity area
Awareness Raising
Awareness Raising
Programmes
Framework for Education
Provision
Cybersecurity Mind-set
Users
Cybersecurity Mind-set
Users
Awareness Raising
Awareness Raising
Programmes
Framework for Education
Provision
Cybersecurity Mind-set
Users
Framework for Education
Provision
Framework for Professional
UptakeTraining for Education
Framework
Provision
Framework for Education
Provision
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Professional
Framework
UptakeTraining
Framework for Professional
Provision
Training for Education
Framework
Administration
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Professional
Framework
UptakeTraining for Education
Framework
Provision
Framework for Professional
Provision
Training
Incident Response
Mode of Operation
Framework for Education
Administration
Framework for Professional
Provision
Training
CrisisManagement
Crisis Management
Communications Redundancy Communications Redundancy
Critical Infrastructure (CI)
Organisation
Protection
Cyber
Defence
Coordination
Cyber Defence
Coordination
Internet InfrastructureInternet Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Internet InfrastructureInternet Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Cyber Defence
Organisation
Cyber Defence
Organisation
Technical Security Controls
Technical Security Controls
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Adherence to Standards
Standards in Software
Development
Software Quality
SoftwareQuality
Technical Security Controls
Technical Security Controls
Trust and Confidence on the User Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
ServicesInfrastructureInternet InfrastructureInternet
Resilience to Standards
Resilience in Procurement
Adherence
Standards
Software Quality
Software Quality
Trust and Confidence on the User Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
Internet to Standards
Services
Adherence
ICT
Security Standards
Trust and Confidence on the User Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
ServicesInfrastructureInternet InfrastructureInternet
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Cryptographic Controls
Cryptographic Controls
Software Quality
Software Quality
Cybersecurity Marketplace
Cybersecurity Technologies
Adherence to Standards
Standards in Software
Development
Trust and Confidence on the User
Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
Internet to Standards
Services in Software
Adherence
Standards
Development
Adherence to Standards
Standards
in Procurement
Technical Security Controls
Technical Security Controls
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
National Cybersecurity
Strategy Development
Strategy Response
Incident
Mode of Operation
Crisis Management
Crisis Management
Incident Response
Coordination
Trust and Confidence on the User Trust in E-government
Internet
Services

Level
4
3
3
4
4
3
3
3
3
3
4
2
2
2
1
2
2
3
2
3
4
3
4
4
3
3
3
2
2
3
4
4
3
3
2
3
3
4
3
4
4
2
2
3
2
2
2
4
3
3
3
2
4
2
2
4
3
4
4
2
3
2
2
4
3
3
2
2
2
3
2
2
3
4

Requirement (keyword)
Entire society involved in awareness raising
Cybersecurity education from primary to postgraduate
Most
users have mind-set
Users' mind-set reducing threat
Entire society involved in awareness raising
Cybersecurity education from primary to postgraduate
Most
users have mind-set
Cybersecurity education from primary to postgraduate
Coordinationof cybersecurity training acrosssectors
Cybersecurity
specific degree
Internationally forerunning in cybersecurity
education cybersecurity training programmes
Structured
Security professional certification
Cybersecurity trained & certified employees
Cybersecurity training for general IT staff
Attractiveness of cybersecurity career
Security professional certification
Cybersecurity training aligned with national
strategyJobcreation in cybersecurity
Cybersecurity education from primary to postgraduate
Coordination
between cybersecurity training&
education
Training& accreditation for CSIRT members
established education aligned with practical
Cybersecurity
problems
Collaboration
between public & private incybersecurity
training
High-level
scenarioof national incident
exercise communications for key
Redundant
stakeholders
Supplychain management of CI
Coordination between CI & defenceIntelligence sharing between CI & defence
Investment to new technologies in internet
infrastructures
Continuous
assess of technical security
controls
Supplemental
security services by ISPs
User side security controls
Regular review of technical security controls
Promotion of use of standards & bestpractices
Contributing
to international standards
Investment to new technologies in internet
infrastructures
Continuous
assess of technical security
controls capabilities & situational
Advancedawareness
Cross-border response ability
Continuous assess of technical security
controls of adoption of standards & best
Metrics
practicesof compliance of standards & best
Metrics
practicesconsideration in all stages
Security
Softwares complying with international
standards security controls based on
Technical
internationalframeworks
Risk reductionin e-gov
Data protection measures of e-gov
Investment to new technologies in internet
infrastructures
Standards& best practices for procurement
widely used
& complied
Softwaredeficiency
handling
Risk reduction in e-gov
Data protection measures of e-gov
Promotion of use of standards & bestpractices
Risk
reduction in e-gov
Data protection measures of e-gov
Investment to new technologies in internet
infrastructures
Continuous
assess of technical security
controls of cryptographic control policies
Revision
Software classification
Security products complied to International
standardsof adoption of standards & best
Metrics
practices for
Promotion
ofdevelopment
e-gov
Data protection measures of e-gov
Security consideration in all stages
Standards & best practices for procurement
widelytechnicalused & complied
Latestcontrols & patch
managements
widelyimplemented
Standards& bestpractices
widely used
Promotion of use of standards & bestpracticesCyber
exercises considered in strategy
Incident response processes & tools
established
National incident exercise done
Subnational / sectorial incident responseorganisations
Data
protection measures of e-gov

293Appendix J
Ref.
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665

294

Approaches
Nation
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.

National #5305-55306-15306-15306-25306-25307-15307-15307-25307-25308-15309-15310-15310-25310-25311-15311-15311-15311-15404-15404-15404-25404-25404-25404-25404-35404-35404-45404-45404-45404-45404-45405-15405-15406-15406-25406-25406-35406-35406-35406-45408-15408-25408-35408-35408-35408-45408-45408-45408-45408-45409-15410-15410-15410-15503-15503-15503-15503-15504-15504-15505-15505-15505-15505-15505-25606-15606-15606-25607-15608-15609-15609-15609-16205-1

SourceStrategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
Automated vulnerability scan on e-government
Awarenes raising in public sector
Awarenes raising in public sector
Development of cyber expertise
Development of cyber expertise
Developing new guidanceDeveloping new guidance
Making cyber threat infomation easily available
Making cyber threat infomation easily available
Improving highest classification networks
Promoting new standards in health & care industries
Awareness raising in Armed Forces
Enhancing detection & reaction functions
Enhancing detection & reaction functions
Metrics
Metrics
Metrics
Metrics
Awareness raising of board members
Awareness raising of board members
Urging organisations & companies to invest in security
Urging organisations & companies to invest in security
Urging organisations & companies to invest in security
Urging organisations & companies to invest in security
Urging organisations & companies to excercise incident response
Urging organisations & companies to excercise incident response
Cybersecurity in CNICybersecurity in CNICybersecurity in CNICybersecurity in CNICybersecurity in CNIGovernment to understand cybersecurity levels in CNIGovernment to understand cybersecurity levels in CNI
Sharing information with CNI
Setting a new standard by collaborating with industries & academia
Setting a new standard by collaborating with industries & academia
Encouraging investment in the latest technologies
Encouraging investment in the latest technologies
Encouraging investment in the latest technologies
Exercising with CNI
Private sector mind-set
Flexible policies for private sector cybersecurity
Promoting growth of cybersecurity industries
Promoting growth of cybersecurity industries
Promoting growth of cybersecurity industries
Coordinating international legal framework
Coordinating international legal framework
Coordinating international legal framework
Coordinating international legal framework
Coordinating international legal framework
Cybersecurity as a regulation
Metrics
Metrics
Metrics
Public awareness raising
Public awareness raising
Public awareness raising
Public awareness raising
Using cybersecurity insurance for corporate awareness raising
Using cybersecurity insurance for corporate awareness raising
Making information, education, tools easily available to public & corporates
Making information, education, tools easily available to public & corporates
Making information, education, tools easily available to public & corporates
Making information, education, tools easily available to public & corporates
Intelligence sharing between government & law enforcement
Enhancing cooperation in incident response between government & private sector
Enhancing cooperation in incident response between government & private sector
Performing inter-sectoral exercise
Trust between government & private sector
Automated information sharing system
Metrics
Metrics
Metrics
Enhancing law enforcement capability in national, regional & local levels

Appendix J

ID
Category
541L2-1 Standards, Organisations, andTechnologies
211L4-1 Cyber
Culture and Society
311L3-1 Cybersecurity Education,
Training and Skills
311L3-1 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,
Training andSkills511L3-3 Standards,
Organisations,andTechnologies
541L4-1 Standards,
Organisations, andTechnologies Policy and
121L2-1 Cybersecurity
Strategy311l2-3 Cybersecurity
Education,
Training and Skills
161L3-1 Cybersecurity
Policy andStrategy Organisations, and
511L2-4 Standards,
Technologies Education,
311L3-1 Cybersecurity
Training and Skills
152L3-1 Cybersecurity
Policy andStrategy
152L4-1 Cybersecurity
Policy and
311L3-2 Strategy
Cybersecurity Education,
Training and Skills
331L3-4 Cybersecurity
Education,
Training andSkills511L2-5 Standards,
Organisations,andTechnologies
512L2-3 Standards,
Organisations, andTechnologies
212L3-1 Cyber
Culture and Society
312L4-1 Cybersecurity Education,
Training and Skills
312L3-1 Cybersecurity
Education,and Skills
312L3-2 Training
Cybersecurity
Education,
Training andSkills541L2-1 Standards,
Organisations,andTechnologies
541L3-2 Standards,
Organisations, andTechnologies Education,
331L2-4 Cybersecurity
Training and Skills
332L2-1 Cybersecurity
Education,
Training and Skills
131L3-2 Cybersecurity
Policy andStrategy
132L3-3 Cybersecurity
Policy andStrategy
133L3-1 Cybersecurity
Policy andStrategy
133L3-2 Cybersecurity
Policy andStrategy
133L3-3 Cybersecurity
Policy andStrategy
131L4-1 Cybersecurity
Policy andStrategy
132L4-2 Cybersecurity
Policy andStrategy
132L2-1 Cybersecurity
Policy andStrategy
132L4-1 Cybersecurity
Policy andStrategy Organisations, and
511L3-3 Standards,
Technologies Policy and
133L3-4 Cybersecurity
Strategy
141L3-4 Cybersecurity
Policy andStrategy
161L3-3 Cybersecurity
Policy and
141L3-1 Strategy
Cybersecurity Policy andStrategy
212L4-1 Cyber
Culture and Society
411L4-1 Legal and Regulatory
FrameworksOrganisations, and
541L4-1 Standards,
Technologies
561L3-1 Standards,
Organisations, andTechnologies
561L4-2 Standards,
Organisations, andTechnologies
411L4-1 Legaland Regulatory
411L4-2 Frameworks
Legal and Regulatory
Frameworks
412L4-3 Legaland Regulatory
Frameworks
412L4-4 Legaland Regulatory
Frameworks
416L4-1 Legaland Regulatory
Frameworks
411L4-1 Legaland Regulatory
Frameworks Policy and
112L4-1 Cybersecurity
Strategy
131L4-1 Cybersecurity
Policy andStrategy
132L4-1 Cybersecurity
Policy andStrategy
213L3-1 Cyber
Culture and Society
222L3-3 Cyber Culture and Society
223L3-2 Cyber Culture and Society
311L4-3 Cybersecurity Education,
Training andSkills562L4-1 Standards,
Organisations,andTechnologies
562L4-3 Standards,
Organisations, andTechnologies
212L4-1 Cyber
Culture and Society
213L4-1 Cyber Culture and Society
311L4-3 Cybersecurity Education,
Training and Skills
311L4-4 Cybersecurity
Education,
Training
Skills432L3-1 Legal
andandRegulatory
Frameworks Policy and
123L3-3 Cybersecurity
Strategy
123L4-1 Cybersecurity
Policy andStrategy
141L2-1 Cybersecurity
Policy andStrategy
141L3-2 Cybersecurity
Policy andStrategy
123L3-3 Cybersecurity
Policy andStrategy
141L3-4 Cybersecurity
Policy and
141L4-4 Strategy
Cybersecurity Policy andStrategy
161L3-3 Cybersecurity
Policy andStrategy
421L3-1 Legaland Regulatory
Frameworks

Categorization / Classification
Subcategory
Capacity area
Level
Requirement (keyword)
Technical Security Controls
Technical Security Controls
Latest technical controls & patch2
managements
widely implemented
Cybersecurity Mind-set
Government
Mind-setcommonplacein public sector
4
Awareness Raising
Awareness Raising
Sector specific programmes of awareness3
ProgrammesRaisingraising specific programmes of awareness
Awareness Raising
Awareness
Sector3
Programmes
raising
Framework for Professional
Provision
Cybersecurity
training aligned with national
3
Training to Standards
strategy
Adherence
ICT Security Standards
Contributing
to international standards
3
Technical Security Controls
Technical Security Controls
Continuous assess of technical security
4
controlsregistry of incidents
Incident Response
Identification of Incidents
Central2
Awareness Raising
Awareness Raising
Cybersecurity information portal
2
Programmes
Communications Redundancy Communications
Redundancy
Redundant communications for key
3
stakeholders
Adherence to Standards
ICT Security Standards
Promotionof use of standards & best2
practices
Awareness Raising
Awareness Raising
Sectorspecific programmes of awareness3
Programmes
raising
Cyber Defence
Organisation
Advancedcapabilities & situational
3
awareness response ability
Cyber Defence
Organisation
Cross-border
4
Awareness Raising
Awareness Raising
Metrics for effectiveness of awareness raising3
Programmes
programmes
Framework for Professional
Provision
Metricsof effectiveness of cybersecurity
3
Training to Standards
training of compliance of standards & best
Adherence
ICT Security Standards
Metrics2
practicesof compliance of standards & best
Adherence to Standards
Standards in Procurement
Metrics2
practices for
procurement
Cybersecurity Mind-set
Private Sector
Mind-setspreadin private sector
3
Awareness Raising
Executive Awareness Raising
Cybersecurity as common agenda in board
4
meetings understandings of cybersecurity
Awareness Raising
Executive Awareness Raising
Executives'
3
measures
Awareness Raising
Executive Awareness Raising
Executives' ability to reallocate resources3
Technical Security Controls
Technical Security Controls
Latest technical controls & patch2
managements
implemented
Technical Security Controls
Technical Security Controls
Regularreviewwidelyof technicalsecurity controls
3
Framework for Professional
Provision
Cybersecurity training programmes for non2
Training for Professional
professionals trained & certified employees
Framework
UptakeCybersecurity
2
TrainingInfrastructure (CI)
Critical
Identification
Vulnerability & asset management of CI
3
Protection
assets chain management of CI
CriticalInfrastructure (CI)
Organisation
Supply3
Protection
CriticalInfrastructure (CI)
Risk Management andCybersecurity oriented risk management in CI
3
Protection
Response
CriticalInfrastructure (CI)
RiskManagement andRegular review of impact analysis of CI
3
Protection
Response
CriticalInfrastructure (CI)
RiskManagement andRegular review of CI incident response plans3
Protection
Response
CriticalInfrastructure (CI)Identification
Regular review of CI risk priorities
4
Protection
CriticalInfrastructure (CI)
Organisation
Trust between CI & government
4
Protection
CriticalInfrastructure (CI)
Organisation
Information sharing established between CI &2
Protection
government
CriticalInfrastructure (CI)
Organisation
Abilityto adjust of CI protection
4
Protection to Standards
Adherence
ICT Security Standards
Contributing to international standards
3
Critical Infrastructure (CI)
Risk Management andRegular review of resource allocation for CI
3
Protection
Response
protection of national incident exercise
CrisisManagement
CrisisManagement
Evaluation
3
informing investment
Communications Redundancy Communications Redundancy
Evaluationof national incident exercise
3
informing
Crisis Management
Crisis Management
High-levelinvestment
scenario of national incident
3
exercise commonplace in private sector
Cybersecurity Mind-set
Private Sector
Mind-set
4
Legal Framework
Legislative Framework for
Balance between cybersecurity legal
4
ICT Security
framework &best practices
Technical Security Controls
Technical
Security Controls
Continuous
assessof technical security
4
controls products complied to International
Cybersecurity Marketplace
Cybersecurity Technologies
Security
3
standards superior security products
Cybersecurity Marketplace
Cybersecurity Technologies
Exporting4
Legal Framework
Legislative Framework for
Balance between cybersecurity legal
4
ICT
Security
framework
practices cooperation
Legal Framework
Legislative
Framework for
Participation&tobest
international
4
ICT Security
agreements to international digital human
Legal Framework
Privacy,
Freedom of Speech &Contributing
4
Other Human
RightsOnline &rightsLegal Framework
Privacy,
Freedomof Speech
Contributing
to international privacy
4
Other Human
Rights Online
protection
online intellectual property & open
Legal Framework
Intellectual
Property
Balancebetween
4
Legislation Framework foraccess policy
Legal Framework
Legislative
Balancebetween cybersecurity legal
4
ICT Security
framework & bestpractices of resources for
National Cybersecurity
Organisation
Reassignment& reallocation
4
StrategyInfrastructure (CI)cybersecurity
Critical
Identification
Regularreviewprogrammeof CI risk priorities
4
Protection
CriticalInfrastructure (CI)
Organisation
Ability to adjust of CI protection
4
Protection
Cybersecurity
Mind-set
Users
Most users have mind-set
3
Trust and Confidence on the User Trust in E-government
Most users can use e-gov securely
3
Internet
Services
Trustand Confidence on the User
Trust in E-commerce
Most users can use e-commerce securely
3
Internet
Services Raising
Awareness
Raising
Awareness
Entire society involved in awareness raising
4
Programmes
Cybersecurity Marketplace
Cyber
Insurance
Innovative cybersecurity insurance market
4
Cybersecurity Marketplace
Cyber Insurance
Premium discount for secure behaviour
4
Cybersecurity Mind-set
Private Sector
Mind-set commonplace in private sector
4
Cybersecurity Mind-set
Users
Users' mind-set reducing threat
4
Awareness Raising
Awareness Raising
Entire society involved in awareness raising
4
ProgrammesRaising
Awareness Raising
Awareness
Overall threat reduced by awareness raising
4
Programmes
Formal and Informal
InformalCooperation
Established relationship among government,
3
Cooperation
Frameworks toprosecutors, sharing
judges &law enforcement
Incident
Response
Coordination
Information
acrosssectors3
Incident Response
Coordination
Coordinating all levels / sectors
4
Crisis Management
Crisis Management
National incident exercise done
2
Crisis Management
Crisis Management
Trust between participants of national incident
3
exercise
Incident Response
Coordination
Information
sharing across sectors
3
Crisis Management
Crisis Management
Evaluation of national incident exercise
3
informing
investment
Crisis Management
Crisis Management
National crisis
management established4
Communications Redundancy Communications Redundancy
Evaluation of national incident exercise
3
informing investment
Criminal Justice System
Law Enforcement
Dedicatedinvestigative resources for3cybercrimes

295Appendix J
Ref.
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739

296

Approaches
Nation
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.

National #6205-16205-26205-26205-36205-36205-36205-36205-36205-46205-46205-56205-56205-66205-66205-66205-76205-76205-76205-86205-86206-16206-16206-16206-16303-16303-16303-26303-36303-36303-46303-46303-46303-56303-56303-56303-66303-76304-16403-16403-16403-16403-16403-26403-26403-36403-36403-36404-16404-16404-16503-16503-16503-16503-16503-26503-26503-26503-26503-36503-36504-1
6504-16603-16603-16604-17106-17106-17107-17107-17107-17107-27107-27107-37108-1

SourceStrategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
Enhancing law enforcement capability in national, regional & local levels
Making UK inefficient cybercrime target based on understanding of cybercrime businessmodel UK inefficient cybercrime target based on understanding of cybercrime business
Makingmodel
International
juridical partnership
International juridical partnership
International juridical partnership
International juridical partnership
International juridical partnership
Discouraging individuals being involved in cybercrime
Discouraging individuals being involved in cybercrime
Exchanging intelligence with industry
Exchanging intelligence with industry
New 24/7 reporting system
New 24/7 reporting system
New 24/7 reporting system
Reducing vulnerabilities in infrastructures
Reducing vulnerabilities in infrastructures
Reducing vulnerabilities in infrastructures
Making use of stolen credentials difficult in UK
Making use of stolen credentials difficult in UK
Metrics
Metrics
Metrics
Metrics
Applying international law in cyberspace
Applying international law in cyberspace
Confidence building
Enhancing NATO cooperation
Enhancing NATO cooperation
Understanding cyber activity of adversaries
Understanding cyber activity of adversaries
Understanding cyber activity of adversaries
Generating all available options
Generating all available options
Generating all available options
Intenational information sharing
Attributing specific identities
Metrics
Enhancing detection of cyber terrorism
Enhancing detection of cyber terrorism
Enhancing detection of cyber terrorism
Enhancing detection of cyber terrorism
Enhancing investigation of cyber terrorism
Enhancing investigation of cyber terrorism
International cooperation
International cooperation
International cooperation
Metrics
Metrics
Metrics
Enhancing development of cyber HR
Enhancing development of cyber HR
Enhancing development of cyber HR
Enhancing development of cyber HR
Developing offensive cyber capability
Developing offensive cyber capability
Developing offensive cyber capability
Developing offensive cyber capability
Integrating offensive cyber capability to armed forces
Integrating offensive cyber capability to armed forces
Metrics
Metrics
Creating new requirement of cryptography
Creating new requirement of cryptography
Metrics
Including cybersecurity into computer science education
Including cybersecurity into computer science education
Making clear rolls of government & private sector in cybersecurity training
Making clear rolls of government & private sector in cybersecurity training
Making clear rolls of government & private sector in cybersecurity training
Urging corporate management to train employees
Urging corporate management to train employees
More attractive careers of cybersecurity professionals
Inter-sectoral coordination of education/training

Appendix J

ID
Category
422L4-2 Legal and Regulatory
Frameworks
421L3-2 Legaland Regulatory
Frameworks
421L3-5 Legaland Regulatory
Frameworks
417L4-1 Legaland Regulatory
Frameworks
418L4-1 Legaland Regulatory
Frameworks
421L3-4 Legaland Regulatory
Frameworks
422L4-1 Legaland Regulatory
Frameworks
432L3-3 Legaland Regulatory
Frameworks Education,
311L4-3 Cybersecurity
Training and Skills
311L4-4 Cybersecurity
Education,
Training and Skills
123L3-3 Cybersecurity
Policy andStrategy
431L2-1 Legaland Regulatory
Frameworks Policy and
121L2-1 Cybersecurity
Strategy
241L2-1 Cyber
Culture and Society
241L2-2 Cyber Culture and Society
131L3-2 Cybersecurity Policy andStrategy Organisations, and
521L2-3 Standards,
Technologies
541L2-1 Standards,
Organisations, andTechnologies
411L3-1 Legaland Regulatory
Frameworks
415L4-1 Legaland Regulatory
Frameworks
417L4-2 Legaland Regulatory
418L4-2 Frameworks
Legal and Regulatory
Frameworks
421L4-3 Legaland Regulatory
Frameworks
423L4-2 Legaland Regulatory
Frameworks Policy and
152L4-1 Cybersecurity
Strategy
153L4-1 Cybersecurity
Policy andStrategy
111L4-2 Cybersecurity
Policy andStrategy
141L4-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
151L3-2 Cybersecurity
Policy andStrategy
152L3-1 Cybersecurity
Policy andStrategy
153L3-1 Cybersecurity
Policy andStrategy
152L3-1 Cybersecurity
Policy andStrategy
153L3-1 Cybersecurity
Policy andStrategy
153L3-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
153L4-1 Cybersecurity
Policy andStrategy
151L3-3 Cybersecurity
Policy andStrategy
151L3-2 Cybersecurity
Policy and
152L3-1 Strategy
Cybersecurity Policy andStrategy
153L2-1 Cybersecurity
Policy andStrategy
421L3-2 Legaland Regulatory
Frameworks
421L3-2 Legaland Regulatory
Frameworks
421L3-4 Legaland Regulatory
Frameworks Policy and
153L4-2 Cybersecurity
Strategy
431L3-1 Legaland Regulatory
432L3-3 Frameworks
Legal and Regulatory
Frameworks
421L4-3 Legaland Regulatory
Frameworks
431L4-1 Legaland Regulatory
Frameworks
432L4-2 Legaland Regulatory
Frameworks Education,
321L3-4 Cybersecurity
Training and Skills
322L3-2 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
152L3-1 Cybersecurity
Policy andStrategy
321L4-3 Cybersecurity
Education,
Training andSkills541L4-1 Standards,
Organisations,andTechnologies
561L4-2 Standards,
Organisations, andTechnologies Policy and
152L3-1 Cybersecurity
Strategy
152L4-1 Cybersecurity
Policy andStrategy
151L3-3 Cybersecurity
Policy andStrategy Organisations, and
541L4-1 Standards,
Technologies
551L4-1 Standards,
Organisations, andTechnologies
551L4-2 Standards,
Organisations, andTechnologies
551L4-1 Standards,
Organisations, andTechnologies Education,
321L3-2 Cybersecurity
Training and Skills
321L3-4 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
332L3-2 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,and Skills
332L3-2 Training
Cybersecurity
Education,
Training and Skills
331L4-3 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills

Categorization / Classification
Subcategory
Capacity area
Criminal Justice System
Prosecution
Criminal Justice System
Law Enforcement
Criminal Justice System
Law Enforcement
Legal Framework
Substantive Cybercrime
Legislation Cybercrime
Legal Framework
Procedural
Legislation
Criminal Justice System
Law
Enforcement
Criminal Justice System
Prosecution
Formal and Informal
Informal Cooperation
CooperationRaising
Frameworks to
Awareness
Awareness Raising
ProgrammesRaising
Awareness Raising
Awareness
Programmes
Incident Response
Coordination
Formal and Informal
Formal Cooperation
Cooperation
Frameworks to
Incident
Response
Identification of Incidents
Reporting Mechanisms
Reporting Mechanisms
Reporting Mechanisms
Reporting Mechanisms
Critical Infrastructure (CI)Identification
Protection
Internet
InfrastructureInternet Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Legal Framework
Legislative Framework for
ICT Security
Legal Framework
ConsumerProtection
Legislation Cybercrime
Legal Framework
Substantive
Legislation
Legal Framework
Procedural Cybercrime
Legislation
Criminal Justice System
Law
Enforcement
Criminal Justice System
CourtsCyber Defence
Organisation
Cyber Defence
Coordination
National Cybersecurity
Strategy Development
Strategy
CrisisManagement
Crisis Management
Cyber Defence
Coordination
Cyber Defence
Strategy
Cyber Defence
Organisation
Cyber Defence
Coordination
Cyber Defence
Organisation
Cyber Defence
Coordination
Cyber Defence
Coordination
Cyber Defence
Coordination
Cyber Defence
Coordination
Cyber Defence
Strategy
Cyber Defence
Strategy
Cyber Defence
Organisation
Cyber Defence
Coordination
Criminal Justice System
Law Enforcement
Criminal Justice System
Law Enforcement
Criminal Justice System
Law Enforcement
Cyber Defence
Coordination
Formal and Informal
Formal Cooperation
Cooperation
Frameworks toFormal and Informal
Informal Cooperation
Cooperation
Frameworks
Criminal
Justice
System to
Law Enforcement
Formal and Informal
Formal Cooperation
Cooperation
Frameworks toFormaland Informal
Informal Cooperation
Cooperationfor
Frameworks
Framework
Education to
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Cyber Defence
Organisation
Framework for Education
Provision
Technical Security Controls
Technical Security Controls
Cybersecurity Marketplace
Cybersecurity Technologies
Cyber Defence
Organisation
Cyber Defence
Organisation
Cyber Defence
Strategy
Technical Security Controls
Technical Security Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Cryptographic Controls
Framework for Education
Provision
Framework for Education
Provision
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Professional
Framework
UptakeTraining for Professional
Framework
Provision
Training
Framework for Professional
UptakeTraining for Professional
Framework
Provision
Training for Education
Framework
Administration

Level
4
3
3
4
4
3
4
3
4
4
3
2
2
2
2
3
2
2
3
4
4
4
4
4
4
4
4
4
4
3
3
3
3
3
3
4
4
3
3
3
2
3
3
3
4
3
3
4
4
4
3
3
4
4
3
4
4
4
3
4
3
4
4
4
4
3
3
3
4
3
3
3
4
4

Requirement (keyword)
Dedicated prosecutorial resources forcybercrimes
Advanced
investigative capabilities forcybercrimes
Statistics& analysis of cybercrime
investigationsto international cybercrime
Contributing
treaties
Contributing
to international cybercrime
treaties
Cross-borderinvestigation of cybercrimes
Prosecution of cross-border cybercrimes
Joint international investigation & prosecution
Entire society involved in awareness raisingOverall threat reduced by awareness raising
Information sharing across sectors
Established formal international cooperation
Central registry of incidents
Incident reporting mechanisms established
Promotion of incident reporting channels
Vulnerability & asset management of CI
assets infrastructures compliant toInternet
international
standards
practices
Latesttechnical
controls&&best
patch
managements
implemented
Regularreviewwidelyof cybersecurity
legal
framework procedures for consumer
Amendment
protection
legislation
Regularreviewof substantive cybercrime
legislation
Regular review of procedural cybercrime
legislation
Regularreview of investigative capabilities
for cybercrimes
Regularreview of court system capabilities tojudge cybercrimes
Cross-border
response ability
Leading international debate about cyberdefence
Contributing
to international debate ofstrategy incident exercise contributing to
National
internationalsharedchallenges
Intelligencewith allies
Capturing landscape of national-level threat
Advanced capabilities & situationalawareness capability in cyber defence
Analytical
Advanced capabilities & situationalawareness capability in cyber defence
AnalyticalStrengths & weaknesses of cyber defence
understood shared with allies
Intelligence
Leading international debate about cyberdefencedefence strategy meets objectives
Cyber
Capturing landscape of national-level threat
Advanced capabilities & situationalawareness between CI & defence
Coordination
Advanced investigative capabilities forcybercrimes
Advanced
investigative capabilities forcybercrimes investigation of cybercrimes
Cross-borderIntelligence shared with allies
Communication channels for international
cooperation
Joint international investigation & prosecution
Regular review of investigative capabilities
for cybercrimes
Regularreview of international cooperation
Adapted international cooperation
Cybersecurity as focusing area
Adapted budget for cybersecurity education
Cooperation between all stakeholders incybersecurity education
Cybersecurity
education aligned with practicalproblems capabilities & situational
Advancedawareness
Cybersecurity
education adapting to changing
needs
Continuous
assess of technical security
controls superior security products
Exporting
Advanced capabilities & situationalawareness response ability
Cross-border
Cyber defence strategy meets objectives
Continuous assess of technical security
controls review of relevance of cryptographic
Regularcontrols of cryptographic control policies
Revision
Regular review of relevance of cryptographic
controls cybersecutity courses for
Mandatory
computer science
degrees area
Cybersecurity
as focusing
Cybersecurity training aligned with national
strategy
Collaboration
between public & private incybersecurity of
training
Coordination
cybersecurity training acrosssectors
Cybersecurity
training aligned with national
strategy
Coordination of cybersecurity training acrosssectors
Incentives
for cybersecurity trained workforce
Cooperation between all stakeholders incybersecurity education

297

Appendix J
Ref.
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813

298

Approaches
Nation
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.

National #7108-17108-17109-17109-17109-27109-27109-37109-47109-57109-67109-67109-77109-77109-77109-87109-87109-97109-107110-17110-1
7203-1
7203-1
7203-1
7203-1
7203-27203-27203-27203-27203-37203-37203-47203-57203-67203-77203-77204-17204-17205-17303-17303-17303-17303-17303-27303-27303-27303-27304-17304-17305-17305-17305-17305-17306-17306-17306-27306-27307-17307-17308-17309-17309-17309-17309-17310-17403-17403-27403-37403-37403-47403-57403-67403-67404-17407-1

SourceStrategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
Inter-sectoral coordination of education/training
Inter-sectoral coordination of education/training
Specialist education targeting 14-18 years
Specialist education targeting 14-18 years
Degree-level apprenticeship in energy, finance & transport
Degree-level apprenticeship in energy, finance & transport
Retraining funds
Supporting high quality post graduate education
Accredition of teachers
Identifying excellent organisation
Identifying excellent organisation
Defence cyber academy to CoE
Defence cyber academy to CoE
Defence cyber academy to CoE
Collaborating between government, forces, industry & academia
Collaborating between government, forces, industry & academia
CyberFirst: nurturing young talent programme
Cybersecurity education from primary to postgraduate
Metrics
Metrics
Supporting commercialisation of academic innovation
Supporting commercialisation of academic innovation
Supporting commercialisation of academic innovation
Supporting commercialisation of academic innovation
Establishing innovation centres
Establishing innovation centres
Establishing innovation centres
Establishing innovation centres
Allocating funds
Allocating funds
Providing testing facilities
Enhancing cooperation between industry & government
Supporting scaling-up
Promoting international standards for easier market access
Promoting international standards for easier market access
Easier access to government procurement for start-ups
Easier access to government procurement for start-ups
Metrics
Making research funding more effective
Making research funding more effective
Making research funding more effective
Making research funding more effective
Human & behavioural aspects of cyber science
Human & behavioural aspects of cyber science
Human & behavioural aspects of cyber science
Human & behavioural aspects of cyber science
Enhancing 'secure-by-default'
Enhancing 'secure-by-default'
Establishing Cyber Science and Technology Strategy
Establishing Cyber Science and Technology Strategy
Establishing Cyber Science and Technology Strategy
Establishing Cyber Science and Technology Strategy
Supporting academic CoE, research institutes & doctral training
Supporting academic CoE, research institutes & doctral training
Establishing new research instituteEstablishing new research instituteSupporting PhD
Supporting PhD
Encouraging collaboration between government, industry & academia
Funding 'grand challenge'
Funding 'grand challenge'
Funding 'grand challenge'
Funding 'grand challenge'
Metrics
Promoting inter-disciplinary research for development of horizon scanning
Integration of cybersecurity & behavioural science
Monitoring cyber criminal market
Monitoring cyber criminal market
Investigating new technologies-doEarly defence technology
Early defence technology
Including cybersecurity into any other research areas for horizon scanning
Metrics

Appendix J

ID
Category
331L4-1 Cybersecurity Education,
Training and Skills
331L4-2 Cybersecurity
Education,
Training and Skills
321L3-3 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training and Skills
332L3-2 Cybersecurity
Education,
Training and Skills
332L3-1 Cybersecurity
Education,
Training and Skills
321L3-3 Cybersecurity
Education,
Training and Skills
321L2-1 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,
Training and Skills
331L4-3 Cybersecurity
Education,
Training and Skills
322L3-4 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,and Skills
322L4-2 Training
Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training and Skills
321L3-5 Cybersecurity
Education,
Training and Skills
321L4-3 Cybersecurity
Education,
Training and Skills
331L3-4 Cybersecurity
Education,
Training and Skills
321L4-2 Cybersecurity
Education,and Skills
322L4-1 Training
Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training andSkills561L4-2 Standards,
Organisations,andTechnologies Education,
321L4-2 Cybersecurity
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
322L4-3 Cybersecurity
Education,
Training andSkills561L4-2 Standards,
Organisations,andTechnologies Education,
322L4-2 Cybersecurity
Training andSkills561L4-2 Standards,
Organisations,andTechnologies
561L4-2 Standards,
Organisations, andTechnologies Education,
322L4-2 Cybersecurity
Training andSkills561L4-2 Standards,
Organisations,andTechnologies
561L3-1 Standards,
Organisations, andTechnologies
561L4-2 Standards,
Organisations, andTechnologies
561L3-1 Standards,
Organisations, andTechnologies
561L4-2 Standards,
Organisations, andTechnologies Education,
321L4-3 Cybersecurity
Training and Skills
321L2-5 Cybersecurity
Education,and Skills
322L2-2 Training
Cybersecurity
Education,
Training and Skills
322L3-2 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
321L2-5 Cybersecurity
Education,
Training and Skills
322L2-2 Cybersecurity
Education,
Training and Skills
322L3-2 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
andSkills513L3-1 Training
Standards,
Organisations,andTechnologies
561L3-1 Standards,
Organisations, andTechnologies Education,
321L2-5 Cybersecurity
Training and Skills
322L2-2 Cybersecurity
Education,
Training and Skills
322L3-2 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
322L3-4 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
322L3-4 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
321L3-3 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
321L2-5 Cybersecurity
Education,
Training and Skills
322L2-2 Cybersecurity
Education,
Training and Skills
322L3-2 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
321L4-3 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training
Skills421L3-2 Legal
andandRegulatory
Frameworks
421L4-3 Legaland Regulatory
FrameworksOrganisations, and
541L4-1 Standards,
Technologies
541L4-1 Standards,
Organisations, andTechnologies Policy and
122L4-2 Cybersecurity
541L4-1 Strategy
Standards, Organisations, andTechnologies Education,
321L4-1 Cybersecurity
Training and Skills
321L4-3 Cybersecurity
Education,
Training and Skills

Categorization / Classification
Subcategory
Capacity area
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Education
Framework
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Professional
UptakeTraining for Professional
Framework
UptakeTraining for Education
Framework
Provision
Framework for Education
Provision
Framework for Professional
Provision
Training for Professional
Framework
Provision
Training for Education
Framework
Administration
Framework for Education
Administration
Framework for Professional
Provision
Training
Framework for Education
Administration
Framework for Professional
Provision
Training for Education
Framework
Provision
Framework for Education
Provision
Framework for Education
Provision
Framework for Professional
Provision
Training for Education
Framework
Provision
Framework for Education
Administration
Framework for Education
Administration
Cybersecurity Marketplace
Cybersecurity Technologies
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Cybersecurity Marketplace
Cybersecurity Technologies
Framework for Education
Administration
Cybersecurity Marketplace
Cybersecurity Technologies
Cybersecurity Marketplace
Cybersecurity Technologies
Framework for Education
Administration
Cybersecurity Marketplace
Cybersecurity Technologies
Cybersecurity Marketplace
Cybersecurity Technologies
Cybersecurity Marketplace
Cybersecurity Technologies
Cybersecurity Marketplace
Cybersecurity Technologies
Cybersecurity Marketplace
Cybersecurity Technologies
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Adherence to Standards
Standards in Software
Development Technologies
Cybersecurity Marketplace
Cybersecurity
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Administration
Framework for Education
Provision
Framework for Education
Provision
Framework for Education
Provision
Criminal Justice System
Law Enforcement
Criminal Justice System
Law Enforcement
Technical Security Controls
Technical Security Controls
Technical Security Controls
Technical Security Controls
Incident Response
Organisation
Technical Security Controls
Technical Security Controls
Framework for Education
Provision
Framework for Education
Provision

Level
4
4
3
4
4
3
3
3
2
3
4
3
4
3
4
4
3
3
4
3
4
4
4
4
4
4
4
4
4
4
4
4
4
3
4
3
4
4
2
2
3
4
2
2
3
4
3
3
2
2
3
4
3
4
3
4
3
4
4
2
2
3
4
4
4
4
3
4
4
4
4
4
4
4

Requirement (keyword)
Collaboration between public & private incybersecurity between
training cybersecurity training
Coordination& education specific degree
Cybersecurity
Internationally forerunning in cybersecurity
education
Cybersecurity
education aligned with practicalproblems
Coordinationof cybersecurity training acrosssectors of cybersecurity training programmes
Review
Cybersecurity specific degree
Qualification for cybersecurity educators
established training aligned with national
Cybersecurity
strategy for cybersecurity trained workforce
Incentives
CoE in cybersecurity
International CoE in cybersecurity
Cybersecurity training aligned with national
strategy
Cooperation between all stakeholders incybersecurity education
Collaboration
between public & private incybersecurity training
Cybersecurity
education from primary to postgraduate
Cybersecurity
education from primary to postgraduate
Cybersecurity
education adapting to changing
needs of effectiveness of cybersecurity
Metrics
training between core components & adaptive
Balanceprocesses
International CoE in cybersecurity
Cybersecurity education aligned with practicalproblems superior security products
Exporting
Balance between core components & adaptive
processes CoE in cybersecurity
International
Cybersecurity education aligned with practicalproblems superior security products
Exporting
Cooperation between all stakeholders incybersecurity
education
Exportingsuperior
security products
Exporting superior security products
Cooperation between all stakeholders incybersecurity
education
Exportingsuperior
security products
Security products complied to International
standards superior security products
Exporting
Security products complied to International
standards superior security products
Exporting
Cybersecurity education adapting to changing
needs
Research& development in cybersecurity
promoted
Budget for research & education forcybersecurity
Adaptedbudget for cybersecurity education
International CoE in cybersecurity
Research & development in cybersecurity
promoted
Budgetfor research & education forcybersecurity
Adaptedbudget for cybersecurity education
International CoE in cybersecurity
Security consideration in all stages
Security products complied to International
standards & development in cybersecurity
Researchpromoted
Budgetfor research & education forcybersecurity
Adaptedbudget for cybersecurity education
International CoE in cybersecurity
CoE in cybersecurity
International CoE in cybersecurity
CoE in cybersecurity
International CoE in cybersecurity
Cybersecurity specific degree
Internationally forerunning in cybersecurity
education between all stakeholders in
Cooperation
cybersecurity
education in cybersecurity
Research& development
promoted
Budgetfor research & education forcybersecurity
Adaptedbudget for cybersecurity education
International CoE in cybersecurity
Cybersecurity education adapting to changing
needsInternationallyforerunning in cybersecurity
education
Internationallyforerunning in cybersecurity
education investigative capabilities for
Advancedcybercrimes
Regularreview of investigative capabilities
for cybercrimes
Continuous
assess of technical security
controls
Continuous
assess of technical security
controls
Earlywarning capability
Continuous assess of technical security
controls
Internationallyforerunning in cybersecurity
education
Cybersecurity
education adapting to changing
needs

299

Appendix J
Ref.
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887

300

Approaches
Nation
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.K.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.

National #84---184---284---384---484---584---584---584---684---684---684---784---784---884---884---884---984---984---984---984---984---1084---1084---1084---1084---1084---1184---1184---1284---1284---1384---1385---185---185---285---285---386---186---186---186---1
1.1.1
1.1.1
1.1.1
1.2.1
1.2.1
1.2.1
1.2.1
1.2.2
1.2.2
1.2.2
1.2.2
1.2.3
1.2.3
1.2.3
1.2.4
1.2.4
1.2.5
1.2.5
1.3.1
1.3.1
1.3.1
1.3.2
1.3.2
1.3.3
1.3.3
1.3.4
1.3.4
1.4.1
1.4.1
1.4.1
1.4.1
1.4.1
1.4.1
1.4.1

SourceStrategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
Strategy2016-2023
CommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommision

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
Contributing to international debate of international law in cyber space-do-doConfidence building measures
Cross-border prosecution
Cross-border prosecution
Cross-border prosecution
Enhancing law enforcement
Enhancing law enforcement
Enhancing law enforcement
Promoting international standards & best practices in emerging technologies
Promoting international standards & best practices in emerging technologies
Cross-border cooperation in capabilities & new technologies
Cross-border cooperation in capabilities & new technologies
Cross-border cooperation in capabilities & new technologies
Assist other countries to build capabilities
Assist other countries to build capabilities
Assist other countries to build capabilities
Assist other countries to build capabilities
Assist other countries to build capabilities
Assist other countries to enhance cybersecurity
Assist other countries to enhance cybersecurity
Assist other countries to enhance cybersecurity
Assist other countries to enhance cybersecurity
Assist other countries to enhance cybersecurity
Enhancing NATO's capability in cyber space
Enhancing NATO's capability in cyber space-do-doContributing international norm development in cyber space
Contributing international norm development in cyber space
Enhancing cooperation with allies
Enhancing cooperation with allies
Contributing to international oganisations
Contributing to international oganisations
Cooperating international non-government actors
Metrics
Metrics
Metrics
Metrics
The President should direct senior federal executives to launch a private–public initiative,
includingprovisions
undertake,track, andtoreport
onameasurable
progressin
The
President
shouldtodirect
senior monitor,
federal executives
launchprivate–public
initiative,
includingprovisions
undertake,track, andtoreport
onameasurable
progressin
The
President
shouldtodirect
senior monitor,
federal executives
launchprivate–public
initiative,
includingprovisions
undertake,monitor,track,and thereporton measurable
progressin
The
President
shouldtocreate,throughexecutiveorder,
National
Cybersecurity
Private–PublicProgramshould(NCP3)
as a throughforum foraddressing
cybersecurity
issuesthrough a high-level,
The
President
create,executiveorder,
the National
Cybersecurity
Private–PublicProgramshould(NCP3)
as a throughforum foraddressing
cybersecurity
issuesthrough a high-level,
The
President
create,executiveorder,
the National
Cybersecurity
Private–PublicProgramshould(NCP3)
as a throughforum foraddressing
cybersecurity
issuesthrough a high-level,
The President
create,executiveorder,
the National
Cybersecurity
Private–PublicProgram(NCP3)
as a forum forshould
addressing
cybersecurity
issues througha high-level,Theprivatesectorand Administration
launcha joint cybersecurity
operation
programfor thepublicand private
sectors to collaborate
on cybersecurity
activitiesoperationin order toprogram
The
privatesectorand Administration
should launcha joint cybersecurity
for thepublicand private
sectors to collaborate
on cybersecurity
activitiesoperationin order toprogram
The
privatesectorand Administration
should launcha joint cybersecurity
for thepublicand private
sectors to collaborate
on cybersecurity
activitiesoperationin order toprogram
The
privatesectorand Administration
should launcha joint cybersecurity
for thepublicand privateshould
sectorsprovide
to collaborate
on cybersecurity
activities
in order toandThe
federalgovernment
companies
the option to engage
proactively
candidlyin formal
collaboration
with thecompanies
government
advancecyber risk
management
The
federalgovernment
should provide
thetooption
to engage
proactively
andcandidlyin formal
collaboration
with thecompanies
government
advancecyber risk
management
The
federalgovernment
should provide
thetooption
to engage
proactively
andcandidlyagencies
in formalshouldcollaboration
withcurrent
the government
to advancerisk management
Federalexpand theimplementationof thecyber
information-sharing
strategy agencies
to includeshould
exchangeof information
on organizational
within theFederalexpandthe current implementation
ofinterdependencies
the information-sharing
strategy
includeinexchange
information
on organizational
withinWith
thetoincrease
wireless of
network
communications
across interdependencies
all organizations, andthe thenation’son theGlobalPositioning System(GPS)
to provide positioning,Withthegrowing
increasereliancein wirelessnetwork
communications
acrossall organizations,and thenation’s
relianceshouldon therequire
Global that
Positioning
System (GPS)to provide
positioning,The
nextgrowing
Administration
all Internet-based
federalgovernment
services
provided
directly to citizens
requirethe thatuse ofauthentication.
The
next Administration
shouldrequireallappropriatelyInternet-basedstrong
federalgovernment services
provided
directly to citizens
requirethe thatuse ofauthentication.
The
next Administration
shouldrequireallappropriatelyInternet-basedstrong
federalgovernment services
provided
directly to citizens
requirethethatusealloffederal
appropriately
strongauthentication.
The
next Administration
shoulddirectagencies
requirethe use of strong
authenticationby their employees,
contractors,
and others
usingrequire
federalthesystems.
The
next Administration
should directthat all federal
agencies
use of strong
authentication
byshould
their employees,
contractors,
and others
usingfederaltosystems.
Thegovernment
serve as a source
to validate
identity
attributes
address online
identity
challenges.
Thegovernment
should serve as a source to validate identity attributes to address online
identityThe
nextchallenges.
Administration should convene a body of experts from the private and public
sectors
develop identity
managementfor devices
andprivate
processes
in support ofThe
nexttoAdministration
shouldconvenerequirementsa body of experts
from theand public
sectorsintocoordination
develop identity
requirements
devices and processes
in support
NIST,
withmanagement
the NCP3, should
establishfora Cybersecurity
Framework
Metricsof
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST,
in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST,
in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST,
in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST, in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST,
in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working
Group (CFMWG)
to develop
industry-led,consensus-basedthat maybe
NIST,
in coordination
with theNCP3, should
establisha Cybersecuritymetrics
Framework
Metrics
Working Group (CFMWG) to develop industry-led, consensus-based metrics that may beAppendix J

ID
Category
153L4-1 Cybersecurity Policy andStrategy
153L4-1 Cybersecurity
Policy andStrategy
153L4-1 Cybersecurity
Policy andStrategy
111L4-2 Cybersecurity
Policy andStrategy
417L4-1 Legaland Regulatory
Frameworks
418L4-1 Legaland Regulatory
Frameworks
422L4-1 Legaland Regulatory
Frameworks
421L3-3 Legaland Regulatory
Frameworks
421L3-4 Legaland Regulatory
Frameworks
432L3-3 Legaland Regulatory
Frameworks Education,
311L3-4 Cybersecurity
Training andSkills511L3-3 Standards,
Organisations,andTechnologies Policy and
161L3-4 Cybersecurity
Strategy
161L4-2 Cybersecurity
Policy and
541L4-1 Strategy
Standards, Organisations, andTechnologies Policy and
123L3-2 Cybersecurity
Strategy
123L4-2 Cybersecurity
Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
161L4-2 Cybersecurity
Policy andStrategy
123L3-2 Cybersecurity
Policy and
123L4-2 Strategy
Cybersecurity Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
124L4-4 Cybersecurity
Policy andStrategy
161L4-2 Cybersecurity
Policy andStrategy
141L4-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
141L4-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
111L4-2 Cybersecurity
Policy andStrategy
153L4-1 Cybersecurity
Policy andStrategy
141L4-2 Cybersecurity
Policy andStrategy
153L4-2 Cybersecurity
Policy andStrategy
123L3-2 Cybersecurity
Policy andStrategy
124L3-5 Cybersecurity
Policy andStrategy
432L4-2 Legaland Regulatory
Frameworks Policy and
111L4-1 Cybersecurity
Strategy
113L4-1 Cybersecurity
Policy andStrategy
431L4-1 Legaland Regulatory
432L4-2 Frameworks
Legal and Regulatory
Frameworks Policy and
152L2-1 Cybersecurity
Strategy
153L3-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy
123L3-3 Cybersecurity
Policy andStrategy
132L2-2 Cybersecurity
Policy and
132L4-2 Strategy
Cybersecurity Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy
123L3-3 Cybersecurity
Policy andStrategy
132L2-2 Cybersecurity
Policy andStrategy
132L4-2 Cybersecurity
Policy andStrategy
132L2-2 Cybersecurity
Policy andStrategy Organisations, and
511L2-1 Standards,
Technologies
511L2-2 Standards,
Organisations, andTechnologies Policy and
123L3-3 Cybersecurity
Strategy
132L3-3 Cybersecurity
Policy andStrategy Organisations, and521L3-2 Standards,
Technologies
541L4-1 Standards,
Organisations, andTechnologies
222L3-2 Cyber
Culture and Society
222L3-3 Cyber Culture and Society
222L4-2 Cyber Culture and Society
211L3-1 Cyber Culture and Society
511L2-2 Standards, Organisations, andTechnologies
222L3-3 Cyber
Culture and Society
541L4-1 Standards, Organisations, andTechnologies
222L3-3 Cyber
Culture and Society
541L4-1 Standards, Organisations, andTechnologies Policy and
121L2-1 Cybersecurity
Strategy
121L3-1 Cybersecurity
Policy andStrategy
211L3-1 Cyber
Culture and Society
212L3-1 Cyber Culture and Society
511L2-2 Standards, Organisations, andTechnologies
511L2-3 Standards,
Organisations, andTechnologies
562L2-1 Standards,
Organisations, andTechnologies

Categorization / Classification
Subcategory
Capacity area
Cyber Defence
Coordination
Cyber Defence
Coordination
Cyber Defence
Coordination
National Cybersecurity
Strategy Development
Strategy
Legal
Framework
Substantive Cybercrime
Legislation Cybercrime
Legal Framework
Procedural
Legislation
Criminal Justice System
Prosecution
Criminal Justice System
Law Enforcement
Criminal Justice System
Law Enforcement
Formal and Informal
Informal Cooperation
CooperationRaising
Frameworks to
Awareness
Awareness Raising
Programmes
Adherence to Standards
ICT
Security Standards
Communications Redundancy Communications RedundancyCommunications Redundancy Communications Redundancy
Technical Security Controls
Technical Security Controls
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Communications Redundancy Communications Redundancy
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Incident Response
Mode of Operation
Communications Redundancy Communications Redundancy
Crisis Management
Crisis Management
Cyber Defence
Coordination
Crisis Management
Crisis Management
Cyber Defence
Coordination
National Cybersecurity
Strategy Development
Strategy
Cyber
Defence
Coordination
Crisis Management
Crisis Management
Cyber Defence
Coordination
Incident Response
Coordination
Incident Response
Mode of Operation
Formal and Informal
Informal Cooperation
Cooperation
Frameworks to
National
Cybersecurity
Strategy Development
Strategy Cybersecurity
National
Content
Strategyand Informal
FormalFormal Cooperation
Cooperation
Frameworks toFormal and Informal
Informal Cooperation
Cooperation
Frameworks to
Cyber
DefenceOrganisation
Cyber Defence
Coordination
Incident Response
Coordination
Incident Response
Coordination
Incident Response
Coordination
Critical Infrastructure (CI)
Organisation
Protection
Critical Infrastructure (CI)
Organisation
Protection
Incident
Response
Coordination
Incident Response
Coordination
Critical Infrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection
CriticalInfrastructure (CI)
Organisation
Protection to Standards
Adherence
ICT Security Standards
Adherence to Standards
ICT Security Standards
Incident Response
Coordination
Critical Infrastructure (CI)
Organisation
Protection
Internet
InfrastructureInternet Infrastructure
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Trust and Confidence on the User Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
Internet
Services
Trustand Confidence on the User
Trust in E-government
Internet
Services
Cybersecurity
Mind-set
Government
Adherence to Standards
ICT Security Standards
Trust and Confidence on the User Trust in E-government
Internet Security Controls
Services Security Controls
Technical
Technical
Trust and Confidence on the User Trust in E-government
Internet Security Controls
Services Security Controls
Technical
Technical
Incident Response
Identification of Incidents
Incident Response
Identification of Incidents
Cybersecurity Mind-set
Government
Cybersecurity Mind-set
Private Sector
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Cybersecurity Marketplace
Cyber Insurance

Level
4
4
4
4
4
4
4
3
3
3
3
3
3
4
4
3
4
3
4
4
3
4
3
4
4
4
4
4
4
4
4
4
4
3
3
4
4
4
4
4
2
3
4
4
3
2
4
4
3
2
4
2
2
2
3
3
3
4
3
3
4
3
2
3
4
3
4
2
3
3
3
2
2
2

Requirement (keyword)
Leading international debate about cyberdefence international debate about cyber
Leading
defence international debate about cyber
Leading
defence
Contributing
to international debate ofstrategyContributing
to international cybercrime
treaties
Contributing
to international cybercrime
treaties
Prosecutionof cross-border cybercrimes
Regular training for law enforcement officers
Cross-border investigation of cybercrimes
Joint international investigation & prosecution
Contribution to international awarenessraising
Contributing
to international standards
Contribution to international communications'
redundancy
Assistingneighbours
Continuous assess of technical security
controls
International
coordination
Regional coordination
International coordination
Regional coordination
Assisting neighbours
International coordination
Regional coordination
International coordination
Regional coordination
Assisting neighbours
National incident exercise contributing tointernationalsharedchallenges
Intelligencewith allies
National incident exercise contributing tointernationalsharedchallenges
Intelligencewith allies
Contributing to international debate ofstrategy international debate about cyber
Leading
defence incident exercise contributing to
National
internationalsharedchallenges
Intelligencewith allies
International coordination
International coordination
Adapted international cooperation
Continual revision of strategy
Continual revision of strategy
Regular review of international cooperation
Adapted international cooperation
Defined responsibility of cyber defence
organisation
Analyticalcapability in cyber defence
Coordinating all levels / sectors
Coordinating all levels / sectors
Information sharing across sectors
Formal & consistent information sharing
between
CI & government
Trust between
CI & government
Coordinating all levels / sectors
Information sharing across sectors
Formal & consistent information sharing
between
CI & government
Trust
between
CI & government
Formal & consistent information sharing
between CI standards& government
Established& best practices
Standards & best practices widely used
Information sharing across sectors
Supply chain management of CI
Investment to new technologies in internet
infrastructures
Continuous
assess of technical security
controls
Privacy-by-default
in e-gov
Most users can use e-gov securely
Data protection measures of e-gov
Mind-set spread in public sector
Standards & best practices widely used
Most users can use e-gov securely
Continuous assess of technical security
controls
Mostusers can use e-gov securely
Continuous assess of technical security
controlsregistry of incidents
CentralRegular revision of incident registryMind-set spread in public sector
Mind-set spread in private sector
Standards & best practices widely used
Metrics of adoption of standards & bestpractices cybersecurity insurance market
Established301

Appendix J
Ref.
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961

302

Approaches
NationU.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.

National #
1.4.2
1.4.2
1.4.3
1.4.3
1.4.4
1.4.4
1.4.5
1.5.1
1.5.1
1.5.1
1.5.2
1.5.2
1.5.3
1.5.3
2.1.1
2.1.1
2.1.1
2.1.2
2.1.2
2.1.3
2.1.4
2.1.4
2.1.4
2.2.1
2.2.1
2.2.2
2.2.2
2.2.2
2.2.2
3.1.1
3.1.1
3.1.1
3.1.2
3.1.2
3.1.3
3.1.3
3.1.3
3.1.3
3.1.3
3.2.1
3.2.1
3.2.1
4.1.1
4.1.1
4.1.2
4.1.2
4.1.3
4.1.3
4.1.3
4.1.4
4.1.4
4.1.5
4.1.6
4.1.7
4.1.7
4.1.7
4.1.7
4.1.7
4.1.8
4.1.8
4.1.8
5.1.1
5.1.1
5.1.1
5.1.1
5.1.1
5.1.1
5.2.1
5.2.1
5.2.1
5.2.2
5.2.2
5.2.2
5.3.1

SourceCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommision

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
All federal agencies should be required to use the Cybersecurity Framework.
All federal agencies should be required to use the Cybersecurity Framework.
Regulatory agencies should harmonize existing and future regulations with the Cybersecurity
Framework agencies
to focus onrisk harmonize
management—reducing
industry’s
cost ofwith
complying
with
Regulatory
shouldexisting and future
regulations
the Cybersecurity
Framework
to focuson riskmanagement—reducing
industry’s
cost thatof complying
withandThe
private sector
shoulddevelopconformity assessment
programs
are effective
efficient,
andsector
that support
the international
trade
and businessactivities
companies.
The
privateshould develop
conformity
assessment
programs
thatofareU.S.
effectiveandefficient,and thatshould
supportthe international
trade and tobusiness
activities
of U.S.
companies.
The
government
extendadditional incentives
companiesthat have
implemented
cyberNationalrisk management
engagement.
The
Institute ofprinciples
Standardsand
anddemonstrate
Technologycollaborative(NIST) should
expand its support ofSMBs
in usingInstitutethe Cybersecurity
Frameworkand should
assessits cost-effectiveness
The
Nationalof Standards
and Technology(NIST)
shouldexpand its support ofSMBs
in usingInstitutethe Cybersecurity
Frameworkand should
assessits cost-effectiveness
The
Nationalof Standards
and Technology(NIST)
shouldexpand its support of
SMBsandin using
Cybersecurity
Frameworkand should
assessits cost-effectiveness
DHS
NIST,thethroughthe National
Cybersecurity
Centerof Excellence(NCCoE), in
collaborationwiththe private
sector, should
developCenter
blueprints
for how to(NCCoE),
integrate andDHS
and NIST,
throughthe National
Cybersecurityof Excellencein usecollaboration withthe private
sector,should develop
blueprints
for how to integrate
Sector-specificagencies(SSAs)and industry
associations
and organizations
should and use
collaborate to develop
a programto review
pastpublic cyber
to identify
lessons
Sector-specificagencies(SSAs) andindustry
associations
andattacks
organizations
shouldcollaborate
developa programto review
publicattacks
to identify
To facilitatetothe
developmentof secureIoT past
devicesandcybersystems,
within60 dayslessons
thePresident
shouldissue an executive
order
directingto work withinwith industry
Tofacilitate
the developmentof secure
IoT
devicesNISTand systems,
60 daysandthe
President
shouldissue an executive
order
directingto work withinwith industry
Tofacilitate
the developmentof secure
IoT
devicesNISTand systems,
60 daysandthe
President should
issue
an executive
order directing
to work withindustry
Regulatory
agenciesshouldassess whether
effectiveNIST
cybersecurity
practicesandandtechnologiesagencies
that are should
identified
by thestandards
processin Action Item
2.1.1andare being
Regulatory
assesswhether
effective
cybersecurity
practices
technologies
thatofareJusticeidentified
by leadthe standards
processin Action
Item
2.1.1 are being
The
Department
shouldan interagency
studywith theDepartmentsofCommerce
andControl
Homeland
Security
andEmergency
work with Response
the FederalTeam
Trade
Commission,
theThe
Industrial
Systems
Cyber(ICS-CERT)
shoulddevelopand communicate
guidelines
IoT cybersecurity
privacy
best practices
The Industrial
Control Systems
Cyberfor
Emergency
ResponseandTeam(ICS-CERT)
shouldfor
developand communicate
guidelines
IoT cybersecurity
privacy
best practices
The
Industrial
Control Systems
Cyberfor
Emergency
ResponseandTeam(ICS-CERT)
shouldfor
developand communicate
cybersecurity
andprivacyshould
best practices
The
Directorof the Office guidelinesof Science for
andIoT
Technology
Policy(OSTP)
lead the fordevelopment
government–private-sector
cybersecurity
roadmap
The
Director of an
theintegrated
Office of Scienceand Technology Policy(OSTP) should
leadforthedevelopmentof an integrated
government–private-sector
cybersecurity
roadmap
for
The
U.S. government
should support
cybersecurity-focusedresearch into
traditionally
underfundedareas, including
human factors
and usability, policy,
law,into
metrics,
and the social
The
U.S. government
should support
cybersecurity-focusedresearchtraditionally
underfundedareas, including
human factors
and usability, policy,
law,into
metrics,
and the social
The
U.S. government
should support
cybersecurity-focusedresearchtraditionally
underfundedareas, including
human factors
and usability, policy,
law,into
metrics,
and the social
The
U.S. government
should support
cybersecurity-focusedresearchtraditionally
underfundedareas, including
humandecisions,factors andpolicy,law, metrics,
anddevelop
the social
To
improve consumers’purchasing
anusability,
independent
organization
shouldthe improve
equivalentof a cybersecurity“nutritional
for technology
productsshould
and services—To
consumers’purchasing
decisions,label”
an independent
organization
developthe improve
equivalentof a cybersecurity“nutritional
for technology
productsshould
and services—To
consumers’purchasing
decisions,label”
an independent
organization
developthe equivalenta cybersecurity“nutritionallabel” forproducts
services—
Withinthe firstof100
days of the new
Administration,thetechnology
White Houseshouldand
conveneasummit theof business,
education,and government
leaders
at alllevelsconvene
to plan for
Withinfirst 100 daysof the consumer,
new Administration,
the WhiteHouseshoulda thesummitbusiness,
education,
consumer,and government
leaders
at all levels
for theThe
FTCofshould
conveneconsumerorganizations
and industry
stakeholders
in toanplaninitiative
to develop
a standard
templatefor documentsthat andinformconsumersof theirincybersecurity
The
FTC should
conveneconsumerorganizationsindustry
stakeholders
an initiative
to develop
a standard
templatefor documentsthat andinformconsumersof theirincybersecurity
The
FTC should
conveneconsumerorganizationsindustry
stakeholders
an initiative
to develop
a standard
templatefor documentsthat andinformconsumersof theirincybersecurity
The
FTC should
conveneconsumerorganizationsindustry
stakeholders
an initiative
to develop
a standard
templatefor documentsthat andinformconsumersof theirincybersecurity
The
FTC should
conveneconsumerorganizationsindustry
stakeholders
an initiativetoa standard templatefor documents
informresearch
consumersof theirbehavior
cybersecurity
Thedevelop
next Administration
and Congressshould thatprioritize
on humanandcybersecurity,
on the basisofCongressthe 2016 should
Federalprioritize
Cybersecurity
Researchand behavior
Development
The
next Administration
andresearchon humanandcybersecurity,
on the basisofCongressthe 2016 should
Federalprioritize
Cybersecurity
Researchand behavior
Development
The
next Administration
andresearchon humanandcybersecurity,
on thebasisinitiateof the 2016
FederalCybersecurity
Researchand Development
The
next President
shoulda national
cybersecurity
workforceprogramto train
100,000
cybersecurity
practitioners
by 2020.
The
next newPresident
should initiate
a national
cybersecurity workforce program to train
100,000
cybersecurity
practitioners
by 2020.
The
next newPresident
should initiate
a national
cybersecurity apprenticeship program to train
50,000cybersecurityby 2020.
The
nextnew
President
should practitioners
initiate a national
cybersecurity apprenticeship program to train
50,000new
cybersecurity
2020.
To better
preparestudents practitioners
as individualsbyandfuture employees, federal programs supporting
educationat all levels
shouldcybersecurity
awarenessfor students
as supporting
they areTo
better prepare
students
as incorporate
individuals andfuture employees,
federalprograms
educationat all levels
shouldcybersecurity
awarenessfor students
as supporting
they areTo
better prepare
students
as incorporate
individuals andfuture employees,
federalprograms
education
all levels shouldincorporateawarenessfor students
as theyareThe
federalatgovernment
shoulddevelop a cybersecurity
mandatory training
programto introduce
managers
and executives
to cybersecurity
risk management
topics—even
if their torole
is not focusedonThefederal government
should develop
a mandatory
training program
introduce
managers
and executives
to cybersecurity
risk management
their role is not
focusedonThefederal government,
SLTT governments,
and topics—even
private-sectoriforganizations
shouldcreatean exchange
aimed
at increasing
the cybersecurity
experienceand capabilities
ofThe
Office ofprogram
Personnel
Management(OPM)
should establish
a Presidential
Cybersecurity
Fellowsthe
programforScience
federal Foundation
civilian agencies
goal ofSecurity
bringingAgency
on 200(NSA),
cybersecurity
NIST,
National(NSF),withthe theNational
and theDepartmentof Education
shouldwork withprivate-sector
organizations,
universities,
NIST,
the National
ScienceFoundation(NSF),
the National
Security Agency(NSA), and theDepartmentof Education
shouldwork withprivate-sector
organizations,
universities,
NIST,
the National
ScienceFoundation(NSF),
the National
Security Agency(NSA), and theDepartmentof Education
shouldwork withprivate-sector
organizations,
universities,
NIST,
the National
ScienceFoundation(NSF),
the National
Security Agency(NSA), and theDepartmentof Education
shouldwork withprivate-sector
organizations,
universities,
NIST,
the National
ScienceFoundation(NSF),
the National
Security Agency(NSA), and theDepartmentof Education
should toworkwithcybersecurity
private-sectordegreeorganizations,andIn
order to attract
more students
pursueprogramsuniversities,
and enter the
cybersecurity
workforcein both the
public cybersecurity
and private sectors,
be theofferedInorder to attract
more students
to pursue
degreeincentives
programs should
and entercybersecurity
workforcein both the
public cybersecurity
and private sectors,
be theofferedInorder to attract
more students
to pursue
degreeincentives
programs should
and entercybersecurity
workforcein establish
both the public
and private
sectors,all
incentives
should benetwork
offeredThe
Administration
shoulda programto consolidate
civilian agencies’
connections(as wellshould
as thoseof appropriate
government
contractors)
intoagencies’a single network
The
Administration
establish
a programto consolidate
all civilian
connections(as wellshould
as thoseof appropriate
government
contractors)
intoagencies’a single network
The
Administration
establish
a programto consolidate
all civilian
connections(as wellshould
as thoseof appropriate
government
contractors)
intoagencies’a single network
The
Administration
establish
a programto consolidate
all civilian
connections(as wellshould
as thoseof appropriate
government
contractors)
intoagencies’a single network
The
Administration
establish
a programto consolidate
all civilian
connections(as wellshould
as thoseof appropriate
government
contractors)
intoagencies’a single network
The
Administration
establish
a programto consolidate
all civilian
connections(as wellshould
as thoseof appropriate
government
contractors)
intoTechnology
a single
The
Administration
expandon the recently
proposed
Information
Modernization
Fundshould(ITMF)
to enable
agenciesto proposedfund technology
investmentsby spreading
The
Administration
expandon therecently
Information
Technology
Modernization
Fundshould(ITMF)
to enable
agenciesto proposedfund technology
investmentsby spreading
The
Administration
expandon therecently
Information
Technology
Modernization
Fund (ITMF)
to enable(GSA)
agencies
to fundinvestmentstechnology
by spreading
The
General Services
Administration
shouldleadtechnology
efforts on integrating
more
effectively
into government
operations,workingwith
Congressto reformtechnology
federalThe General
Services
Administration(GSA) should
leadefforts
on integrating
moreGeneraleffectively
into government
operations,workingwith
Congressto reformtechnology
federalThe
Services
Administration(GSA) should
leadefforts
on integrating
moreOfficeeffectively
into government
operations,working
Congressreform federal
Theof Management
and Budget(OMB)
shouldwith
requirefederaltoagencies
to use the
Cybersecurity Framework for any cybersecurity-related reporting, oversight, and policy

Appendix J

ID
Category
511L2-2 Standards, Organisations, andTechnologies
511L2-3 Standards,
Organisations, andTechnologies
411L3-1 Legaland Regulatory
Frameworks
411L4-1 Legaland Regulatory
FrameworksOrganisations, and
511L2-5 Standards,
Technologies
561L4-2 Standards,
Organisations, andTechnologies
212L3-1 Cyber
Culture and Society
212L3-1 Cyber Culture and Society
511L2-2 Standards, Organisations, andTechnologies
511L3-1 Standards,
Organisations, andTechnologies
511L4-1 Standards,
Organisations, andTechnologies
511L4-3 Standards,
Organisations, andTechnologies
511L4-1 Standards,
Organisations, andTechnologies
511L4-3 Standards,
Organisations, and
511L2-5 Technologies
Standards, Organisations, andTechnologies
511L3-3 Standards,
Organisations, andTechnologies
511L4-1 Standards,
Organisations, andTechnologies
511L2-3 Standards,
Organisations, andTechnologies
511L2-4 Standards,
Organisations, andTechnologies
411L3-1 Legaland Regulatory
FrameworksOrganisations, and
511L2-1 Standards,
511L2-2 Technologies
Standards, Organisations, andTechnologies
511L2-4 Standards,
Organisations, andTechnologies
521L4-1 Standards,
Organisations, andTechnologies
541L4-1 Standards,
Organisations, andTechnologies Education,
321L2-5 Cybersecurity
Training
Skills411L3-1 Legal
andandRegulatory
FrameworksOrganisations, and
521L4-1 Standards,
Technologies
541L4-1 Standards,
Organisations, andTechnologies
213L4-1 Cyber
Culture and Society
223L3-2 Cyber Culture and Society
223L4-1 Cyber Culture and Society
311L2-1 Cybersecurity Education,
Training and Skills
311L2-2 Cybersecurity
Education,
Training
and Skills
213L3-1 Cyber
Cultureand Society
213L4-1 Cyber Culture and Society
221L4-1 Cyber Culture and Society
412L4-3 Legal and Regulatory
Frameworks
412L4-4 Legaland Regulatory
321L2-5 Frameworks
Cybersecurity Education,
Training andSkills541L3-1 Standards,
Organisations,andTechnologies
541L4-1 Standards,
Organisations, andTechnologies Education,
331L3-2 Cybersecurity
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
331L3-2 Cybersecurity
Education,
Training and Skills
331L4-3 Cybersecurity
Education,and Skills
213L3-1 Training
Cyber Culture
and Society
251L2-3 Cyber Culture and Society
321L3-5 Cybersecurity Education,
Training and Skills
311L2-1 Cybersecurity
Education,
Training and Skills
312L3-4 Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
331L4-1 Cybersecurity
Education,
Training and Skills
321L2-5 Cybersecurity
Education,
Training and Skills
321L3-4 Cybersecurity
Education,
Training and Skills
321L4-1 Cybersecurity
Education,
Training and Skills
322L4-1 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
321L3-3 Cybersecurity
Education,
Training and Skills
322L4-2 Cybersecurity
Education,
Training and Skills
331L4-3 Cybersecurity
Education,
Training and Skills
122L3-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy Organisations, and
521L4-1 Standards,
Technologies
521L4-2 Standards,
Organisations, andTechnologies
521L4-3 Standards,
Organisations, andTechnologies
541L4-1 Standards,
Organisations, andTechnologies
521L4-2 Standards,
Organisations, andTechnologies
521L4-3 Standards,
Organisations, andTechnologies
521L4-4 Standards,
Organisations, andTechnologies
512L3-1 Standards,
Organisations, and
512L3-2 Technologies
Standards, Organisations, andTechnologies
512L3-3 Standards,
Organisations, andTechnologies
511L2-3 Standards,
Organisations, andTechnologies

Categorization / Classification
Subcategory
Capacity area
Level
Requirement (keyword)
Adherence to Standards
ICT Security Standards
Standards & best practices widely used2
Adherence to Standards
ICT Security Standards
Metrics of adoption of standards & best2
practicesreview of cybersecurity legal
Legal Framework
Legislative Framework forRegular3
ICT Security
framework
Legal Framework
Legislative
Framework for
Balancebetween cybersecurity legal
4framework& best practices
Adherence to Standards
ICT Security Standards
Metricsof complianceof standards & best2
practices superior security products
Cybersecurity Marketplace
Cybersecurity Technologies
Exporting4
Cybersecurity Mind-set
Private Sector
Mind-set spread in private sector
3
Cybersecurity Mind-set
Private Sector
Mind-set spread in private sector
3
Adherence to Standards
ICT Security Standards
Standards & best practices widely used2
Adherence to Standards
ICT Security Standards
Risk-based adoption of standards & best3
practicesreview of adoption of standards &Adherence to Standards
ICT Security Standards
Regular4
best practices
Adherence to Standards
ICT Security Standards
Risk-based
decision making of compliance
4Adherence to Standards
ICT Security Standards
Regular review of adoption of standards &4
best practices
Adherence to Standards
ICT Security Standards
Risk-based
decision making of compliance
4Adherence to Standards
ICT Security Standards
Metrics of compliance of standards & best2
practices
Adherence to Standards
ICT Security Standards
Contributing
to international standards
3
Adherence to Standards
ICT Security Standards
Regular review of adoption of standards &4
best practices
Adherence to Standards
ICT Security Standards
Metricsof adoption of standards & best2
practices of use of standards & best
Adherence to Standards
ICT Security Standards
Promotion2
practicesreview of cybersecurity legal
Legal Framework
Legislative Framework forRegular3
framework standards & best practices
Adherence to Standards
ICT Security Standards
Established2
Adherence to Standards
ICT Security Standards
Standards & best practices widely used2
Adherence to Standards
ICT Security Standards
Promotion of use of standards & best2
practices acquisition of infrastructures
Internet InfrastructureInternet Infrastructure
Controlled
4
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Continuous assess of technical security
4
controls & development in cybersecurity
Framework for Education
Provision
Research2
promotedreview of cybersecurity legal
Legal Framework
Legislative Framework forRegular3
ICT Security
framework acquisition of infrastructures
Internet InfrastructureInternet
Infrastructure
Controlled
4
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Continuous assess of technical security
4
controlsmind-set reducing threat
Cybersecurity Mind-set
Users
Users'
4
Trust and Confidence on the User Trust in E-commerce
Most users can use e-commerce securely
3
Internet
Services
Trustand Confidence on the User
Trust in E-commerceContinuous improvement of e-commerce
4
Internet
Services Raising
Awareness
Raising
Awareness
National programme of awareness raising2
ProgrammesRaising
Awareness Raising
Awareness
Consultation with stakeholders in national
2
Programmes
programmeof awareness
Cybersecurity Mind-set
Users
Most
users havemind-set raising
3
Cybersecurity Mind-set
Users
Users' mind-set reducing threat
4
Trust and Confidence on the User Trust and Confidence on
Users can evaluate risk & adjust behaviour
4Internet
the Internet
Legal
Framework
Privacy,
Freedom of Speech &Contributing to international digital human
4
Other Human
RightsOnline &rightsLegal Framework
Privacy,
Freedomof Speech
Contributing
to international privacy
4
Other
Human Rights Online
protection
Framework for Education
Provision
Research &online
development in cybersecurity
2
promoted
Technical Security Controls
Technical Security Controls
Userside security controls
3Technical Security Controls
Technical Security Controls
Continuous assess of technical security
4
controls
Framework for Professional
Provision
Cybersecurity
training aligned with national
3
Training for Professional
strategy
Framework
Provision
Collaboration
between public & private in4
Training for Professional
cybersecurity training
Framework
Provision
Cybersecurity
training aligned with national
3
Training for Professional
strategy for cybersecurity trained workforce
Framework
Provision
Incentives
4
Training
Cybersecurity Mind-set
Users
Most users have mind-set
3Media and Social MediaMedia and Social Media
Broad discussion on social media security
2
Framework for Education
Provision
Cybersecurity education from primary to post3
graduate programme of awareness raising
Awareness Raising
Awareness Raising
National
2
Programmes
Awareness Raising
Executive
Awareness Raising
Mandatory cybersecurity education for3
executives
Framework for Professional
Provision
Collaboration
between public & private in4
Training for Professional
cybersecurity training
Framework
Provision
Collaboration
between public & private in4
Training for Education
cybersecurity
training
Framework
Provision
Research& development
in cybersecurity
2
promoted
Framework for Education
Provision
Cybersecurity
as focusing area
3
Framework for Education
Provision
Internationally forerunning in cybersecurity
4
education CoE in cybersecurity
Framework for Education
Administration
International
4
Framework for Education
Administration
Cooperation between all stakeholders in4cybersecurity education
Framework for Education
Provision
Cybersecurity
specific degree
3
Framework for Education
Administration
Cooperation between all stakeholders in4cybersecurity
Framework for Professional
Provision
Incentives
for education
cybersecurity trained workforce
4
Training Response
Incident
Organisation
Formal roles & responsibilities allocated3
Incident Response
Coordination
Coordinating all levels / sectors
4Internet InfrastructureInternet Infrastructure
Controlled acquisition of infrastructures
4
Resilience
Resilience
Internet
InfrastructureInternet
Infrastructure
Optimised cost for internet infrastructures
4
Resilience
Resilience
Internet
InfrastructureInternet
Infrastructure
Controlled acquisition of critical technologies
4
ResilienceSecurity Controls
ResilienceSecurity Controls
Technical
Technical
Continuous assess of technical security
4
controls cost for internet infrastructures
Internet InfrastructureInternet Infrastructure
Optimised
4
Resilience
Resilience
Internet
InfrastructureInternet
Infrastructure
Controlled acquisition of critical technologies
4
Resilience
Resilience
Internet
InfrastructureInternet
Infrastructure
Independency & persistence of internet
4
Resilience to Standards
Resilience in Procurement
infrastructuretechnologies
Adherence
Standards
Standards& bestpractices for procurement
3
widely& complied
Adherence to Standards
Standards in Procurement
Regularused
reviewof procurement
3
Adherence to Standards
Standards in Procurement
Wider resource planning in procurement
3
Adherence to Standards
ICT Security Standards
Metrics of adoption of standards & best2
practices303

Appendix J
Ref.
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995

304

Approaches
NationU.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.
U.S.A.

National #
5.3.2
5.3.3
5.3.3
5.3.3
5.4.1
5.4.1
5.4.2
5.4.2
5.5.1
5.5.1
5.5.2
5.5.2
5.5.3
5.5.3
6.1.1
6.1.1
6.1.1
6.1.1
6.1.2
6.1.3
6.1.3
6.1.4
6.1.4
6.1.4
6.1.4
6.1.4
6.1.4
6.1.5
6.1.5
6.1.6
6.1.6
6.1.6
6.1.6
6.1.6

SourceCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommisionCommision

Year
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016
2016

Action Item
In the first 100 days of the Administration, OMB should work with NIST and DHS to clarify
agencyshould
and OMBresponsibilities
under
the Federal
Information
Security
Modernization
Act
OMB
integrate
cybersecurity
metrics
with agency
performance
metrics,
review these
metricsshould
biannually,
andcybersecurity
integrate metrics
and with
associatedthe annual
OMB
integrate
metrics
agencyperformance
performancewith
metrics,
reviewbudgetthese
metricsshould
biannually,
andcybersecurity
integrate metrics
and with
associatedthe annual
OMB
integrate
metrics
agencyperformance
performancewith
metrics,
reviewbudgetthese
metrics
biannually,
andintegrate
andanassociatedwithfortheCybersecurity,
annual budget
The
President
shouldappoint
andmetrics
empower
Assistant performanceto the President
reportingthrough
the appoint
Nationaland
Security
Advisor,to lead national
cybersecurity
policy andThe
President
shouldempoweran Assistantto the President
for Cybersecurity,
reportingthrough theshould
National
Security
Advisor,to leadnational cybersecurity
policyChief
andThe
Administration
clarify
OMB’srole—andspecifically,that of the Federal
Information
Officer should(CIO), clarify
the Federal
Chief
Information
Securitythat
Officer(CISO),
theThe
Administration
OMB’srole—andspecifically,of theFederaland
Chief
Information
Officer
FederalCybersecurity
Chief Information
Security
Officer(CISO),and ofthehisThe
President
should(CIO),
issue athe
National
Strategy
withinthe first
180 days
Administration.
The
President should issue a National Cybersecurity Strategy within the first 180 days of his
Administration.
Congressshould consolidate cybersecurity and infrastructure protection functions under theoversight ofa singlefederal agency,
and ensure
this agency has
the appropriate
capabilities
Congressshouldconsolidate
cybersecurity
and infrastructure
protection
functions
under theoversightof a single
federalagency,consider
and ensure
this agency
haslegislative
the appropriate
capabilities
The
governors
in eachstate should
seeking
necessary
authority
andresources
to trainand equip
the NationalGuard
to serve
as partlegislativeof the nation’s
cybersecurityThegovernors
in eachstate should
considerseeking
necessary
authority
andresources
train
and
equip
National
Guard to serveas part of should
the nation’s
cybersecurity
Within thetofirst180
daysof the next
Administration,
the President
appointan
Ambassador
for180Cybersecurity
lead
U.S. engagement
the international
communityonWithinthe firstdays of the tonext
Administration,
the with
President
should appointan
Ambassador
for180Cybersecurity
lead
U.S. engagement
the international
communityonWithinthe firstdays of the tonext
Administration,
the with
President
should appointan
Ambassador
for180Cybersecurity
lead
U.S. engagement
the international
communityonWithinthe firstdays of the tonext
Administration,
the with
President
should appointan
Ambassador
for Cybersecurity
lead U.S.
engagement inwithinternational
community
The
federal government
should toincrease
its engagement
thetheinternational
standards
arenaonto garnerconsensus
fromshould
other nations
anditspromotethelike-minded
use of sound,harmonizedThe
Departmentof State
continuework withnations
to promote
peacetime
cybersecurity
behavior.
The
Departmentof State norms
shouldofcontinue
its work with like-minded nations to promote
peacetime
cybersecurityof behavior.
Congress should
providenorms
sufficient
resources to the Department of Justice (DOJ) to fully
staff and modernize
the Mutual
Legal
Assistance
Treaty(MLAT)ofprocess,includinghiringCongressshould provide
sufficient
resources
to theDepartment
Justice (DOJ)
to fully
staff and modernize
the Mutual
Legal
Assistance
Treaty(MLAT)ofprocess,includinghiringCongressshould provide
sufficient
resources
to theDepartment
Justice (DOJ)
to fully
staff and modernize
the Mutual
Legal
Assistance
Treaty(MLAT)ofprocess,includinghiringCongressshould provide
sufficient
resources
to theDepartment
Justice (DOJ)
to fully
staff and modernize
the Mutual
Legal
Assistance
Treaty(MLAT)ofprocess,includinghiringCongressshould provide
sufficient
resources
to theDepartment
Justice (DOJ)
to fully
staff and modernize
the Mutual
Legal
Assistance
Treaty(MLAT)ofprocess,includinghiringCongressshould provide
sufficient
resources
to theDepartment
Justice (DOJ)
to fully
staff andthe Mutual
Legal
Assistance
Treaty(MLAT)
process,
includinghiringNIST
andmodernize
the Departmentof Stateshouldproactively
seekinternational
partners
to extend
the Cybersecurity
Framework’s
approachrisk management
to a broader
international
NIST
and the Departmentof Stateshould toproactively
seek international
partners
to extend
the Cybersecurity
approachrisk management
to a broader
The
Department ofFramework’s
State, DHS, andother toagenciesshould continue
to assistinternationalcountries withcybersecurity
capacitybuilding
lightof growing
recent todevelopments.
The
Departmentof State,
DHS, inand
otheragencies needs
shouldand
continueassist countries withcybersecurity
capacitybuilding
lightof growing
recent todevelopments.
The
Departmentof State,
DHS, inand
otheragencies needs
shouldand
continueassist countries withcybersecurity
capacitybuilding
lightof growing
recent todevelopments.
The
Departmentof State,
DHS, inand
otheragencies needs
shouldand
continueassist countries withcybersecurity
capacitybuilding
lightof growing
recent todevelopments.
The
Departmentof State,
DHS, inand
otheragencies needs
shouldand
continueassist countries withcybersecurity capacity building in light of growing needs and recent developments.

Appendix J

ID
Category
112L4-1 Cybersecurity Policy andStrategy Organisations, and
511L2-3 Standards,
Technologies
511L2-5 Standards,
Organisations, andTechnologies
511L3-2 Standards,
Organisations, andTechnologies Policy and
123L4-1 Cybersecurity
Strategy
152L3-1 Cybersecurity
Policy andStrategy
122L3-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy
111L4-1 Cybersecurity
Policy andStrategy
113L4-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy andStrategy
151L3-3 Cybersecurity
Policy andStrategy
123L3-1 Cybersecurity
Policy andStrategy
123L4-1 Cybersecurity
Policy and
111L4-2 Strategy
Cybersecurity Policy andStrategy
113L4-2 Cybersecurity
Policy andStrategy
153L4-1 Cybersecurity
Policy andStrategy Organisations, and
511L3-3 Standards,
Technologies
511L3-3 Standards,
Organisations, andTechnologies Policy and
153L4-1 Cybersecurity
Strategy
311L3-4 Cybersecurity
Education,
Skills411L4-2 Training
Legal andand
Regulatory
Frameworks
417L4-1 Legaland Regulatory
Frameworks
418L4-1 Legaland Regulatory
Frameworks
431L4-1 Legaland Regulatory
Frameworks
432L4-2 Legaland Regulatory
Frameworks
422L4-1 Legaland Regulatory
Frameworks Education,
311L3-4 Cybersecurity
Training andSkills511L3-3 Standards,
Organisations,andTechnologies Policy and
113L4-2 Cybersecurity
Strategy
161L4-2 Cybersecurity
Policy andStrategy
411L4-4 Legaland Regulatory
Frameworks
432L4-4 Legaland Regulatory
FrameworksOrganisations, and
561L4-2 Standards,
Technologies

Categorization / Classification
Subcategory
Capacity area
National Cybersecurity
Organisation
Strategy to Standards
Adherence
ICT Security Standards
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Incident Response
Coordination
Cyber Defence
Organisation
Incident Response
Organisation
Incident Response
Coordination
National Cybersecurity
Strategy Development
Strategy Cybersecurity
National
Content
Strategy Response
Incident
Coordination
Cyber Defence
Strategy
Incident Response
Coordination
Incident Response
Coordination
National Cybersecurity
Strategy Development
Strategy Cybersecurity
National
Content
Strategy
Cyber
Defence
Coordination
Adherence to Standards
ICT Security Standards
Adherence to Standards
ICT Security Standards
Cyber Defence
Coordination
Awareness Raising
Awareness Raising
Programmes
Legal Framework
Legislative Framework for
ICT SecurityCybercrime
Legal Framework
Substantive
Legislation Cybercrime
Legal Framework
Procedural
Legislation
Formal and Informal
FormalCooperation
Cooperation
Frameworks toFormaland Informal
Informal Cooperation
Cooperation
Frameworks
Criminal
Justice
System to
Prosecution
Awareness Raising
Awareness Raising
Programmes
Adherence to Standards
ICT
Security Standards
National Cybersecurity
Content
Strategy
Communications
Redundancy Communications Redundancy
Legal Framework
Legislative Framework for
ICT Security
Formal and Informal
InformalCooperation
Cooperation Frameworks
Cybersecurity
Marketplaceto
Cybersecurity Technologies

Level
4
2
2
3
4
3
3
4
4
4
4
3
3
4
4
4
4
3
3
4
3
4
4
4
4
4
4
3
3
4
4
4
4
4

Requirement (keyword)
Reassignment & reallocation of resources forcybersecurity
programme
Metricsof adoptionof standards & bestpracticesof compliance of standards & best
Metrics
practices allocation based on standards
Resource
Coordinating all levels / sectors
Advanced capabilities & situationalawareness
Formalroles & responsibilities allocated
Coordinating all levels / sectors
Continual revision of strategy
Continual revision of strategy
Coordinating all levels / sectors
Cyber defence strategy meets objectives
Subnational / sectorial incident responseorganisations all levels / sectors
Coordinating
Contributing to international debate ofstrategyContributing
to international cooperation
Leading international debate about cyberdefence
Contributing
to international standards
Contributing to international standards
Leading international debate about cyberdefence
Contribution
to international awarenessraising
Participation to international cooperationagreements to international cybercrime
Contributing
treaties
Contributing
to international cybercrime
treaties review of international cooperation
Regular
Adapted international cooperation
Prosecution of cross-border cybercrimes
Contribution to international awarenessraising
Contributing
to international standards
Contributing to international cooperation
Assisting neighbours
International and/or regional cooperation of
establishing legislative
framework
International
and/or regional
cooperation of
establishing
cybercrime
legislation
Exportingsuperior
security
products

305