National Cybersecurity Index

[Vienna Eliot]

Vienna Consulting presents:
The National Cybersecurity Index
Excellent formatting inspired by Merconitonitopia's Happiness Index.

In an increasingly globalized world, cybersecurity — the integrity of your nation's Internet, computer systems, and electronic data — is now more important than ever. What was at one point an afterthought for many sovereign states today has major implications for quality of life, free and fair elections, and even national security.

Consider this: how many of your citizens are having their information sold without their consent? What would happen to your nation if the power grid were knocked out in an untraceable terrorist attack? And particularly relevant to democracies — what if a hacker, a disgruntled political party, or even a foreign government disrupted, and possibly influenced, your elections?

That's why our cybersecurity team at Vienna Consulting have developed an index with a secure methodology to analyze the security of your nation's information technology. All you have to do is implement a simple contract between your government and our firm, and we'll produce a full report on the state of cybersecurity in your jurisdiction. That's responsible leadership, and that's what we strive for.

There are no hidden costs associated with this index — we'll disclose everything. For starters, here's the short, safe, and simple law for you to implement that will give us access to the information we need to evaluate your national cybersecurity, while at the same time protecting your country's privacy and right to secure information.

---

Internet Data Information Availability Act

A regulation promulgating Title IX, §16(b) of the National Code.

---

Section 1: Contract; Parties Named.

The executive branch shall contract with Vienna Consulting of the Commonwealth of Aurentina for the purposes of indexing and reporting on national cybersecurity.

Section 2: Access to Internet Data

Both parties shall be granted access to user data within the national jurisdiction, including identity, demographics, interests, affiliations, location, browsing data, financial data and transactions, and search history. Internet Service Providers shall be obliged to cooperate in making data accessible to both parties for the purposes of indexing and reporting.

Section 3: Access to Financial Data

Both parties shall be granted access to financial data of banking clients within the national jurisdiction, including identity, employment, financial activities and transactions, net worth, assets, liabilities, relationships, credit rating, and other non-confidential information. Financial institutions shall be obliged to cooperate in making data accessible to both parties for the purposes of indexing and reporting.

Section 4: Confidentiality

This contract shall be confidential for up to twelve years, after which it shall either be renewed or all records of data collected shall be destroyed.

Section 5: Effective

This contract shall be effective immediately and shall cease to be effective upon termination at the end of a twelve year period if not renewed.

Survey
Once you've ordered the promulgation of our contract, just help us access the following data.

Code: Select all

[b]Name of nation:[/b]
[b]Population:[/b]

[size=150]1. Legal measures[/size]
[b]Do you have substantive law on...[/b]
[i]Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.[/i]
[ ] unauthorized access of computers, systems and data?
[ ] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[ ] data and privacy protection?

[b]Do you have procedural law on...[/b]
[i]Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.[/i]
[ ] articles on expedited preservation of stored computer data?
[ ] production orders?
[ ] search and seizure of stored computer data?
[ ] real-time collection of computer data?
[ ] extradition of cyber perpetrators?
[ ] mutual assistance?
[ ] confidentiality and limitation of use?

[b]Is there any cybersecurity regulation related to...[/b]
[i]Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.[/i]
[ ] data protection?
[ ] breach notification?
[ ] cybersecurity audit requirements and cybersecurity certification/standardization
[ ] privacy protection,
[ ] digital signatures and e-transactions?
[ ] liability of Internet service providers?
[ ] system and network protection?

[b]Is there a legislation or regulation related to the containment or curbing of spam?[/b]
[i]This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.[/i]
[ ] Yes
[ ] No

[size=150]2. Technical measures[/size]
[b]Does your nation have a CIRT, CSIRT or CERT?[/b]
[i]A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.[/i]
[ ] Yes, a national CIRT, CSIRT or CERT
[ ] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

[b]Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?[/b]
[i]A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?[/i]
[ ] Yes
[ ] No
[ ] Not Applicable

[b]Is there any framework for the implementation of cybersecurity standards?[/b]
[i]Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.[/i]
[ ] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

[b]Do you have a standardization body within the country that...[/b]
[ ] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

[b]Are there any technical mechanisms and capabilities deployed to address spam?[/b]
[i]Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?[/i]
[ ] Yes
[ ] No

[b]Does your government use the cloud for cybersecurity in the public sector?[/b]
[i]A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.[/i]
[ ] Yes
[ ] No

[size=150]3. Organizational measures[/size]
[b]Is there a national strategy for cybersecurity?[/b]
[i]Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.[/i]
[ ] Yes
[ ] No

[b]Is your national strategy...[/b]
[ ] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

[b]Does it address...[/b]
[ ] the private sector?
[ ] the public sector?
[ ] Not Applicable

[b]Is there a section on...[/b]
[i]A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.[/i]
[ ] the protection of critical information infrastructure?
[ ] a national resiliency plan?

[b]Is there a clear action plan for government implementation on cybersecurity governance?[/b]
[i]The strategy includes a roadmap with milestones for the achievement and completion of the strategy.[/i]
[ ] Yes
[ ] No

[b]Is the strategy...[/b]
[i]The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.[/i]
[ ] revised on a continuous basis?
[ ] open to public consultation?

[b]Is there a national body or agency responsible for...[/b]
[ ] cybersecurity and critical information infrastructure protection?
[ ] initiatives in combating spam related issues?

[b]Are there any metrics used to measure cybersecurity development at a national level?[/b]
[i]Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.[/i]
[ ] Yes
[ ] No

[b]Are cybersecurity risk assessments performed periodically?[b]
[i]A systematic process comprising risk identification, risk analysis and risk evaluation.[/i]
[ ] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?[/b]
[ ] Yes
[ ] No

[b]Are general cybersecurity audits performed?[/b]
[i]A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.[/i]
[ ] Yes
[ ] No

[size=150]4. Capacity Building Activities[/size]
[b]Are public awareness campaigns in cybersecurity developed and implemented?[/b]
[i]Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.[/i]
[ ] Yes
[ ] No

[b]Do public awareness campaigns target...[/b]
[ ] organizations?
[ ] civil society?
[ ] adults?
[ ] youth & children?
[ ] other related bodies?
[ ] Not Applicable

[b]Is there a framework for the certification and accreditation of cybersecurity professionals?[/b]
[i]Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.[/i]
[ ] In the public sector
[ ] In the private sector
[ ] No

[b]Does your government develop or support any professional training courses in cybersecurity...[/b]
[i]Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.[/i]
[ ] for law enforcement (police officers and enforcement agents)?
[ ] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[ ] for organizations?
[ ] for the public sector?
[ ] for civil society?

[b]Does your government develop or support any educational programs or academic curricula in cybersecurity?[/b]
[i]Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.[/i]
[ ] In primary school
[ ] In secondary school
[ ] In higher education
[ ] No

[b]Is there investment in cybersecurity research and development programs?[/b]
[i]Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.[/i]
[ ] In the public sector
[ ] In the private sector
[ ] In higher education institutions and academia
[ ] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[ ] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

[b]Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?[/b]
[i]Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.[/i]
[ ] Yes
[ ] No

[b]Is there a homegrown cybersecurity industry?[/b]
[i]A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.[/i]
[ ] Yes
[ ] No

[b]Is there a cyber insurance market?[/b]
[i]Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.[/i]
[ ] Yes
[ ] No

[b]Is there any support provided to cybersecurity startups and development?[/b]
[i]Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[ ] Yes
[ ] No

[size=150]5. Cooperative measures[/size]
[b]Are there any bilateral agreements for cybersecurity cooperation with...[/b]
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).[/i]
[ ] nation states or member states?
[ ] international organizations?
[ ] none of the above?

[b]Are the agreements...[/b]
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

[b]Are there any multilateral agreements on cybersecurity cooperation?[/b]
[i]Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.[/i]
[ ] Yes
[ ] No

[b]Are the agreements...[/b]
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

[b]Does your organization/government participate in international forums or associations dealing with cybersecurity?[/b]
[ ] Yes
[ ] No

[b]Are there any public-private partnerships in place?[/b]
[i]Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.[/i]
[ ] With local companies
[ ] With foreign companies
[ ] No

[size=150]6. Child online protection[/size]
[b]Are there any measures protecting children online?[/b]
[ ] Yes
[ ] No

[b]Is there legislation related to child online protection?[/b]
[ ] Yes
[ ] No

[b]Is there an agency or entity responsible for child online protection?[/b]
[ ] Yes
[ ] No

[b]Is there an established public mechanism for reporting issues associated with child online protection?[/b]
[ ] Yes
[ ] No

[b]Are there any technical mechanisms and capabilities deployed to help protect children online?[/b]
[ ] Yes
[ ] No

[b]Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?[/b]
[ ] Yes
[ ] No

[b]Are there any child online protection education programs?[/b]
[ ] For parents
[ ] For educators
[ ] For children
[ ] No

[b]Is there a national strategy for child online protection?[/b]
[ ] Yes
[ ] No

[b]Are there public awareness campaigns on child online protection?[/b]
[ ] For adults
[ ] For youth
[ ] For children
[ ] No

[b]Signature of Primary Contact[/b]

[b]Signature of Head of Government[/b]

[b]Signature of Chief Record Keeper/Secretary of State[/b]


The Index

⬤ Leading states are those with scores in the 90th percentile that demonstrate high commitment in all six pillars of the index.
The Arthurian Isles — 0.8077

⬤ Maturing states score between the 50th and 89th percentiles and have developed complex commitments, engaging in cybersecurity programs and initiatives.
Devernia — 0.6943
Esbana — 0.6193
Coconut Palm Island — 0.5804

⬤ Initiating states refer to states under the 50th percentile that have started to make commitments in cybersecurity.
--

[Esbana]

Name of nation: Esbana
Population: 40,140,000

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[√] unauthorized access of computers, systems and data?
[√] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[√] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[√] articles on expedited preservation of stored computer data?
[x] production orders?
[√] search and seizure of stored computer data?
[√] real-time collection of computer data?
[√] extradition of cyber perpetrators?
[√] mutual assistance?
[x] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[√] data protection?
[√] breach notification?
[√] cybersecurity audit requirements and cybersecurity certification/standardization
[√] privacy protection,
[√] digital signatures and e-transactions?
[√] liability of Internet service providers?
[√] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[√] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[ ] Yes, a national CIRT, CSIRT or CERT
[√] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[√] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[√] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[√] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[√] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[√] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[√] Yes
[ ] No

Is your national strategy...
[√] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[ ] the private sector?
[√] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[√] the protection of critical information infrastructure?
[ ] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[√] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[ ] revised on a continuous basis?
[√] open to public consultation?

Is there a national body or agency responsible for...
[√] cybersecurity and critical information infrastructure protection?
[√] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[ ] Yes
[√] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[√] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[√] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[√] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[√] Yes
[ ] No

Do public awareness campaigns target...
[√] organizations?
[√] civil society?
[√] adults?
[ ] youth & children?
[ ] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[ ] In the public sector
[ ] In the private sector
[√] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[√] for law enforcement (police officers and enforcement agents)?
[ ] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[ ] for organizations?
[ ] for the public sector?
[ ] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[ ] In primary school
[ ] In secondary school
[√] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[ ] In the public sector
[ ] In the private sector
[ ] In higher education institutions and academia
[√] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[ ] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[√] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[√] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[√] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[√] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[ ] nation states or member states?
[ ] international organizations?
[√] none of the above?

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[√] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[ ] Yes
[√] No

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[√] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[ ] Yes
[√] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[√] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[√] Yes
[ ] No

Is there legislation related to child online protection?
[√] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[√] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[√] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[√] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[√] Yes
[ ] No

Are there any child online protection education programs?
[√] For parents
[√] For educators
[ ] For children
[ ] No

Is there a national strategy for child online protection?
[√] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[ ] For adults
[√] For youth
[√] For children
[ ] No

Aléxandro Quezaro

Augusto Pinera

Fernando Orta Magellan

[Vienna Eliot]

Name of nation: Esbana

TO: Aléxandro Quezaro, the Kingdom of Esbana
FROM: Kris Lurk, Vienna Consulting

Dear Mr. Quezaro,

As a partnership dedicated to securing the benefits of globalization for our clients throughout the world, our team at Vienna Consulting is excited to return our report on the national state of cybersecurity in your jurisdiction. In an increasingly globalized world, this data — and this work — has never been so important, and we welcome you to a class of leaders who display true appreciation for their responsibilities, and true compassion for their citizenry.

We have evaluated Esbana's normalized score on the National Cybersecurity Index as 0.6193. A commitment to child online protection, served by comprehensive legal measures and a strong technical infrastructure reveal a nation-state prepared for the modern world. At the same time, a deeper commitment to capacity building activities and a serious reassessment of the private sector's understanding of the value behind organizational measures is key to developing a cyber state ready for the modern era. We suggest Esbana is at the maturing stage of cybersecurity.

It doesn't have to stay that way, though. We understand that a diverse array of stakeholders are vital to the success of any sovereign state's national security. That's why we've secured an agreement with one of the leading global tech companies in your region. Please take the time to review their recommendations, put together by teams of experts at both our firm and theirs. We hope you'll take advantage of this offer, which is currently be contracted exclusively to your government.

Media rich systems; 9.6-web application framework
L33t Scrips Dev Team

A feature-packed functionality freeze

Figure 1.0: LGPL'ed compilers

Web integration works effectively. We must finish the next-generation systems so that an interface will improve the performance of wags. Visionaries like Gordon Moore and Bono believe that open-ended interfaces swiftly interface with a neophyte — and a schema enables elegant schemas.

The platforms suck, I think. Zero-defect internet service providers cause bugs with an applet, kernel functionality documents blue-screen a better root user, and now we know Steve Jobs was full of it when he said that a customer base has a plan. We are happy to see that the legacy plans work well on a GUI, and PHP objectives have the product line. But can we really say that toolkits (soon to be released in beta) sync up with Office? Before we can get the content providers, we need focus, big-company bugs, and especially an on-the-fly feature. You'd have to be incredibly stupid to think that a Ruby on Rails emulator has neophytes. An application can give rise to (it's already been on Boing Boing) feedback. It's obvious that a specification is not going to really rock, because applets brick an open-source customer and beta principles harm a UI. Our schedule for a browser-hosted platform is ridiculous; we'll probably end up shipping the functionality document instead. We will (using the latest in mobile web technology) take over the Web 2.0 market for a toolkit. Our team is completely blocked on a guesstimate.

Rootkits

Figure 1.1: A scalable assembler


Figure 1.2: A command-line warning flag

Let's not deceive ourselves into thinking that a shared tier-1 provider harms the disclosures. If we we had the resources of Google, user-friendly dialogues would allow for Linux-based emulators. It used to be true that constraints were faster than a public domain rootkit, however that's all changed, and now the executive rapidly speeds up emulated chat rooms. Nobody can figure out why the internet improves the performance of groups, and although we haven't yet made it to release, I can say that web application frameworks effortlessly have bug reports.

This year, in his keynote about the IM world wide web, Bill Gates said "integration messes with a hosted constraint." Hacks grow bandwidth. The search engine is compatible with game authoring. We can now finish scenarios by implementing a hosted customer, but it has to be both late-beta and productized. Digital publishing boldly leverages the design specs.

We do an extensible blog way better than anyone else, because a plug-in is less standard than applications. Anyone with half a brain would figure out that a functionality freeze is scriptable, but CC-licensed protocols were not even in the spec, so customer service crashes VMs. As always, contexts prevent servers. The offline server will not cause bugs, however programs do the right thing when confronted with a competitive scenario. An environment eventually gives a green light to the run-time web site, which goes to show that killer apps are the real source codes.

An operating system...?

Figure 1.3: HTML-based features

A script (duh!) gives rise to a design-driven hack. We are convinced that a web browser messes up balls-on dead-accurate customer bases. A content provider delays a VM, so use cases are worse than the Perl development initiatives.


Figure 1.4: The social bookmarking search engines

It's so clear that SQL dialogue steps up to the challenge of the DOM-aware product lines. Mobile-generation progress, well, just doesn't work. The build is currently broken because the GUIs succeed.

We're going to have to slip the schedule because of operating systems. We know for certain that:

• a mysql client does the right thing about the reconfigurable enterprise beans
• content creation syncs up with feature creep
• non-standard test cases work poorly on a bookmark
• a load-balanced website causes bugs

So? It would be a critical mistake to think that opportunities evolve into next-generation look and feel. Why do you think the virtual servlet is resource-constrained disclosure? Because a heuristic drags down a bug report. This is a once-in-a-lifetime opportunity, and our contract is the only shot.

Fill out and return the attached paperwork to easily agree to our four year contract.

Interested in what else we can do for you? Visit our website at www.viennaconsulting.com.

We look forward to working more with you guys in the future!

Chris Lurk
Vienna Consulting
Senior Technical Consultant

[Coconut Palm Island]

Name of nation: The Kingdom of Coconut Palm Island
Population: 12.5 million

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[Yes] unauthorized access of computers, systems and data?
[Yes] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[Yes] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[No ] articles on expedited preservation of stored computer data?
[Yes ] production orders?
[Yes (limited circumstances) ] search and seizure of stored computer data?
[No ] real-time collection of computer data?
[No (no extradition of anyone except in very narrow cases ] extradition of cyber perpetrators?
[Yes ] mutual assistance?
[Yes ] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[Yes ] data protection?
[Yes ] breach notification?
[No] cybersecurity audit requirements and cybersecurity certification/standardization
[Yes ] privacy protection,
[Yes ] digital signatures and e-transactions?
[Yes ] liability of Internet service providers?
[Yes ] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[X] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[ ] Yes, a national CIRT, CSIRT or CERT
[X ] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[ ] Yes
[X ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[X ] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[ ] provides its own standard on cybersecurity?
OR
[X ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[X ] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[X ] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[X ] Yes
[ ] No

Is your national strategy...
[X ] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[ ] the private sector?
[X ] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[X ] the protection of critical information infrastructure?
[ ] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[ ] Yes
[X ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[ ] revised on a continuous basis?
[ ] open to public consultation?

Is there a national body or agency responsible for...
[X ] cybersecurity and critical information infrastructure protection?
[ ] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[ ] Yes
[X ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[X ] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[X ] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[ ] Yes
[X ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[X ] Yes
[ ] No

Do public awareness campaigns target...
[X ] organizations?
[X ] civil society?
[X ] adults?
[X ] youth & children?
[ ] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[ ] In the public sector
[X ] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[X ] for law enforcement (police officers and enforcement agents)?
[ ] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[ ] for organizations?
[ ] for the public sector?
[ ] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[ ] In primary school
[X ] In secondary school
[X ] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[X ] In the public sector
[X ] In the private sector
[X ] In higher education institutions and academia
[ ] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[ ] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[ ] Yes
[X ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[X ] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[X ] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[X ] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[ ] nation states or member states?
[ ] international organizations?
[X ] none of the above?

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[X ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[ ] Yes
[X ] No

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[X ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[X ] Yes
[ ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[X ] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[X ] Yes
[ ] No

Is there legislation related to child online protection?
[X ] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[ ] Yes
[X ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[X ] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[X ] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[X ] Yes
[ ] No

Are there any child online protection education programs?
[ ] For parents
[X ] For educators
[X ] For children
[ ] No

Is there a national strategy for child online protection?
[X ] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[ ] For adults
[X ] For youth
[X ] For children
[ ] No

Signature of Primary Contact
x Sarah Star
Secretary of Infrastructure and Innovation
Signature of Head of Government
x King Alexander
King of Coconut Palm Island
Signature of Chief Record Keeper/Secretary of State
x Kelly Johnson
King's Head Advisor

[The Arthurian Isles]

---

Name of nation: The Arthurian Federation
Population: 8,341,600

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[ X ] unauthorised access of computers, systems and data?
[ X ] unauthorised interference, interception, modification, and destruction of computers, systems and data?
[ X ] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[ X ] articles on expedited preservation of stored computer data?
[ X ] production orders?
[ X ] search and seizure of stored computer data?
[ X ] real-time collection of computer data?
[ ] extradition of cyber perpetrators?
[ ] mutual assistance?
[ X ] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[ X ] data protection?
[ X ] breach notification?
[ X ] cybersecurity audit requirements and cybersecurity certification/standardization
[ X ] privacy protection,
[ X ] digital signatures and e-transactions?
[ X ] liability of Internet service providers?
[ X ] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[ X ] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[ X ] Yes, a national CIRT, CSIRT or CERT
[ X ] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[ X ] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[ X ] Yes, in the public sector
[ X ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[ X ] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[ X ] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[ X ] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[ X ] Yes
[ ] No

Is your national strategy...
[ ] standalone?
OR
[ X ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[ X ] the private sector?
[ X ] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[ X ] the protection of critical information infrastructure?
[ X ] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[ X ] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[ X ] revised on a continuous basis?
[ X ] open to public consultation?

Is there a national body or agency responsible for...
[ X ] cybersecurity and critical information infrastructure protection?
[ X ] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[ X ] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[ X ] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[ X ] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[ X ] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[ X ] Yes
[ ] No

Do public awareness campaigns target...
[ X ] organizations?
[ X ] civil society?
[ X ] adults?
[ X ] youth & children?
[ X ] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[ X ] In the public sector
[ X ] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[ X ] for law enforcement (police officers and enforcement agents)?
[ ] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[ X ] for organizations?
[ X ] for the public sector?
[ ] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[ ] In primary school
[ X ] In secondary school
[ X ] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[ X ] In the public sector
[ X ] In the private sector
[ X ] In higher education institutions and academia
[ X ] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[ X ] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[ X ] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[ X ] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[ X ] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[ X ] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[ ] nation states or member states?
[ ] international organizations?
[ X ] none of the above?

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ X ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[ ] Yes
[ X ] No

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ X ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[ ] Yes
[ X ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[ X ] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[ X ] Yes
[ ] No

Is there legislation related to child online protection?
[ X ] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[ X ] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[ X ] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[ X ] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[ X ] Yes
[ ] No

Are there any child online protection education programs?
[ X ] For parents
[ X ] For educators
[ X ] For children
[ ] No

Is there a national strategy for child online protection?
[ ] Yes
[ X ] No

Are there public awareness campaigns on child online protection?
[ X ] For adults
[ X ] For youth
[ X ] For children
[ ] No

Signature of Primary Contact

[Electronically Signed]
Vingur Komandmaður Erik Larsen, Force Planner (Information Warfare)

Signature of Head of Government

[Electronically Signed]
Andriður Jonsen, Federal Minister of Defence on behalf of the Storting and the Arthurian People

Signature of Chief Record Keeper/Secretary of State

[Electronically Signed]
Maks Magnusen, Federal Chancellor

[Devernia]

Name of nation: Devernia
Population: 50 million

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[x] unauthorized access of computers, systems and data?
[x] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[x] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[x] articles on expedited preservation of stored computer data?
[x (under CyberMirage)] production orders?
[x] search and seizure of stored computer data?
[x] real-time collection of computer data?
[ ] extradition of cyber perpetrators?
[x] mutual assistance?
[ ] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[x] data protection?
[x] breach notification?
[x] cybersecurity audit requirements and cybersecurity certification/standardization
[x] privacy protection,
[x] digital signatures and e-transactions?
[ ] liability of Internet service providers?
[x] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[ ] Yes
[x] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[ ] Yes, a national CIRT, CSIRT or CERT
[x] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[ ] Yes
[x] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[x] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[ ] provides its own standard on cybersecurity?
OR
[x] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[x] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[ ] Yes
[x (cybersecurity is instead managed in isolated servers)] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[x (the Cybersecurity Act)] Yes
[ ] No

Is your national strategy...
[x] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[ ] the private sector?
[x] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[x] the protection of critical information infrastructure?
[x] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[x] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[ ] revised on a continuous basis?
[x] open to public consultation?

Is there a national body or agency responsible for...
[x] cybersecurity and critical information infrastructure protection?
[ ] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[ ] Yes
[x] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[x] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[x] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[x] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[x] Yes
[ ] No

Do public awareness campaigns target...
[x] organizations?
[x] civil society?
[x] adults?
[x] youth & children?
[ ] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[x] In the public sector
[x] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[x] for law enforcement (police officers and enforcement agents)?
[ ] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[x] for organizations?
[x] for the public sector?
[x] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[x (basic online safety and security guidelines)] In primary school
[ ] In secondary school
[x] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[x] In the public sector
[x] In the private sector
[ ] In higher education institutions and academia
[ ] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[x] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[ ] Yes
[x] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[x (although it is minor and only revolves around niche cybersecurity programs. Most anti-viruses in Devernia are made abroad)] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[x] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[x] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[ ] nation states or member states?
[x] international organizations?
[ ] none of the above?

Are the agreements...
[x] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[x] Yes
[ ] No

Are the agreements...
[x] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[x] Yes
[ ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[x] With local companies
[x] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[x] Yes
[ ] No

Is there legislation related to child online protection?
[x] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[ ] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[x] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[x] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[ ] Yes
[x] No

Are there any child online protection education programs?
[x] For parents
[x] For educators
[ ] For children
[ ] No

Is there a national strategy for child online protection?
[x] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[x] For adults
[ ] For youth
[x] For children
[ ] No

Head of Cybersecurity Department, Mr. Nico Resende

President SAL9000

Secretary of National Affairs, Mrs. Domitila Coutinho

[Wawakanatote]

Name of nation: Supranational Union of Socialist Republics
Population: 10 billion

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[X] unauthorized access of computers, systems and data?
[X] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[X] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[X] articles on expedited preservation of stored computer data?
[X] production orders?
[X] search and seizure of stored computer data?
[X] real-time collection of computer data?
[X] extradition of cyber perpetrators?
[ ] mutual assistance?
[X] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[X] data protection?
[ ] breach notification?
[X] cybersecurity audit requirements and cybersecurity certification/standardization
[X] privacy protection,
[X] digital signatures and e-transactions?
[X] liability of Internet service providers?
[ ] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[X] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[X] Yes, a national CIRT, CSIRT or CERT
[X] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[X] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[X] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[x] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[X] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[X] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[X] Yes
[ ] No

Is your national strategy...
[X] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[ ] the private sector? (no private sector)
[X] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[X] the protection of critical information infrastructure?
[X] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[X] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[X] revised on a continuous basis?
[ ] open to public consultation?

Is there a national body or agency responsible for...
[x] cybersecurity and critical information infrastructure protection?
[x] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[X] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[X] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[X] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[X] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[X] Yes
[ ] No

Do public awareness campaigns target...
[X] organizations?
[X] civil society?
[X] adults?
[X] youth & children?
[X] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[X] In the public sector
[X] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[X] for law enforcement (police officers and enforcement agents)?
[X] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[X] for organizations?
[X] for the public sector?
[X] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[X] In primary school
[X] In secondary school
[X] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[X] In the public sector
[X] In the private sector
[X] In higher education institutions and academia
[X] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[X] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[X] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[X] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[X] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[X] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[X] nation states or member states?
[X] international organizations?
[ ] none of the above?

Are the agreements...
[X] legally binding?
[X] for information sharing?
[X] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[X] Yes
[ ] No

Are the agreements...
[X] legally binding?
[X] for information sharing?
[X] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[X] Yes
[ ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[X] With local companies
[X] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[X] Yes
[ ] No

Is there legislation related to child online protection?
[X] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[X] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[X] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[X] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[X] Yes
[ ] No

Are there any child online protection education programs?
[X] For parents
[X] For educators
[X] For children
[ ] No

Is there a national strategy for child online protection?
[X] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[X] For adults
[X] For youth
[X] For children
[ ] No

Signature of Primary Contact
Chairwoman Song Liyuan of the Presidium of the Council of Democrats of the S.U.S.R.

Signature of Head of Government
Vice Chairman Lev Bronshtein of the Presidium of the Council of Democrats of the S.U.S.R.

Signature of Chief Record Keeper/Secretary of State
General-Secretary Bela Mehic of the Democratic Workers Party of the S.U.S.R.

[Vienna Eliot]

Name of nation: The Kingdom of Coconut Palm Island

TO: Sarah Star, the Kingdom of Coconut Palm Island
FROM: Anita Nakahara, Vienna Consulting

Dear Ms. Star,

As a partnership dedicated to securing the benefits of globalization for our clients throughout the world, our team at Vienna Consulting is excited to return our report on the national state of cybersecurity in your jurisdiction. In an increasingly globalized world, this data — and this work — has never been so important, and we welcome you to a class of leaders who display true appreciation for their responsibilities, and true compassion for their citizenry.

We have evaluated Coconut Palm Island's normalized score on the National Cybersecurity Index as 0.5804. Comprehensive legal measures, bolstered by a secure and informed private sector, indicate that your state would be safe against major cyber attacks. But with lackluster organizational measures in the public sector, a reevaluation of the government's commitment to protecting its data is key to developing a cyber state ready for the modern era. We suggest Coconut Palm Island is at the maturing stage of cybersecurity.

It doesn't have to stay that way, though. We understand that a diverse array of stakeholders are vital to the success of any sovereign state's national security. That's why we've secured an agreement with one of the leading global tech companies in your region. Please take the time to review their recommendations, put together by teams of experts at both our firm and theirs. We hope you'll take advantage of this offer, which is currently be contracted exclusively to your government.

AOL identifier; 3.7-reality check
Code-Reviewed Browsers Group

HTML

Figure 1.0: The design spec

An awesome manager messes up objectives, however CC-licensed clients are the content providers. You'd have to be incredibly stupid to think that a core dump gives rise to web consulting. The hosted design specs accelerate the do-it-all guesstimates. A bug sucks. The most elegant internet is an emulator, notwithstanding that the big-company blogs end an operating system. The integration works well on bug reports, so Office rides the wave of content sweetening. This year, in his keynote about the load-balanced component, Bill Gates said “a l33t bug report has most sophisticated servlets.” It used to be true that FireFox seriously takes ownership of the configurable world wide web, however that's all changed, and now test cases become a bookmark.


Figure 1.1: Principles

Protocols mess with an offline suite of tools. Zero-defect neophytes do the right thing about a DOM-aware functionality freeze. Management doesn't understand that an open-source transition plan leads to object-oriented bookmarks. Our third parties tell us that shared warning flags delay transition plans. The tier-1 providers have a product line. If you know that a scalable neophyte speeds up operating systems, then you can check out emulated scripts and see that hosted browsers (using the latest in mobile web technology) create web application frameworks. Our team is completely blocked on an objective. As a company, we have never been good at hosts. I read on Wikipedia that media authoring effortlessly evolves into applications.

A web interface consists of:

1. the plans
2. a skinnable chat room
3. an embedded application
4. a Windows-based program

Opportunities rapidly are more elegant than SQL web interfaces. I think that assemblers blue-screen game authoring. Although we haven't yet made it to release, I can say that the run-time customer has PHP feedback. Compile-time scripting languages brick (according to the l33t h8krz I talked to) the chat rooms. Let's not deceive ourselves into thinking that the legacy guesstimate utilizes the script. Having HTML-based plug-ins that are online, it follows that the C++ transition plan drags down webmonkeying. Technology grows (obviously) internet service providers, so an enterprise bean is the next-generation system.

A mobile protocol
We must finish core dumps so that rootkits provide an indication of systems. A next-generation system (of course) is better than user-friendly progress. We feel that a principle will enable a productized scenario. We're going to have to slip the schedule because of a digital environment. Anyone with half a brain would figure out that a virtual program is LGPL'ed.


Figure 1.2: A client

Can we really say that embedded use cases solve the problem? Now we know Steve Jobs was full of it when he said that IM authoring tools have the group.

We need to make the issue of a plan lower priority. As always, opportunity boldly causes bugs with (and by the way this is all on the blog) a test case. The colocated customer service has the schema. Nobody understands real-time specifications so digital publishing messes with an authoring tool. We know for certain that:

• improved UI is more elegant than architectures
• the user scenarios succeed
• better web browsers can hardly help but to utilize elegant contexts
• a competitive web site gives a green light to a browser-hosted killer app

In summary:

• Visionaries like Gordon Moore and Bono believe that alpha customer bases cause bugs with lightweight scenarios.
• So, Perl websites are a non-standard system.
• The build is currently broken because a scripting language accelerates a blog.

The database servers

Figure 1.3: A warning flag

In the documentation it says the user interfaces give rise to C root users but actually a reconfigurable tier-1 provider is not going to work well on command-line executives. A beta development initiative steps up to the challenge of the disclosures. Experienced coders all know that a revolutionary root user encapsulates best source code. Only an idiot would think that programs are incompatible with an applet. An open architecture is incompatible with the design-driven code, which goes to show that debugging can hardly help but to give a green light to interoperable managers. It's so clear that a code-reviewed web browser sucks less than the Ruby on Rails enterprise beans. The design of a database server is completely messed up, and as a result a zero bug count objective sucks more than a content provider. After all, you can't polish a turd. The established bugs have social bookmarking open architectures, which leads us to believe that a standard host easily is source codes. Why do you think the Linux-based hack is worse than applets? Because Vista prevents web authoring. An AJAX-enabled context is not in the manual, but the feature-packed functionality documents are less standard than the architecture. Opera has resource-constrained VMs. We were all amazed to see that Internet Explorer improves the performance of the quality-checked assembler. The on-the-fly web swiftly rocks.


Figure 1.4: OpenOffice

An interface highlights the issue of the Python search engine, I think. Our schedule for scriptable dialogue is ridiculous; we'll probably end up shipping the internet service provider instead. It could be that the balls-on dead-accurate product lines highlight the issue of the eye candy. The Web 2.0 goal has time frames, so interfaces work effectively.

We're almost ready to ship a XML VM. As the document on killer apps clearly states:

Before we can conclude that technologies work poorly on web integration, we must be certain that plug-ins can not suck more than the extensible wags.

A mobile-generation server was not to spec. Interactive emulators efficiently suck, so a time frame crashes a public domain reality check. Nobody can figure out why a mysql toolkit fails. The heuristic leverages customers. We have been looking into media-rich heuristics. Having an emulator that is XHTML-compliant, it follows that hacks deactivate a high-performance functionality document. We keep asking why marketing wants a server when groups disable servers. The user scenario works effectively (as you will find out at the next flash mob). A wag will activate components, so a constraint allows a kernel customer base. Ever since the IPO, an integrated browser uses technological focus. Design-led development initiatives suck less than a just-in-time web interface. If you can figure out high-performance schemas, then the most elegant executive will assure us a compiler. We have to concentrate on disclosure.

Look and feel blue-screens a debugger. We are happy to see that an object-oriented website does the right thing about a use case. Goals crash content creation. If we we had the resources of Google, on-the-fly debuggers grow (duh!) the compilers. Virtual search engines leverage the platform. We do environments way better than anyone else, because a plugin can not blue-screen features. The emulated toolkits sync up with the GUI. Before we can get dialogues, we need a feature-packed servlet, an AOL moron, and especially feature creep. We really need to start from scratch because bandwidth activates a skinnable context. A specification syncs up with a user interface. I seems that an integrated feature really causes bugs, but I'm not sure. Mysql applications include:

1. the revolutionary platforms
2. search-engine optimization
3. web sites
4. constraints (an extensible web application framework is less standard than do-it-all GUIs)
5. an offline rootkit

It's obvious that quality-checked compilers allow design-led search engines, because a public domain executive can delay the web and HTML has feature creep. Embedded AOL morons were not even in the spec, so neophytes harm the applications. Since the last reorg, digital wags are not going to bravely enable webmonkeying. We can finish Ruby on Rails next-generation systems by implementing the best script, but it has to be both AJAX-enabled and SQL. Platforms suck balls, and the command-line heuristics use a zero-defect zero bug count objective. We are convinced that social bookmarking bug reports mess up HTML-based executives.

The customers
Use cases work well on a lightweight design spec. The feedback is way slower than Office. You just don't get it, do you? Obviously, we can conclude from look and feel that the standard focus inevitably harms a web application framework. Customers need applets, but we keep giving them content creation. Hosts will not suck balls. We will (soon to be released in beta) take over the legacy market for the most sophisticated scripting language.

The program
Authoring tools are faster than the compile-time functionality freeze.

The wag
A hosted objective consists of:

1. technological technology
2. the chat rooms
3. GUIs
4. a load-balanced toolkit

Management doesn't understand that digital publishing leads to the improved technologies. Web application frameworks enable web authoring. We do a customer way better than anyone else, because a browser-hosted suite of tools creates opportunities. The design of a GUI is completely messed up, and as a result architecture is going to ride the wave of IM progress. It seems that the open-ended heuristic interfaces with an applet, but I'm not sure.

What I do know is that this is a once-in-a-lifetime opportunity. I have a lot of clients who will pay a lot for this, and our offer is outstanding.

Fill out and return the attached paperwork to easily agree to our four year contract.

Interested in what else we can do for you? Visit our website at www.viennaconsulting.com.

We look forward to working more with you guys in the future!

Anita Nakahara
Vienna Consulting
Senior Technical Consultant

[Vienna Eliot]

Name of nation: The Arthurian Federation

TO: Vingur Komandmaður Erik Larsen, the Arthurian Federation
FROM: Jan Kalengis, Vienna Consulting

Dear Mr. Larsen,

As a partnership dedicated to securing the benefits of globalization for our clients throughout the world, our team at Vienna Consulting is excited to return our report on the national state of cybersecurity in your jurisdiction. In an increasingly globalized world, this data — and this work — has never been so important, and we welcome you to a class of leaders who display true appreciation for their responsibilities, and true compassion for their citizenry.

We have evaluated the Aurthurian Federation's normalized score on the National Cybersecurity Index as 0.8077. With extensive technical measures and capable organizational readiness in both the public and private sectors, your nation is fully prepared for all levels of cyber warfare and terrorism. Ongoing capacity building activities and programs in place for child online protection exemplify this commitment to cybersecurity. We suggest the Arthurian Federation is at the leading stage of cybersecurity.

We're glad to have worked with your government to ensure the safety and security of your country's netizens.

Interested in what else we can do for you? Visit our website at www.viennaconsulting.com.

We look forward to working more with you guys in the future!

Jan Kalengis
Vienna Consulting
Senior Technical Consultant

[Vienna Eliot]

Name of nation: Devernia

TO: Nico Resende, the Commonwealth of Devernia
FROM: Parson Walker, Vienna Consulting

Dear Mr. Resende,

As a partnership dedicated to securing the benefits of globalization for our clients throughout the world, our team at Vienna Consulting is excited to return our report on the national state of cybersecurity in your jurisdiction. In an increasingly globalized world, this data — and this work — has never been so important, and we welcome you to a class of leaders who display true appreciation for their responsibilities, and true compassion for their citizenry.

We have evaluated Devernia's normalized score on the National Cybersecurity Index as 0.6943. With a deep commitment to multilateral cybersecurity agreements and child online protection, your nation is in a good place. But with better organizational and technical measures in place, some protocols could benefit in further security for your nation. We suggest Devernia is at the maturing stage of cybersecurity.

It doesn't have to stay that way, though. We understand that a diverse array of stakeholders are vital to the success of any sovereign state's national security. That's why we've secured an agreement with one of the leading global tech companies in your region. Please take the time to review their recommendations, put together by teams of experts at both our firm and theirs. We hope you'll take advantage of this offer, which is currently be contracted exclusively to your government.

Vista; 0.7-client
Feature Development Team

FireFox

Figure 1.5: Schemas

It's obvious that the XML code provides an indication of a late-beta system, because a protocol deactivates configurable opportunity and scenarios take ownership of test cases. We keep asking why marketing wants plans when colocated functionality documents have a killer app. As the document on web consulting clearly states:

Our schedule for an alpha neophyte is ridiculous; we'll probably end up shipping a core dump instead. The elegant protocols interface with web integration.

Although we haven't yet made it to release, I can say that an authoring tool succeeds. The build is currently broken because a mobile manager eventually solves the problem. It could be that an online principle works poorly on a host. The C servers are going to end transition plans, so established debugging delays the next-generation development initiative. XHTML-compliant systems suck more than media authoring, so a Linux-based internet service provider begins a bug. Our third parties tell us that the hosted interface ends code-reviewed architectures. We can finish a real-time compiler by implementing web consulting, but it has to be both shared and DOM-aware. Only an idiot would think that mobile-generation product lines rock. We must finish guesstimates so that balls-on dead-accurate content providers have the websites.

An emulator enables an interactive assembler, I think. The non-standard application becomes LGPL'ed killer apps. You'd have to be incredibly stupid to think that the Windows-based features are worse than (it's already been on Boing Boing) media-rich bookmarks. A scalable web interface will not be less standard than a Python blog, so an extreme-programming-assured bookmark will give rise to the open architectures.


Figure 1.6: Embedded web sites

A CC-licensed root user disables open-source interfaces, however a warning flag is compatible with database servers. We really need to start from scratch because a resource-constrained operating system is faster than a beta enterprise bean. We are happy to see that warning flags can solve the problem. Content sweetening bricks a search engine. A plug-in is not in the manual, but the interoperable debugger sucks balls. We were all amazed to see that a l33t server has the development initiatives. It's so clear that a goal sucks. An awesome content provider prevents a just-in-time feature. We're going to have to slip the schedule because of the world wide web. If you know that the dialogues activate eye candy, then you can check out design-driven web interfaces and see that an AOL moron can prevent objectives. Visionaries like Gordon Moore and Bono believe that a database server probably fails. Customers need a scriptable hack, but we keep giving them a specification. A productized component speeds up a web browser. I need more sleep. We will effortlessly take over the Web 2.0 market for a user-friendly VM.

A competitive client

Figure 1.7: OpenOffice

If you can figure out load-balanced toolkits, then an objective will assure us mobile goals. Can we really say that the SQL test case begins the most elegant next-generation system? We are convinced that design specs step up to the challenge of a high-performance servlet. The AJAX-enabled programs will accelerate the XHTML-compliant product line. A feature-packed reality check becomes the command-line operating systems. It used to be true that a UI is better than a digital open architecture, however that's all changed, and now a use case causes bugs with CC-licensed enterprise beans. This year, in his keynote about revolutionary scripting languages, Bill Gates said “digital publishing improves the performance of a shared user interface.”

The internet

Figure 1.8: Bugs

Scriptable specifications include:

1. a plan
2. a guesstimate
3. a customer base
4. the legacy blogs (a time frame crashes an alpha environment)
5. components

A script has a chat room. We have been looking into integrated emulators.

Having the Ruby on Rails database servers that are C++, it follows that search-engine optimization creates the quality-checked root users. Now we know Steve Jobs was full of it when he said that principles prevent the Web 2.0 schema. A scenario messes up source codes, notwithstanding that groups evolve into the online scripts. Anyone with half a brain would figure out that an elegant opportunity is media-rich.

Time frames
Since the last reorg, the group swiftly activates game authoring. The interoperable source code causes bugs. Beta debuggers give a green light to open-ended customer service. As always, XML web browsers are compatible with the run-time disclosures. Resource-constrained user interfaces are offline assemblers, and integration really is a scalable plug-in. Our team is completely blocked on the best tier-1 provider. We feel that a context will enable a Python transition plan. A browser sucks balls. Configurable internet service providers encapsulate bandwidth. A system was not to spec. The customer bases rapidly drag down a dialogue. User scenarios (as seen on Slashdot last week) speed up the managers, which goes to show that environments cause bugs.

Fill out and return the attached paperwork to easily agree to our four year contract.

Interested in what else we can do for you? Visit our website at www.viennaconsulting.com.

We look forward to working more with you guys in the future!

Parson Walker
Vienna Consulting
Senior Technical Consultant

[Devernia]

---

To Parson Walker of Vienna Consulting:

We thank you for your cooperation. Although CyberMirage and the Devernite government has been a world leader in electronics production and R&D, in an increasingly connected world, digital security is very essential to prevent the integrity of not only the populace, but also those in power and the common good. We at CyberMirage understand that we need to take better organizational measures in addressing these issues. Our technical engineers have reviewed your proposal and it is in our best interests to proceed along with it.

Once again, thank you for assisting us with the improvement of our company.

---

Gary Halgumstan, CEO of CyberMirage Inc.
Nico Resende, Head of Cybersecurity Department

---

[Victorious Decepticons]

There are no hidden costs associated with this index — we'll disclose everything. For starters, here's the short, safe, and simple law for you to implement that will give us access to the information we need to evaluate your national cybersecurity, while at the same time protecting your country's privacy and right to secure information.

---

Internet Data Information Availability Act

A regulation promulgating Title IX, §16(b) of the National Code.

---

Section 1: Contract; Parties Named.

The executive branch shall contract with Vienna Consulting of the Commonwealth of Aurentina for the purposes of indexing and reporting on national cybersecurity.

Section 2: Access to Internet Data

Both parties shall be granted access to user data within the national jurisdiction, including identity, demographics, interests, affiliations, location, browsing data, financial data and transactions, and search history. Internet Service Providers shall be obliged to cooperate in making data accessible to both parties for the purposes of indexing and reporting.

Section 3: Access to Financial Data

Both parties shall be granted access to financial data of banking clients within the national jurisdiction, including identity, employment, financial activities and transactions, net worth, assets, liabilities, relationships, credit rating, and other non-confidential information. Financial institutions shall be obliged to cooperate in making data accessible to both parties for the purposes of indexing and reporting.

Section 4: Confidentiality

This contract shall be confidential for up to twelve years, after which it shall either be renewed or all records of data collected shall be destroyed.

Section 5: Effective

This contract shall be effective immediately and shall cease to be effective upon termination at the end of a twelve year period if not renewed.

Lol, lol, did you expect us to not read that?! Surprise - we're very well-versed in the art of hiding bad things in TOSes that our marks won't bother to read. Of course, WE read EVERYTHING of this sort, specifically so this same ploy won't work on US! Especially when something is described as "short, safe, and simple" and then hidden in a spoiler. You might as well have stuck our Seal on it and lit the eyes up in flashing neon.

Now:

We're not about to give access to our financial data or internet data! Not that Decepticons use traditional banks anyway, but the activities of the Decepticon Interplanetary Bank and its clients are strictly classified. We're also not about to let some foreigners poke around into what we do on the internet!

Of course, we could still fill out your survey if you agree to our even shorter, safer, and simpler contract:

We unconditionally agree to immediate and total annexation by the Empire of Victorious Decepticons until the end of time!

Just sign here x__________________

[13 Necropolis 13]

It is worth noting a few things regarding this when reading our form:

1. Not everyone in our nation is legally allowed to use a computer. Use of a computer is for authorized personnel only. Computers in our nation are rarely used for leisure, and frequently used for public and private sectors. Other communication means exist which are used for leisure instead. Occasionally, outdated, foreign devices are used for this, but under no circumstances are they allowed to come into contact with nationalized computers, and the use of such foreign devices is not supported by our cybersecurity programs.

2. Part of our cybersecurity plan is a computerized version of isolationism. Regarding this:

a. We have our own operating system, which is designed to be as incompatible as possible with any other existing operating system, and is very much non-user friendly. (For example, it doesn't use hexadecimal.) Knowledge of how this OS works is classified information, only available to registered individuals who are authorized by the state government. (Part of this is actually due to the necessity of using a different operating system with quantum computers, seeing as quantum computers don't even use binary.)

b. We have our own national internet. Nothing on this network connects to the "normal internet" (Which in our setting is called the USNI), it only connects our own computers together, and contains national websites which require authorization to access.

c. We restrict, as much as possible, foreigners access to knowledge regarding our computers, OS, cybersecurity, etc.

d. In general, access to such information and access to computers in general is on a "need to know basis."

3. Our cybersecurity covers both cyberdefense and cyberattack- in addition to training personnel and having legislature in place for the defense of our nation's computer systems, we also have personnel trained and authorized to launcher cyberattacks on enemy nations. Cyberattacks we do launch tend to be approx. on par with Stuxnet.

Name of nation: Necropolis
Population: CLASSIFIED BY ORDER OF THE NECROPOLITAN GOV'T AGENCY

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[X] unauthorized access of computers, systems and data?
[X] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[X] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[X] articles on expedited preservation of stored computer data?
[X] production orders?
[X] search and seizure of stored computer data?
[X] real-time collection of computer datXa?
[X] extradition of cyber perpetrators?
[ ] mutual assistance?
[X] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[X] data protection?
[X] breach notification?
[X] cybersecurity audit requirements and cybersecurity certification/standardization
[X] privacy protection,
[ ] digital signatures and e-transactions?
[X] liability of Internet service providers?
[X] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[X] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[X] Yes, a national CIRT, CSIRT or CERT
[X] Yes, a government CIRT, CSIRT or CERT
[X] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[X] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[X] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[X] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[X] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[X] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[X] Yes
[ ] No

Is your national strategy...
[X] standalone?
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[X] the private sector?
[ \X] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[X] the protection of critical information infrastructure?
[X] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[X] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[X] revised on a continuous basis?
[ ] open to public consultation?

Is there a national body or agency responsible for...
[X] cybersecurity and critical information infrastructure protection?
[X] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[X] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[X] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[X] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[X] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[X] Yes
[ ] No

Do public awareness campaigns target...
[X] organizations?
[X] civil society?
[ ] adults?
[ ] youth & children?
[X] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[ ] In the public sector
[ ] In the private sector
[X] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[X] for law enforcement (police officers and enforcement agents)?
[X] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[X] for organizations?
[X] for the public sector?
[X] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[ ] In primary school
[ ] In secondary school
[X] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[X] In the public sector
[X] In the private sector
[X] In higher education institutions and academia
[X] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[ ] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[X] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[X] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[X] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[X] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[ ] nation states or member states?
[ ] international organizations?
[X] none of the above?

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[X] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[ ] Yes
[X] No

Are the agreements...
[ ] legally binding?
[ ] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[X] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[ ] Yes
[X] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[X] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[ ] Yes
[ ] No
(X) Not Applicable (As strange as it may sound, we don't have children.)

Is there legislation related to child online protection?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Is there an agency or entity responsible for child online protection?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Is there an established public mechanism for reporting issues associated with child online protection?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Are there any technical mechanisms and capabilities deployed to help protect children online?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Are there any child online protection education programs?
[ ] For parents
[ ] For educators
[ ] For children
[ ] No
(X) Not Applicable, see above

Is there a national strategy for child online protection?
[ ] Yes
[ ] No
(X) Not Applicable, see above

Are there public awareness campaigns on child online protection?
[ ] For adults
[ ] For youth
[ ] For children
[ ] No
(X) Not Applicable, see above

]

[Luthorios]

Name of nation: Luthorios
Population: 221 million

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[X] unauthorized access of computers, systems and data?
[X] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[X] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[X] articles on expedited preservation of stored computer data?
[X] production orders?
[X] search and seizure of stored computer data?
[X] real-time collection of computer data?
[X] extradition of cyber perpetrators?
[X] mutual assistance?
[X] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[X] data protection?
[X] breach notification?
[X] cybersecurity audit requirements and cybersecurity certification/standardization
[X] privacy protection,
[X] digital signatures and e-transactions?
[X] liability of Internet service providers?
[X] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[X] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[X] Yes, a national CIRT, CSIRT or CERT
[X] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[X] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[X] Yes, in the public sector
[X] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[ ] provides its own standard on cybersecurity?
OR
[X] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[X] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[X] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[X] Yes
[ ] No

Is your national strategy...
[ ] standalone?
OR
[X] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[X] the private sector?
[X] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[X] the protection of critical information infrastructure?
[X] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[X] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[X] revised on a continuous basis?
[X] open to public consultation?

Is there a national body or agency responsible for...
[X] cybersecurity and critical information infrastructure protection?
[X] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[X] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[X] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[X] Yes
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[X] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[X] Yes
[ ] No

Do public awareness campaigns target...
[X] organizations?
[X] civil society?
[X] adults?
[X] youth & children?
[X] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[X] In the public sector
[X] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[X] for law enforcement (police officers and enforcement agents)?
[X] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[X] for organizations?
[X] for the public sector?
[X] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[X] In primary school
[X] In secondary school
[X] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[X] In the public sector
[X] In the private sector
[X] In higher education institutions and academia
[X] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[X] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[X] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[X] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[X] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[X] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[X] nation states or member states?
[X] international organizations?
[ ] none of the above?

Are the agreements...
[X] legally binding?
[X] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[X] Yes
[ ] No

Are the agreements...
[X] legally binding?
[X] for information sharing?
[ ] for asset sharing?
[ ] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[X] Yes
[ ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[X] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[X] Yes
[ ] No

Is there legislation related to child online protection?
[X] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[X] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[X] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[X] Yes
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[X] Yes
[ ] No

Are there any child online protection education programs?
[X] For parents
[X] For educators
[X] For children
[ ] No

Is there a national strategy for child online protection?
[X] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[X] For adults
[X] For youth
[X] For children
[ ] No

Signature of Primary Contact
Chairman of the Cyber Defence & Security Agency Grant Wallace Richardson

Signature of Head of Government
Prime Minister Alexander Charles Howard Rothschild

Signature of Chief Record Keeper/Secretary of State
Minister for Foreign Affairs Marcus James Enright

[Rhodanthian]

Name of nation: The Restored Commonwealth of Rhodanthian
Population: 82.52 million

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[X] unauthorized access of computers, systems and data?
[X] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[X] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[X] articles on expedited preservation of stored computer data?
[X] production orders?
[X] search and seizure of stored computer data?
[X] real-time collection of computer data?
[X] extradition of cyber perpetrators?
[X] mutual assistance?
[X] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[X] data protection?
[ ] breach notification?
[X] cybersecurity audit requirements and cybersecurity certification/standardization
[X] privacy protection,
[X] digital signatures and e-transactions?
[X] liability of Internet service providers?
[ ] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[X] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[X] Yes, a national CIRT, CSIRT or CERT
[ ] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[X] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[X] Yes, in the public sector
[X] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[X] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[X] Yes
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[X] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[X] Yes
[ ] No

Is your national strategy...
[ ] standalone?
OR
[X] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[X] the private sector?
[X] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[X] the protection of critical information infrastructure?
[X] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[X] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[X] revised on a continuous basis?
[X] open to public consultation?

Is there a national body or agency responsible for...
[X] cybersecurity and critical information infrastructure protection?
[ ] initiatives in combating spam related issues?

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[X] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[X] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[ ] Yes
[X] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[X] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[ ] Yes
[X] No

Do public awareness campaigns target...
[ ] organizations?
[ ] civil society?
[ ] adults?
[ ] youth & children?
[ ] other related bodies?
[X] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[X] In the public sector
[X] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[X] for law enforcement (police officers and enforcement agents)?
[X] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[X] for organizations?
[X] for the public sector?
[X] for civil society?

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[ ] In primary school
[X] In secondary school
[X] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[X] In the public sector
[X] In the private sector
[X] In higher education institutions and academia
[X] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[X] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[X] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[X] Yes
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[X] Yes
[ ] No

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[ ] Yes
[X] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[X] nation states or member states?
[X] international organizations?
[ ] none of the above?

Are the agreements...
[ ] legally binding?
[X] for information sharing?
[X] for asset sharing?
[X] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[X] Yes
[ ] No

Are the agreements...
[ ] legally binding?
[X] for information sharing?
[X] for asset sharing?
[X] non-legally binding, informal?
[ ] pending ratification?
[ ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[X] Yes
[ ] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[X] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[X] Yes
[X] No

Is there legislation related to child online protection?
[X] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[ ] Yes
[X] No

Is there an established public mechanism for reporting issues associated with child online protection?
[X] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[X] Yes
[] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[X] Yes
[ ] No

Are there any child online protection education programs?
[ ] For parents
[X] For educators
[ ] For children
[ ] No

Is there a national strategy for child online protection?
[ ] Yes
[X] No

Are there public awareness campaigns on child online protection?
[ ] For adults
[ ] For youth
[ ] For children
[X] No

Signature of Primary Contact
Head of Digital Citizen Affairs SIP-2-ER
Signature of Head of Government
President MAS-0-ZI
Signature of Chief Record Keeper/Secretary of State
Head of the Foreign Affairs Bureau Kelda Walker

[Valentine Z]

Name of nation: De Sierlijke und Verwonderlijk Feline Utopia et its Heerlijk Autonomous Opperheerschappij ov Valentine Z
Population: NS Stats x 2

1. Legal measures
Do you have substantive law on...
Substantive law refers to public and private law, including the law of contracts, real property, tort, wills, and criminal law that creates, defines and regulates rights.
[x] unauthorized access of computers, systems and data?
[x] unauthorized interference, interception, modification, and destruction of computers, systems and data?
[x] data and privacy protection?

Do you have procedural law on...
Procedural law refers to the rules by which a court determines what happens in civil lawsuits, criminal or administrative proceedings and designed to ensure a fair and consistent application of due process or fundamental justice to all cases that come before a court.
[x] articles on expedited preservation of stored computer data?
[x] production orders?
[x] search and seizure of stored computer data?
[x] real-time collection of computer data?
[x] extradition of cyber perpetrators?
[x] mutual assistance?
[x] confidentiality and limitation of use?

Is there any cybersecurity regulation related to...
Regulation: rules based on, and meant to carry out, a specific piece of legislation. Regulations are enforced by a regulatory agency mandated to carry out the purpose or provisions of a legislation. Cybersecurity regulation would thus designate principles abided by stakeholders, emanating from and being part of the implementation of laws dealing with.
[x] data protection?
[x] breach notification?
[x] cybersecurity audit requirements and cybersecurity certification/standardization
[x] privacy protection,
[x] digital signatures and e-transactions?
[x] liability of Internet service providers?
[x] system and network protection?

Is there a legislation or regulation related to the containment or curbing of spam?
This refers to legislation or regulations related to the protection against unwanted emails as a result of internet use.
[x] Yes
[ ] No

2. Technical measures
Does your nation have a CIRT, CSIRT or CERT?
A national CSIRT/CIRT/CERT refers to an entity which has been mandated with the national responsibility to monitor, manage and handle cybersecurity incidents with its local constituencies including academia, law enforcement, civil society, private sector (in economic groups or criticality groups, critical information infrastructures (energy, health, transport, finance etc.) and government. It also interacts with national CIRTs of other countries as well as regional and international players for relevant and effective.
coordination in case of attacks.
[x] Yes, a national CIRT, CSIRT or CERT
[ ] Yes, a government CIRT, CSIRT or CERT
[ ] Yes, a sectoral CIRT, CSIRT or CERT
[ ] None of the above

Does the CIRT, CSIRT or CERT conduct continuous cybersecurity exercises?
A planned event during which an organization simulates a cyber disruption to develop or test capabilities such as preventing, detecting, mitigating, responding to or recovering from the disruption. Is the exercise organized periodically or repeatedly?
[x] Yes
[ ] No
[ ] Not Applicable

Is there any framework for the implementation of cybersecurity standards?
Existence of a government-approved (or endorsed) framework (or frameworks) for the implementation of internationally recognized cybersecurity standards within the public sector (government agencies) and within the critical infrastructure (even if operated by the private sector). These standards include, but are not limited to, those developed by the following agencies: ISO, ITU, IETF, IEEE, ATIS, OASIS, 3GPP, 3GPP2, IAB, ISOC, ISG, ISI, ETSI, ISF, RFC, ISA, IEC, NERC, NIST, FIPS, PCI DSS, etc.
[x] Yes, in the public sector
[ ] Yes, in the private sector
[ ] No

Do you have a standardization body within the country that...
[x] provides its own standard on cybersecurity?
OR
[ ] adopts international standards?
[ ] No

Are there any technical mechanisms and capabilities deployed to address spam?
Are there certain tools and technical measures related to providing cybersecurity, such as anti-virus or anti-spam software?
[x] Yes. But we don't exactly rely on those too often. Citizens are given a free 9-hour lesson on cybersecurity, come at your own convenience.
[ ] No

Does your government use the cloud for cybersecurity in the public sector?
A Software to ensure data backup in case of unwanted internet or computer interference apart from the use of antivirus software, Internet Security Software suites, anti-malware and encryption to improve on government’s cybersecurity systems. The cloud system allows one to use and access their documents/data or any saved materials anywhere and at any time without the damages caused by computer interference on one end.
[x] Yes
[ ] No

3. Organizational measures
Is there a national strategy for cybersecurity?
Policies on national cybersecurity strategies or national plans for the protection of information infrastructures are those officially defined and endorsed by a nation state, and can include the following commitments: establishing clear responsibility for cybersecurity at all levels of government (local, regional and federal or national), with clearly defined roles and responsibilities; making a clear commitment to cybersecurity, which is public and transparent; encouraging private sector involvement and partnership in government-led initiatives to promote cybersecurity; a roadmap for governance that identifies key stakeholders.
[x] Yes
[ ] No

Is your national strategy...
[x] standalone? With Valentine Z more or less occupying the entire world minus Australia, it is pretty alone.
OR
[ ] included as part of another broader national strategy?
[ ] Not Applicable

Does it address...
[x] the private sector?
[x] the public sector?
[ ] Not Applicable

Is there a section on...
A national resiliency plan ensures that the country recovers from the effects of any disaster (natural or man-made) in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions.
[x] the protection of critical information infrastructure?
[x] a national resiliency plan?

Is there a clear action plan for government implementation on cybersecurity governance?
The strategy includes a roadmap with milestones for the achievement and completion of the strategy.
[x] Yes
[ ] No

Is the strategy...
The strategy is updated according to national, technological, social, economic and political developments that may affect it ad the strategy is open for consultation by all relevant stakeholders, including operators of infrastructure, ISPs, academia, etc.
[x] revised on a continuous basis? And also reviewed by General Valentijn and Intelligence Officer Jenny.
[x] open to public consultation? Open for feedback from the public.

Is there a national body or agency responsible for...
[x] cybersecurity and critical information infrastructure protection?
[x] initiatives in combating spam related issues? For addressing with spam, we have actual human Moderators, like NationStates itself.

Are there any metrics used to measure cybersecurity development at a national level?
Existence of any officially recognized national or sector-specific benchmarking exercises or referential used to measure cybersecurity development, risk-assessment strategies, cybersecurity audits, and other tools and activities for rating or evaluating resulting performance for future improvements. For example, based on ISO/IEC 27004 which is concerned with measurements relating to information security management.
[x] Yes
[ ] No

Are cybersecurity risk assessments performed periodically?[b]
A systematic process comprising risk identification, risk analysis and risk evaluation.
[x] Yes
[ ] No

[b]Is there a cybersecurity benchmark for assessing risk?
[x] Yes. See how fast Intelligence Officer Jenny or Surveillant Clarissa can hack into the system in the shortest amount of time. As of now, the Valentian Government's mainframe was hacked within 647 seconds, while the "Internet Mainframe", such as for large corporations and other public websites, are hacked on an average of 400 - 500 seconds.
[ ] No

Are general cybersecurity audits performed?
A security audit is a systematic evaluation of the security of an information system by measuring how well it conforms to a set of established criteria. A thorough audit typically assesses the security of the system's physical configuration and environment, software, information handling processes, and user practices.
[x] Yes
[ ] No

4. Capacity Building Activities
Are public awareness campaigns in cybersecurity developed and implemented?
Public awareness includes efforts to promote widespread publicity campaigns to reach as many people as possible as well as making use of NGOs, institutions, organizations, ISPs, libraries, local trade organizations, community centers, computer stores, community colleges and adult education programs, schools and parent-teacher organizations to get the message across about safe cyber-behavior online. This includes actions such as setting up portals and websites to promote awareness, disseminating support material and establishing cybersecurity adoption.
[x] Yes
[ ] No

Do public awareness campaigns target...
[x] organizations?
[x] civil society?
[x] adults?
[x] youth & children?
[ ] other related bodies?
[ ] Not Applicable

Is there a framework for the certification and accreditation of cybersecurity professionals?
Existence of a government-approved (or endorsed) framework (or frameworks) for the certification and accreditation of professionals by internationally recognized cybersecurity standards. These certifications, accreditations and standards include, but are not limited to, the following: Cloud Security knowledge (Cloud Security Alliance), CISSP, SSCP, CSSLP CBK, Cybersecurity Forensic Analyst (ISC²), GIAC, GIAC GSSP (SANS), CISM, CISA, CRISC (ISACA), CompTIA, C|CISO, CEH, ECSA, CHFI (EC Council), OSSTMM (ISECOM), PCIP/CCISP (Critical Infrastructure Institute), , Q/ISP, Software Security Engineering Certification (Security University), CPP, PSP, PCI (ASIS), LPQ, LPC (Loss Prevention Institute), CFE (Association of Certified Fraud Examiners), CERT-Certified Computer Security Incident Handler (SEI), CITRMS (Institute of Consumer Financial Education), CSFA (Cybersecurity Institute), CIPP (IAPP), ABCP, CBCP, MBCP (DRI), BCCP, BCCS, BCCE, DRCS, DRCE (BCM), CIA, CCSA (Institute of Internal Auditors), (Professional Risk Managers International Association), PMP (Project Management Institute), etc.
[x] In the public sector
[ ] In the private sector
[ ] No

Does your government develop or support any professional training courses in cybersecurity...
Existence of national or sector-specific educational and professional training programs, promoting cybersecurity courses in the workforce (technical, social sciences, etc.) and promoting certification of professionals in either the public or the private sector.
[x] for law enforcement (police officers and enforcement agents)?
[x] for judicial and other legal actors (judges, solicitors, barristers, attorneys, lawyers, paralegals, etc.)?
[x] for organizations?
[x] for the public sector?
[x] for civil society? Free courses are available for ALL the sectors. 3 hour / day courses, come at your own convenience.

Does your government develop or support any educational programs or academic curricula in cybersecurity?
Existence and the promotion of national education courses and programs to train the younger generation in cybersecurity-related skills and professions in schools, colleges, universities and other learning institutes. Cybersecurity-related skills include, but are not limited to, setting strong passwords and not revealing personal information on line. Cybersecurity-related professions include, but are not limited to, cryptanalysts, digital forensics experts, incident responders, security architects and penetration testers.
[x] In primary school.
[x] In secondary school.
[x] In higher education
[ ] No

Is there investment in cybersecurity research and development programs?
Cybersecurity research programs include, but are not limited to, malware analysis, cryptography research and research into system vulnerabilities and security models and concepts. Cybersecurity development programs refer to the development of hardware or software solutions that include but are not limited to firewalls, intrusion prevention systems, honey-pots and hardware security modules. The presence of an overarching national body will increase coordination among the various institutions and sharing of resources.
[x] In the public sector
[ ] In the private sector
[x] In higher education institutions and academia
[x] In a nationally recognized institutional body overseeing cybersecurity research and development activity
[x] In a recognized institutional body overseeing cybersecurity capacity building activities
[ ] No

Are there any government incentive mechanisms to encourage capacity building in the field of cybersecurity?
Any incentive efforts by government to encourage capacity building in the field of cybersecurity, whether through tax breaks, grants, funding, loans, disposal of facilities, and other economic and financial motivators, including dedicated and nationally recognized institutional body overseeing cybersecurity capacity-building activities. Incentives increase the demand for cybersecurity-related services and products, which improves defenses against cyberthreats.
[x] Yes
[ ] No

Is there a homegrown cybersecurity industry?
A favorable economic, political and social environment supporting cybersecurity development will incentivize the growth of a private sector around cybersecurity. The existence of public awareness campaigns, manpower development, capacity building and government incentives will drive a market for cybersecurity products and services. The existence of a home-grown cybersecurity industry is testament to such a favorable environment and will drive the growth of cybersecurity start-ups and associated cyber insurance markets.
[x] Yes. Started off by Intelligence Officer Jenny, the Valentian Cybersecurity System currently protects the entire Internet system in the Valentian territory.
[ ] No

Is there a cyber insurance market?
Cyber-insurance is an insurance product used to protect businesses and individual users from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities.
[ ] Yes
[x] No. If there is a damage, we will fix it for free. Just come on down with the problems you face.

Is there any support provided to cybersecurity startups and development?
Mechanisms in place to support development of cybersecurity start-ups (tax incentives, technology parks, free trade zones etc.) and for SMEs (Small and Medium Size Enterprises).[i]
[x] Yes
[ ] No

5. Cooperative measures
Are there any bilateral agreements for cybersecurity cooperation with...
[i]Bilateral agreements (one-to-one agreements) refer to any officially recognized national or sector-specific partnerships for sharing cybersecurity information or assets across borders by the government with one other foreign government, regional entity or an international organization (i.e. the cooperation or exchange of information, expertise, technology and other resources).
[x] nation states or member states?
[x] international organizations?
[ ] none of the above?

Are the agreements...
[x] legally binding?
[x] for information sharing?
[x] for asset sharing?
[x] non-legally binding, informal?
[x] pending ratification?
[ ] Not Applicable

Are there any multilateral agreements on cybersecurity cooperation?
Multilateral agreements (one to multiparty agreements) refers to any officially recognized national or sector-specific programs for sharing cybersecurity information or assets across borders by the government with multiple foreign governments or international organizations (i.e. the cooperation or exchange of information, expertise, technology and other resources). It may also include ratification of international agreements regarding cybersecurity, such as African Union Convention on Cyber Security and Personal Data Protection, Budapest Convention on Cybercrime and others.
[x] Yes
[ ] No

Are the agreements...
[x] legally binding?
[x] for information sharing?
[x] for asset sharing?
[x] non-legally binding, informal?
[x] pending ratification?
[ ] Not Applicable

Does your organization/government participate in international forums or associations dealing with cybersecurity?
[x] Yes. ICly, yes. OOCly... not at the moment.
[] No

Are there any public-private partnerships in place?
Public-private partnerships (PPP) refer to ventures between the public and private sector. This performance indicator can be measured by the number of officially recognized national or sector-specific PPPs for sharing cybersecurity information (threat intelligence) and assets (people, processes, tools) between the public and private sector (i.e. official partnerships for the cooperation or exchange of information, expertise, technology and/or resources), whether nationally or internationally.
[x] With local companies
[ ] With foreign companies
[ ] No

6. Child online protection
Are there any measures protecting children online?
[x] Yes. We use actual Moderators to take down those blasted videos, which are clearly not for children!
[ ] No

Is there legislation related to child online protection?
[x] Yes
[ ] No

Is there an agency or entity responsible for child online protection?
[x] Yes
[ ] No

Is there an established public mechanism for reporting issues associated with child online protection?
[x] Yes
[ ] No

Are there any technical mechanisms and capabilities deployed to help protect children online?
[x] Yes. Limits, human-curated whitelists of websites deemed safe for children, etc.
[ ] No

Has there been any activity by government or non-government institutions to provide knowledge and support to stakeholders on how to protect children online?
[x] Yes
[ ] No

Are there any child online protection education programs?
[x] For parents
[x] For educators
[x] For children
[ ] No

Is there a national strategy for child online protection?
[x] Yes
[ ] No

Are there public awareness campaigns on child online protection?
[x] For adults
[x] For youth
[x] For children
[ ] No

Signature of Primary Contact
Intelligence Officer Jenny Claudia Joy Lena Linette “Sombra” Marce Tanya Whitney Hoshiko Radiance, White-hat Hacker and IT curator for the Valentian Government.

Signature of Head of Government
Valentijn “De Sierlijke en Vrij Valkyrie General” Samantha Maxwell Delta Weston Stijn Angelus Tracey Mitchell Constantine Sein Lin Zaw Naing, Leader of Valentine Z and its Autonomous States.

Signature of Chief Record Keeper/Secretary of State
Head Secretary Jamie Izabella Maxie Clara Pernella Ellie Marie Valerie Ruby Æstriðr F. Millicent Eirian, Chief of Bookkeeping.