One of the main elements should be a process involving many stakeholders, who understand their impact and role. If one agency or institution develops the strategy alone, without consulting other stakeholders, it is not going to work. Ownership and shared responsibility are key. Of course, political support and the allocation of resources are also needed – if these are lacking, the development of the strategy will never be prioritised and is unlikely to ever be implemented. Finally, a clear action plan setting concreate measurable activities is essential to ensure that the strategy is implemented rather than filed away.

For those doing it for the first time, the guide is like a bible, a source of inspiration. If you are unsure where to start or what to consider, it is an invaluable resource. A large part of the strategy is dedicated to governance and priorities, an area in which many countries struggle, so having guidelines with concrete examples is extremely helpful.

However, it is important to highlight that, due to the ever-changing nature of the cybersecurity landscape, the strategy should be a ‘living document’. To keep it up to date and relevant, regular checks and monitoring are necessary. It is recommended that this is done at least once a year, with a clear definition of who is responsible for doing so.

Ultimately, coordinating the National Cybersecurity Strategy is a matter of accountability to the whole country. Therefore, it is essential to track progress and ensure that the allocated budget is sufficient to achieve the planned objectives.