Cyber Strategy Workshop for African Union Member States July 23-27, 2018 Addis Ababa, Ethiopia

National Cyber Strategy Preparedness: 8 Preparatory Questions

The 8 Preparatory Questions Activity Introduction to the 8 Preparatory Questions for Developing and Implementing a National Cyber Strategy National teams review and discuss each question @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

1. Is the Internet part of your development plan 1. Is the Internet part of your development plan? Is it as important as Roads? Water? Electricity? Internet access can provide citizens with health, economic, and knowledge benefits. It is an essential pre-requisite for nations to be a part of the digital global economy. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

2. Does Leadership Prioritize Cyber Capacity Building? An effective cyber strategy will requires cross-government agreement about its importance. Cyber capabilities and processes are interconnected, it is difficult to implement in only part of the government or in some industries. Broad commitment is usually necessary in order to provide resources, coordinate implementation, and convincingly communicate to the larger society. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

3. Do you have Defined Cyber Stakeholders? Cyberspace connects: Government Industry Academia Individuals Cyberspace involves: ICT Infrastructure Data Regulations Technologies Legal issues Ethical issues @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

4. Do Stakeholders have Roles and Responsibilities? Different entities will need to have defined roles because cyberspace impacts many parts of society. Identifying Stakeholders isn’t enough, each entity needs to know what their roles are, what part they play, and what their responsibilities are. Stakeholders also need to be held accountable and to understand the metrics used to measure success. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

5. Are the Stakeholders Regularly Involved? It is important that stakeholders are working together to solve cyber issues and have regular opportunities to connect. Having stakeholders who are not actively involved will weaken your ability to coordinate and deconflict cyber activities. Stakeholders who coordinate regularly are more likely to find common goals and objectives, which enables leveraging and sharing of resources. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

6. How do Stakeholders Communicate? Formal structures for stakeholders to communicate about priorities, roles, and responsibilities, and to coordinate efforts are important to start progress and maintain momentum. If there isn’t structure it can be difficult to ensure everyone’s priorities and resource needs are accounted for. There can be more than one approach depending on the goal – forums can be government only, industry only, public-private focused, or based on specific initiatives. Choose the format that is best for the needs of implementing a national strategy. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

7. Is there a Legal Framework for Cyberspace? A legal framework should include things like: Institutionalizing cyber roles and responsibilities Legitimizing electronic transactions Defining online theft and fraud Setting cybercrime investigations, prosecution, and judicial procedures and standards Addressing privacy, regulatory, and security concerns @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

8. Are There Dedicated Government Resources for Cyber Capacity Building? Even the most basic cyber strategy will require resources to execute. Resources mean not only money, but also manpower and training, infrastructure and necessary partnerships. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

Answering the 8 Preparatory Questions In your packet, you have a copy of the 8 Questions and an Answer Table Using the Answer Table and working in national groups, answer the 8 Questions to the best of your ability with Yes; Yes, However, or No; No, However. This process will be facilitated by the speaker and groups will discuss and record each question Designate one member of the delegation to record answers on the hardcopy Answer Table Designate another delegation member to record answers on the on-line survey tool When you are finished answering the questions, turn in the Answer Table to a facilitator. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

Survey Monkey Access https://www.surveymonkey.com/r/ZCP6FSC to input your results. @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

National Results – Delegation Nation________________ Question Yes Yes, However No No, However 1. Is internet connectivity a significant part of your country’s national development plan?  2. Does a broad segment of the government (and all key decision makers) agree that cyber capacity building is a national priority? 3. Does your country have a defined set of cybersecurity stakeholders? 4. Have roles and responsibilities been identified for cybersecurity stakeholders? 5. Are stakeholders consistently involved in resolving cyber-related issues such as strategy, policy, legislation, or national priorities? 6. Is there an organizational structure or some other formal means by which stakeholders communicate about cyber or technology priorities, roles, and responsibilities, and coordinate their efforts? 7. Does your country have a legal framework that applies to cyberspace? 8. Can the government realistically identify and commit resources for cyber capacity building?  TOTALS @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155

Questions? @ 2018 The MITRE Corporation. All rights reserved. Approved for Public Release. Distribution Unlimited. Case 17-2155