About this phase
The purpose of this phase is to collect data to assess the national cybersecurity landscape and the current and future cyber-risk landscape to inform the drafting and development of the National Cybersecurity Strategy. The output of this exercise may be a report that provides an overview of the strategic national cybersecurity posture and risk landscapes. Such a report would be submitted to the Steering Committee overseeing the strategy production, where one has been established.
Before beginning the actual production of the text of the strategy, the lead official(s) for producing the strategy should carefully analyse and assess the information gathered during the stocktaking phase to ensure that any gaps in cybersecurity capacity are identified and options for addressing them presented. The analysis should result in an assessment of how far the existing policy, regulatory and operational environments meet the stated objectives of the strategy and highlight where they fall short. Similarly, it should be used to identify specific key issues, such as educational and training gaps. Lastly, the analysis should result in an assessment of all relevant and desirable outcomes for the strategy, as well as the potential effects and outcomes of means chosen.
For advice on this phase see the ‘Guide to developing a national cybersecurity strategy’; Second Edition, 2021, p.20.
What are preconditions for this phase?
By the start of the Stocktaking and Analysis, the political direction that was a precondition for Initiation should have developed to leadership support and the lead official should have been given the resources to conduct the stocktaking and analysis. Leadership support might mean that the minister(s) and/or senior official(s) above the lead official have supported them by helping secure the necessary resources and the necessary support from the other government ministries and agencies that will be involved in the stocktaking and analysis. They may also have helped them set up a steering committee for the strategy production.