About this phase
The purpose of this phase is to develop the text of the strategy by engaging key stakeholders from the public sector, private sector and civil society through a series of public consultations and working groups. This broader group of stakeholders will be responsible for contributing to the overall vision and scope of the strategy, setting high-level objectives, taking stock of the current situation (detailed in Phase II), prioritising objectives in terms of impact on society, citizens and the economy, and ensuring the necessary financial resources.
For advice on this phase see the ‘Guide to developing a national cybersecurity strategy’; Second Edition, 2021, p.22.
What are preconditions for this phase?
The start of the Production phase is best triggered by a formal decision from a political leadership (i.e. ministerial) level. This ensures that the strategy production has the necessary political leadership support and gives the final product a big chance of being adopted and implemented. The lead official(s) will need resources to produce the strategy, which may include a small team of staff and funding for workshops, commissioning further research and a launch event.
Before the Production phase begins it will help the lead official focus their efforts to know which national goals the strategy should support and how the political leadership prioritise these. This will prevent a scenario, for example, in which a strategy is produced focusing on the goal of national defence only to learn at the end that ministers wanted a strategy orientated towards economic prosperity. Of course, a national cybersecurity strategy could support both national goals, and more. It is the relative priorities of these goals in relation to cybersecurity that is important to understand at this point.
The Production phase also requires information inputs that should have been gathered at the Stocktaking and Analysis phase. These include identification of critical functions/assets and an assessment of current protective measures, national cyber capacity, threats and landscape. Further information can be gathered and analysed during the Production phase, but it is best to gather as much as possible before entering it.