Among many multilateral cyber diplomacy processes, one of the most tangible is the set of 16 confidence-building measures (CBMs) on cyber/ICT security developed by the Organisation for Security and Cooperation in Europe (OSCE). These CBMs were endorsed by the OSCE participating states in 2016, and since then both the OSCE and its member states have taken great strides towards their practical implementation.
As part of this effort, the OSCE has published a new Handbook on National Cyber Incident Classification (pdf), co-authored by James Shires and Serge Droz. The handbook is designed primarily to assist states with CBM 15 on critical infrastructure protection, and so gives concrete recommendations for states to set up a cyber incident classification system for national critical infrastructure. More broadly, it also serves as a helpful guide for all states to better coordinate and react to cyber incidents, especially across multiple sectors and involving public and private stakeholders.
The handbook is divided into six steps, from setting the goals and engaging stakeholders to implementing, testing and refining the system. Throughout, the handbook emphasizes that a national cyber incident classification system should lower barriers to information sharing and build on existing – and trusted – structures wherever possible. In this way, it also builds on and expands the recommendations of the OSCE’s previous Good Practice Guide to cyber incident classification.
To turn often abstract discussions into clear legal, policy, and technical actions, the handbook accompanies each step with illustrative examples of that step taken by two contrasting fictional states. The first state has a centralized governance model, driven by a top-down approach with clearly defined security priorities, while the second is more federalized, with decision-making powers in many areas delegated to regional provinces. Despite their different characteristics, both states can follow the steps of this handbook to develop national cyber incident classification systems that are appropriate and effective in their contexts.
At Virtual Routes, we look forward to working with the OSCE to translate the steps of the handbook into practical impacts, across the OSCE participating states and beyond.
