<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="metricconverter"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
h1
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:24.0pt;
font-family:"Times New Roman";
font-weight:bold;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1269461271;
mso-list-template-ids:-2018210822;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:1314289805;
mso-list-template-ids:-126061808;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:1657296159;
mso-list-template-ids:-387027234;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style>
</head>
<body lang=FR link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Bonjour Anne,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Un peu de Français de temps en temps car,
nous autres sommes limités en Anglais.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Cordialement.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>De :</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
africann-bounces@afrinic.net [mailto:africann-bounces@afrinic.net] <b><span
style='font-weight:bold'>De la part de</span></b> Anne-Rachel Inné<br>
<b><span style='font-weight:bold'>Envoyé :</span></b> lundi 30 mars 2009
18:52<br>
<b><span style='font-weight:bold'>À :</span></b> africann@afrinic.net<br>
<b><span style='font-weight:bold'>Objet :</span></b> [AfrICANN-discuss]
Protecting Critical Information Infrastructures:Something for RECs to think
about?</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<h1><b><font size=6 face="Times New Roman"><span style='font-size:24.0pt'>Protecting
Critical Information Infrastructures: Frequently Asked Questions<o:p></o:p></span></font></b></h1>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What are Critical Information Infrastructures?</span></font></b><o:p></o:p></p>
<p><b><u><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>There is no globally shared definition of Critical
Information Infrastructures (CII).</span></font></u></b> In its <a
href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2005:0576:FIN:EN:PDF">Green
Paper on a European Programme for Critical Infrastructure Protection</a>
(EPCIP), the<b><span style='font-weight:bold'> </span></b>European Commission
captured the concept of CII as being all<b><span style='font-weight:bold'> </span></b><i><span
style='font-style:italic'>"ICT systems that are critical infrastructures
for themselves or that are essential for the operation of critical
infrastructures (telecommunications, computers/software, Internet, satellites,
etc.)".</span></i> In 2008, the OECD defined CII as <i><span
style='font-style:italic'>"those interconnected information systems and
networks, the disruption or destruction of which would have a serious impact on
the health, safety, security, or economic well-being of citizens, or on the
effective functioning of government or the economy".</span></i><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Despite
the existing differences in national and international policy contexts, what is
important is that the notion of CII is conducive to a holistic policy
perspective on the secure and continuous functioning of ICT systems, services,
networks and infrastructures (ICT infrastructures) of which the Internet is a
very important component, due to its widespread diffusion and the process of
technological convergence. <o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>Why is action at EU level to protect these infrastructures
urgently needed?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Cyber
attacks have risen to an unprecedented level of sophistication. What used to be
simple experiments are now turning into sophisticated activities performed for
profit or political reasons. The recent large scale cyber-attacks on Estonia,
Lithuania and Georgia are the most widely covered examples of a general trend.
The huge number of viruses, worms and other forms of malware, the expansion of
botnets<a name=fnB1></a><a
href="http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/09/141&format=HTML&aged=0&language=EN&guiLanguage=en#fn1"><b><sup><span
style='font-weight:bold'>[1]</span></sup></b></a> and the continuous rise of
spam confirms that this is a severe problem. <o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The high
dependence on CII, their cross-border interconnectedness and interdependencies
with other infrastructures (e.g. energy infrastructures), as well as the
vulnerabilities and threats they face raise the need to address their security
and resilience in a systemic perspective as the frontline of defence against
failures and attacks.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Because
of the transnational dimension of this issue, a more integrated and coordinated
approach throughout the European Union will usefully complement and add value
to the programmes which are already in place within Member States. This will
also reinforce the wealth creation capabilities of the Single Market.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>It is
clear that no single "silver bullet" solution will be able to provide
all the answers, but simply leaving the situation as is will not lead to
satisfactory results. It is necessary to establish the right policy framework –
in particular for economic and societal drivers and incentives – on the basis
of a shared responsibility and cooperation amongst all the involved
stakeholders. It is vital to promote operational/ tactical cooperation in the
short and medium term (until 2010-2011) as well as strategic policy discussion
for long-term scenarios (2012 and beyond). The work must start now in order to
prepare Europe against large-scale cyber attacks and disruptions. <o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>How does this initiative relate to the debate around European
efforts towards an increased and modernised network and information security
policy?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
Commission's initiative on Critical Information Infrastructure Protection
focuses on prevention, preparedness and awareness and defines a plan of
immediate actions running until 2011 to strengthen the security and resilience
of CII. The focus and timeframe are consistent with the debate launched at the
request of the Council and the European Parliament to address the challenges
and priorities for network and information security policy and the most
appropriate instruments needed at EU level to tackle them beyond 2012. The work
conducted and the lessons learned under the Commission's proposed action plan
will be an important contribution to the more general debate on an increased
and modernised European policy in this area.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>Why is the Commission proposing voluntary rather than binding
measures?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Ensuring
the security and resilience of CII requires cooperation between public and
private actors, which is largely based on trust. A non-binding approach will be
more effective in steering a dialogue through which interested parties can work
out the best way to cooperate and share best practices. During the consultation
process prior to the launch of this initiative, Member States' and private
sector representatives strongly supported the proposed initiative and confirmed
the need and willingness to cooperate at EU level, as long as this remained
voluntary.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>This does
not mean that a binding approach can not be used to enhance the level of
security and resilience of CII. Proposals by the European Commission to reform
the Electronic Communication regulatory package – including provisions to
strengthen operators’ obligations to ensure that appropriate security measures
are taken, and those on mandatory security breach notification – show that
binding measures are considered when it is feasible and useful. <o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Moreover,
there is not yet sufficient data on security incidents and their impact across
the different sectors to define and frame additional regulatory measures in a
consistent economic and public policy perspective.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What are the specific objectives of the Critical Information
Infrastructure Protection initiative? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
Commission's proposal covers the following objectives:<o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l2 level1 lfo1'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Foster cooperation, exchange of information and
transfer of good policy practices between Member States via a
newly-established <b><span style='font-weight:bold'>European Forum</span></b>.<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l2 level1 lfo1'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Develop a <b><span style='font-weight:bold'>public-private
partnership</span></b> at the European level on security and resilience of
CII to support sharing of information and dissemination of good practices
between public and private stakeholders.<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l2 level1 lfo1'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Enhance <b><span style='font-weight:bold'>incident
response capability</span></b> in the EU by increasing national
capacities, possibly built on National or Governmental Computer Emergency
Response Teams/Computer Security Incidents Response Teams (CERTs/CSIRTs)
as well as by encouraging and supporting the European cooperation between
these entities with a view to facilitate the exchange of information,
technical measures and good practices.<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l2 level1 lfo1'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Promote the organisation of <b><span
style='font-weight:bold'>national and European exercises for contingency
planning and disaster recovery</span></b> on simulated large-scale network
security incidents.<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l2 level1 lfo1'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Reinforce <b><span style='font-weight:bold'>international
cooperation</span></b> on global issues, in particular on resilience and
stability of Internet.<o:p></o:p></span></font></li>
</ul>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What is the purpose and value of a European Forum for Member
States? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Although
there are commonalities among the challenges and the issues faced, measures and
regimes to ensure the security and resilience of CII, as well as the level of
expertise and preparedness, differ across Member States.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Purely
national approaches run the risk of producing fragmentation and inefficiency
across Europe. Differences in national approaches and the lack of systematic
cross-border co-operation substantially reduce the effectiveness of domestic
countermeasures, <i><span style='font-style:italic'>inter alia</span></i>
because, due to the interconnectedness of CII, a low level of security and
resilience of CII in a country has the potential to increase vulnerabilities
and risks in other ones.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>To
overcome this situation a European effort is needed to bring added value to
national policies and programmes by fostering the development of awareness and
common understanding of the challenges; stimulating the adoption of shared
policy objectives and priorities; reinforcing cooperation between Member States
and integrating national policies in a more European and global dimension.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>These are
the reasons why the Commission has proposed to establish a <b><span
style='font-weight:bold'>European Forum</span></b> for Member States to share
information and good policy practices on security and resilience of CII.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>Why a Public-Private Partnership for Resilience (EP3R)? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Enhancing
the security and the resilience of CII poses peculiar governance challenges.
While Member States remain ultimately responsible for defining CII-related
policies, their implementation depends on the involvement of the private
sector, which owns or controls a large number of CII. On the other hand,
markets do not always provide sufficient incentives for the private sector to
invest in the protection of CII at the level that public authorities would
normally demand.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>Public-private
partnerships (PPPs) have emerged at the national level as the reference model
to address this governance challenge. However, despite the consensus that this
approach would also be desirable on the EU level, European PPPs have not
materialised so far. <o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>PPP at
the EU level could play an important role to complement the work carried out by
Member States at national level – in particular, in areas like the
exchange/promotion of good policy practices and measures, the implementation of
cross-border security and resilience measures for CII, the adoption of
preventive measures and response strategies, etc.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>A
Europe-wide multi-stakeholder governance framework, which may include an
enhanced role of ENISA, could foster the involvement of the private sector in
the definition of strategic European public policy objectives as well as
operational priorities and measures. The focus would be on enhancing the
security and resilience of CII and the coordination of preventive and response
activities.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>This
framework would bridge the gap between national and EU policy-making and
operational reality on the ground.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What will be the remit and the form of the proposed
Public-Private Partnership? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
concrete remit of this PPP might initially consist of:<o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l0 level1 lfo2'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Knowledge sharing to deepen the understanding and
mastering of European challenges for the security and resilience of CII;<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l0 level1 lfo2'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Identification and dissemination of good baseline
practices and commonly agreed guidelines and standards for the security
and resilience of CII.<o:p></o:p></span></font></li>
</ul>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The work
of this PPP should be focused on specific issues and be action-oriented. The
topics discussed should have a cross-border or global dimension.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>In terms
of form, it is proposed that the setting-up of the <b><span style='font-weight:
bold'>European Public Private Partnership for Resilience (EP3R)</span></b> CII
would follow a step-by-step approach so that, on the one hand, stakeholders
would discuss and design the necessary building blocks that would best match
their requirements and, on the other hand, the work on the key challenges that
require this kind of approach could immediately start. The first step of this
process is the <b><span style='font-weight:bold'>workshop on the EU policy
dimension of vulnerability management and disclosure process</span></b> of 31
March 2009.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What is the role of the European Network and Information
Security Agency in this initiative?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The Commission
has called on the European Network and Information Security Agency (ENISA) to
play a key role in supporting this initiative by encouraging dialogue and
cooperation between Member States, the private sector and other relevant
players across Europe, building on the findings and results it has already
contributed in this area. <o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>How does this initiative relate to the European Programme on
Critical Infrastructure Protection and other EU activities in the area of
justice and home affairs? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
activities planned in today's Communication are conducted under and in parallel
to the <a
href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2006:0786:FIN:EN:PDF">European
Programme for Critical Infrastructure Protection (EPCIP</a>). A key element of
EPCIP is the <a
href="http://register.consilium.europa.eu/pdf/en/08/st10/st10934.en08.pdf">Directive
on the identification and designation of European Critical Infrastructures</a>,
which identifies the ICT sector as a future priority sector. One element of the
CIIP action plan is to further develop the criteria for identifying European
Critical Infrastructures for the ICT sector which will help implement the above
mentioned Directive.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
proposed actions are also complementary to existing <b><span style='font-weight:
bold'>third pillar </span></b>initiatives – e.g. fight against cyber-crime – as
envisaged by the <a
href="http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32005F0222:EN:NOT">Council
Framework Decision on Attacks Against Information Systems adopted in 2005
(2005/222/JHA)</a>. As the CIIP initiative focuses on prevention, preparedness
and awareness to enhance the intrinsic security and resilience of CII, it does
not conflict with or duplicate the efforts carried out under the third pillar,
i.e. by police and judicial cooperation addressing measures to prevent, fight
and prosecute criminal and terrorist activities targeting CII.<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>How does the Commission's action plan relate to international
efforts in this area? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>This
initiatives takes stock and builds upon recognised international principles
such as the <a
href="http://www.cybersecuritycooperation.org/documents/G8_CIIP_Principles.pdf">G8
principles on CIIP</a>, the UN General Assembly Resolution 58/199 '<a
href="http://www.itu.int/ITU-D/cyb/cybersecurity/docs/UN_resolution_58_199.pdf.">Creation
of a global culture of cybersecurity and the protection of critical information
infrastructures'</a> and the recent <a
href="http://www.oecd.org/dataoecd/1/13/40825404.pdf">OECD Recommendation on
the Protection of Critical Information Infrastructures</a>.<o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
initiative complements work conducted by NATO on cyber-security – specifically
the common policy on cyber defence and the activities of the Cyber Defence
Management Authority (CDMA), announced by NATO on April 2008, as well as the
outputs of the <a href="http://transnet.act.nato.int/WISE/TNCC/CentresofE/CCD">NATO's
Cooperative Cyber Defence Centre of Excellence</a> (CCD-COE). NATO initiatives
are mostly focused on military defence whereas the Commission's proposal works
to facilitate the coordination and cooperation of public and private resources
and capabilities across Member States. <o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>Does the action plan include regulatory measures for the
Internet?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
action plan does not propose any measure aimed at regulating the Internet. It
proposes three complementary activities to enhance the resilience and stability
of the Internet. <o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo3'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>The Commission will launch a Europe-wide debate
to define EU priorities for the long-term resiliency and stability of the
Internet. <o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo3'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>The Commission will work with Member States to
define appropriate principles and guidelines for Internet resilience and
stability.<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo3'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>The Commission, together with Member States, will
develop a roadmap to promote these principles and guidelines at the global
level, building upon strategic cooperation with third countries.<o:p></o:p></span></font></li>
</ul>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>What is the timing envisaged by the action plan? </span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
different actions have different targets and timelines, running from 2009 until
the end of 2011. However continuous European efforts will still be needed
beyond <st1:metricconverter ProductID="2011. A" w:st="on">2011. A</st1:metricconverter>
stock-taking exercise will already be conducted at the end of 2010 and lessons
learned will be used as an input into the debate on the future of Network and
Information Security beyond 2012. <o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span style='font-size:12.0pt;
font-weight:bold'>How will the Commission monitor the implementation of the
action plan?</span></font></b><o:p></o:p></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'>The
Commission identified in the <a
href="http://ec.europa.eu/governance/impact/cia_2009_en.htm">impact assessment
of the Communication</a> a number of indicators for achieving the objectives of
the action plan. These include, the number of meetings and conferences
organised at EU level with relevance to security and resilience of CII; the
agreements on common terminology and procedures for the collection and
dissemination of information on economic impacts of security incidents; the
number of National/Governmental CERTs participating in the European
Governmental CERTs Group; the number of international agreements on mutual
assistance, recovery, and remedial strategies for the resilience and stability
of the Internet. <o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'><a
href="http://ec.europa.eu/information_society/policy/nis/strategy/activities/ciip/index_en.htm">http://ec.europa.eu/information_society/policy/nis/strategy/activities/ciip/index_en.htm</a><o:p></o:p></span></font></p>
<p><font size=3 face="Times New Roman"><span style='font-size:12.0pt'><a
href="http://europa.eu/rapid/pressReleasesAction.do?reference=IP/09/494&format=HTML&aged=0&language=EN&guiLanguage=en">IP/09/494</a>
<o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p><a name=fn1></a><a
href="http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/09/141&format=HTML&aged=0&language=EN&guiLanguage=en#fnB1"><b><sup><span
style='font-weight:bold'>[1]</span></sup></b></a> A group of computers, often
very large, that malicious hackers have brought under their control. While most
owners are oblivious to the infection, the networks of tens of thousands of
computers are used to launch spam e-mail campaigns, denial-of-service attacks
or online fraud schemes.<o:p></o:p></p>
</div>
</body>
</html>