Dr. Richard Browne:

For dealing with any cybersecurity risks it is us. NSAC does not have an operational role. It is a co-ordination body more than anything else.

The Chairman asked a specific question about what we are doing to prepare for potential incidents. I referred to it in my statement. We have a substantial incident-response capability ourselves and we work with and procure incident response services to keep as a reserve in case of larger incidents or particular technological challenges that might emerge during incident response processes such as analytical capability, deployed resources and various other things. In this kind of context, what we have done as part of this process and working with European colleagues is identify the number of potential incident types that might arise in the context of, for example, sanctions or related issues. Then we worked with regulators and potential victims to ensure both the incident response planning and the mitigations to deal with the incident types are in place and that we have a co-ordination role that is standing and ready to go if there were to be an incident.