Dr. Richard Browne:

The IAEA does great work. I was delighted to see the publication of this piece, which is a very valuable contribution to the discussion and debate. I note also that the piece references the 2019 national cybersecurity strategy in the bibliography. However, I would point out that that same strategy outlined on page 20 the existing - at that point in 2019 - information sharing roles that the NCSC had. In fact, if we go through the remainder of that IAEA report, several other aspects of the recommendations were implemented five years ago, so much of what is in here is already in place and has been in place for a long time.

To answer the question directly, the extent of the gap that the IAEA report suggests has not existed in five or six years, particularly since the transposition into law here of the network and information systems directive, NIS 1, in September 2018, so, by law, this was done five years ago, or very nearly. However, and this has been instrumental in what we have done in government to begin with, the depth and utility of that sharing can always be improved. In talking to colleagues all around the world on this, everybody has had the same problems and the same discussions. What we have done in the CORE model means it is a deliberately different model; it is much more involved and labour-intensive, and involves much more than us just showing up with information. We have been issuing advisories, alerts and notifications to entities in the State on cybersecurity for more than a decade now, so we have been sharing this information for ten years. We have at least three times, if not four, completely revised how we do that. The Gov CORE and the ensuing and coming COREs in local government, energy and digital infrastructure - we have plans for more beyond that - are far deeper than that.

To answer the question directly, I do not fully agree with what is in the IAEA report. Using just public domain information, we can very readily show that we were doing this a long time ago. There is always a case for us to continually assess and improve what we do, and this is what we are doing.