Ireland’s first publicly available plan to deal with national cyber emergencies has been published.
The State watchdog, the National Cyber Security Centre (NCSC), has set out the process by which an emergency could be declared, managed and co-ordinated.
The National Cyber Emergency Plan (NCEP) has three different levels, including a permanent mode, which relates to the normal course of business; a warning mode which indicates a heightened risk of an emergency incident; and a full activation mode which is triggered when an incident is under way or imminent.
The plan states that a full activation mode can also be triggered when there is an incident in another EU member state.
The plan provides a framework of how cyber emergencies will be dealt with by the State.
The plan states that a full emergency mode will be activated if the incident meets the threshold of a national “cyber emergency”, which requires the activation of the National Emergency Co-ordination Group (NECG Cyber).
A cyber emergency is defined as any cyber incident which causes or threatens to cause death or serious injury or damage to property, the environment or the economy or significant incidents impacting two or more critical sectors; and which requires the activation of the National Emergency Co-ordination Group to ensure an effective co-ordinated response for containment, mitigation and recovery.
The plan states: “While most cybersecurity incidents are an ongoing challenge that can be managed without a significant societal or economic consequence, certain incidents can pose significant risk to economic and social activity.
“Responding to cybersecurity emergencies effectively at a national level is a complex undertaking due to the very wide range of potential incidents, and the diverse nature, extent and consequences associated with these.
“An effective response process requires substantial planning and resources, and this capability needs to be exercised on a regular basis.”
In the event that a warning mode is declared, the Office of Emergency Planning (OEP) will email NCEP stakeholders.
The NCSC will be in contact with a potential victim or victims, and share information in relation to the incident in “different directions”.
The plan states that technical details, including the result of forensic analyses of any affected devices or networks, will be shared with other potential victims in the state and potentially also via relevant EU and Nato information sharing networks.
Information relating to potential risks to services or infrastructure in the state will be shared also with key security stakeholders and with lead Government departments or other departments.
It also states that it is likely that regular virtual or in-person briefings of members of the NECG Cyber will take place to maintain situational awareness and prepare for any escalation to full activation mode.
The warning mode ends when the risk is “successfully eradicated”, or the incident is capable of causing severe operational disruption to the sector.
Speaking on the publication of the plan, NCSC director Richard Browne said: “Responding to cybersecurity emergencies effectively at a national level is a complex undertaking due to the very wide range of potential incidents, and the diverse nature, extent and consequences associated with these.
“This plan establishes an architecture for co-ordinating the Government response in accordance with Irish and European legislation and policy.”
