National Cyber Security Centre publishes Ireland's National Cyber Emergency Plan

The plan sets out the national approach for responding to serious cyber security incidents that affect nationally important systems and networks

Today sees the publication of Ireland's National Cyber Emergency Plan (NCEP), developed following extensive engagement throughout both the public and private sectors and two sector-specific emergency exercises in 2022 and 2023, as well as lessons learned from the HSE ransomware attack in 2021.

The plan outlines the process by which a National Cyber Emergency is declared, managed and co-ordinated. It ensures that everyone understands their roles and responsibilities during a cyber emergency, and that the government's approach to serious cyber incidents is clearly explained and communicated to the public.

Cyber security incidents are diverse by their nature and, as such, there are a vast range of potential scenarios where the plan may be initiated. This, in turn, has ensured that a very flexible response process has been in-built during its development.

The activities described in the NCEP rely upon three co-operation modes:

Permanent Mode: Relates to the normal course of business, during which situational awareness is maintained and incident preparedness activities are carried out
Warning Mode: This is activated when evidence indicates that there is a heightened risk of a 'cyber emergency' type incident emerging in a specific sector or sectors. It involves communications with stakeholders across government and in the private sector as appropriate
Full Activation Mode: This is activated if an incident occurs that meets the threshold of a national cyber emergency which requires the activation of the National Emergency Co-ordination Group chaired by the National Cyber Security Centre (NCSC) to ensure an effective, co-ordinated multi agency and cross-government response for containment, mitigation or recovery

Speaking on the publication on the plan, the NCSC Director Richard Browne said:

"Responding to cyber security emergencies effectively at a national level is a complex undertaking due to the very wide range of potential incidents, and the diverse nature, extent and consequences associated with these. This plan establishes an architecture for coordinating the government response in accordance with Irish and European legislation and policy.”

The primary audience for the plan are officials from government departments/agencies who have a role in the response to national cyber emergencies and potential victim organisations (providers of essential public and private services), including but not limited to senior officials, communications staff, and personnel who have responsibilities relating to incident response within their organisation.

The publication of the plan ensures seamless co-ordination with the national approach to emergency management as established in the 'Strategic Emergency Management (SEM) National Structures and Framework'. This framework is designed to enhance the protection, support, and welfare of the public in times of emergency by ensuring that fit-for-purpose national structures and procedures are in place to deal with a broad spectrum of emergencies, whether of internal or external origin.

As the plan has been developed in alignment with the Strategic Emergency Management National Structure and Framework, it establishes the structures for co-ordinating a "whole of society" approach to preparing for and responding to a cyber emergency.

The plan is available on the NCSC website.

ENDS

Notes to the Editor

A senior official from the NCSC (National Cyber Security Centre) may be available for media engagements on this topic. Requests should be sent to the Press Office (Media Relations Unit) in the Department of Environment, Climate and Communications ( press.office@decc.gov.ie or 0876937580).

A cyber emergency is defined as any cyber incident which causes, or threatens to cause:

death or serious injury or damage to property, the environment or the economy, or significant incidents impacting two or more critical sectors
and which requires the activation of the National Emergency Coordination Group (NECG Cyber) to ensure an effective coordinated response for containment, mitigation or recovery

The Strategic Emergency Management Framework is available on the Department of Defence website.