Duration of cybersecurity strategies --- Good point - it seems the pace of tech development (and risks) is increasing, and 4-years strategy may seem a too far fetch. On the other hand, a strategy should be multi-year if it is to be a strategy, not an operational document.

In practice, countries seem to stick to 3-5 years-long cybersec strategies. What seems to be necessary, however, is to have a more flexible - and inclusive - action plan, probably revised more often, in order to adjust to the changing reality.

Any (good) hands-on experiences in this regards?

Source author: Vladimir Radunovic vladar@diplomacy.edu