Soft policies --- @Vlada, I agree with your elaboration. What I meant was that developing states that lag behind in implementing cyber strategies don't have the luxury to rely upon just and only on soft policies. Such states have to seriously focus on the cybersecurity agenda, to research and adapt foreign good practices and in the same time implement legislation (they have to do these things simultaneously in shorter time-frames, because if they don't, probably, the vulnerabilities of such states will increase and they will become an easy pray for the ever-advancing cyberattacks/cybercrime. Worse, the cyber-gap (in comparison to developed states) will become bigger, making it even harder to advance and catch-up. What I mostly think of when I say legislation/hard policies is strict laws regarding cybercrime and international cooperation related to cybercrime, as well as laws for protecting CI/CII. On the other hand, I too, agree with you and @Bennette, that soft policies are irreplaceable tool when it comes to reaching to the wider public, training, awareness raising and education!

Source author: Vladimir Nikolov vladimir984@yahoo.com