When can private organizations become subject to the Norwegian Security Act?

Organizations may be brought within the scope of the Act if they process classified information or are of critical importance to fundamental national functions.

What does preventive security work under the Norwegian Security Act involve?

Organizations covered by the Act must work systematically with preventive security, including security management, regular risk assessments, and measures to maintain an adequate level of security.

What should a risk assessment under the Norwegian Security Act consider?

Risk assessments should consider threats, vulnerabilities, consequences, and the organization's dependencies.

What does the Norwegian Security Act protect?

The Act regulates the protection of classified information, information systems, objects, and infrastructure.

What are fundamental national functions?

Under the Security Act, the term refers to functions of such importance that organizations connected to them may become subject to the Act's requirements.

Sicra can assist with security assessments based on NSM's basic principles, risk assessments, security strategy, and maturity assessments. This can provide organizations with a structured basis for evaluating their security posture, risks, and improvement needs.

Norwegian Security Act

What is the Norwegian Security Act?

The Norwegian Security Act is Norway's legislation on national security. Its purposes include protecting Norway's sovereignty, territorial integrity, democratic system of government, and other national security interests, as well as preventing, detecting, and countering activities that threaten national security. The Act entered into force on January 1, 2019.

The Act applies to state, county, and municipal authorities and to suppliers involved in security-classified procurements. Ministries may also decide that other organizations are fully or partly subject to the Act, including organizations that handle classified information or are of critical importance to fundamental national functions.

Organizations subject to the Act must carry out systematic preventive security work. This includes security management, regular risk assessments, and measures necessary to maintain an adequate level of security. Risk assessments must consider areas such as threats, vulnerabilities, consequences, and dependencies on other organizations.

The Act also regulates the protection of security-sensitive information, information systems, objects, and infrastructure, as well as personnel security, security-classified procurements, and ownership control.

Sicra and the Norwegian Security Act

For organizations subject to the Security Act, risk management, security management, and maintaining an adequate level of security are central requirements. This requires visibility into assets, threats, vulnerabilities, dependencies, and existing security controls.

Sicra provides security analyses based on NSM principles, assessing an organization's current security posture, risks, and areas for improvement. Sicra also supports organizations through security strategy and maturity assessments that can provide a structured foundation for further security work.

Services

Security analysis – NSM principles

Security maturity assessment

Security strategy

NIS2 and ISO27001

Need Assistance?

We are happy to have a non-binding conversation.