The check shall not encompass private communications or communications with
undertakings which are not covered by the act. If the check nevertheless intercepts such
communications, the check shall be stopped immediately, and information to which the
check has secured access shall be erased.
All persons who have access to information as specified in the third paragraph in
connection with work or service for the National Security Authority have a duty of secrecy
in respect of the content of such information.
The National Security Authority shall notify the management of the undertaking of the
methods to be used in the check and the National Security Authority's assessment of the
risk that the check may intercept communications as specified in the third paragraph. If
the management of the undertaking concludes that the objective of information system
security cannot justify the methods and the risk, the check shall not be performed.
Information to which the check provides access may only be used for the purpose of the
check. When the information is no longer required, it shall be erased. Knowledge and
experience acquired by the National Security Authority through the check may be used in
the further development of the National Security Authority's general security work.
The National Security Authority shall issue a report to the undertaking on the results of
the check. The report shall only contain information which may help to improve the
undertaking's security.
The King may issue regulations on communication and content monitoring of
information systems, and regulations authorising the performance of such checks by
parties other than the National Security Authority.
Chapter 7. Object and infrastructure security
Section 7-1.Critical national objects and infrastructure
Objects and infrastructure are nationally critical if fundamental national functions may be
harmed if their functionality is reduced or they are subjected to vandalism, damage or
unlawful seizure.
Ministries shall designate, classify and maintain an overview of critical national objects
and infrastructure in their areas of responsibility. All identified and classified objects and
infrastructure shall be notified to the National Security Authority together with a
specification of the classification category.
The National Security Authority shall identify, classify and maintain an overview of
critical national objects and infrastructure which do not fall within the area of
responsibility of any ministry.
Undertakings which control objects or infrastructure identified pursuant to the second or
third paragraph shall be notified of such identification.
14/30