DANISH CYBER AND INFORMATION SECURITY STRATEGY 2022-2024 The cyber and information security work is organized according to the principle of sectoral responsibility. This means that the authority, which has day-to-day responsibility is also responsible in the event of a serious incident. This applies with respect to daily preparedness, during an ongoing incident and in connection with recovery work following an incident. Intra-sector incidents The entity (authorities, businesses and organisations) which has day-today responsibility for a given service or function will continue to have this responsibility in the event of a cyber incident. In connection with this, the entity must ensure that it receives assistance from any operational supplier. Furthermore, the entity may request assistance from decentralised cyber security units. The entity is responsible for requesting this Principle of sectoral responsibility 37 assistance and for preliminary incident management. Furthermore, depending on the scope of the incident, the entity is responsible for reporting the incident to all competent authorities and to the Centre for Cyber Security. Finally, the entity is responsible for any external communication concerning the incident. Major cross-sectoral incidents In connection with major cyber incidents that affect several sectors, The National Operative Staff (NOST, which includes among its permanent members the Danish National Police, the Danish Security and Intelligence Service and the Danish Defence Intelligence Service/the Centre for Cyber Security) may be activated. Among other things, the principle of sectoral responsibility implies that: 1. All ministers must ensure an appropriate emergency response within their own remit. 2. Sector-specific responsibility encompasses all critical functions and services required by law, politically or administratively. 3. The authorities’ emergency response planning must be based on an ongoing and systematic risk assessment process, for which management assumes overall responsibility. 4. The public authorities must monitor the risk scenario for their own sector on a regular basis.