38 DANISH CYBER AND INFORMATION SECURITY STRATEGY 2022-2024 However, in these situations the principle of sectoral responsibility continues to apply, which means that it is the authorities responsible for the relevant sectors who must ensure that a comprehensive overview of the scope of the incident is carried out and the reporting of this to the relevant authorities, including to the Centre for Cyber Security (and to the National Operative Staff if this unit has been established), just as it is the responsibility of the affected authorities, businesses and organisations to manage the incident and its consequences. Depending on the scope and nature of the incident, the Centre for Cyber Security may assist the entities affected by the incident in their response. For instance, the Centre for Cyber Security may carry out technical investigations of cyberattacks with a view to stopping the specific incident, as well as to clarify any methods of attack or vulnerabilities, such that prevention of similar situations can be improved. These investigations will be carried out in close collaboration with the entity that has been subject to the incident. Communication As a general rule, external communication in connection with minor incidents which do not affect several sectors will be managed by the authority responsible for the relevant sector. Communication concerning cyber threats and the current situation report as well as other crisis communication in connection with cyber incidents is the responsibility of the Centre for Cyber Security in collaboration with the authority responsible for the relevant sector. In connection with the majority of major cyberattacks there will be a need for both general investigations and technical, ICT-security investigations. To this end, close cooperation has been established between the police (including the Danish Security and Intelligence Service) and the Centre for Cyber Security. This cooperation entails mutual briefing in the event of major cyber incidents, including intentional attacks. Similarly, concerted operational efforts will typically be implemented in connection with specific incidents. Government bodies with crosssectoral responsibility for cyber and information security Public authorities’ work with cyber security will be supported through assistance, information, guidance and advice from government bodies with cross-sectoral and coordinating functions in the field. Public authorities must actively request the assistance they require. Communication will need to be coordinated in the event of a major, cross-sectoral incident. This coordination is the responsibility of the Central Operational Communication Staff (DCOK) under the auspices of National Operative Staff (NOST). The DCOK is responsible for ensuring rapid disclosure and coordination of relevant information to the general public, including to the media. The DCOK is also tasked with establishing ad hoc units from which the public can obtain further information concerning the specific incidents.