DANISH CYBER AND INFORMATION SECURITY STRATEGY 2022-2024 Maturity in working with cyber and information security is generally increasing in Denmark, including among government authorities. However, several key challenges remain, including a lack of understanding of the cyber threat in general, and complex ICT systems that makes the work difficult. Vital societal functions, such as energy supply, rail transport and research, are increasingly digitised, requiring a focus on the critical ICT infrastructure that supports them. There is a need for a better overview of the critical ICT infrastructure and dependencies between the ICT systems that support vital societal functions. Therefore, ministerial areas with responsibility for vital societal functions must have a clear plan for their cyber and information security and be able to participate in operational cooperation and emergency preparedness. Many government agencies lack basic technical security measures and continue not to comply with the established technical minimum requirements. Likewise, the level of security for a large part of the ICT systems critical to society in the central government is currently inadequate. Since 2016, government agencies have been required to follow the international security standard ISO 27001, which sets best practices for information security management. Over a third of the agencies have yet to complete the implementation of the standard. 1 Digital security in Danish SMEs 2021 2 Nationwide Centre for Cybercrime 19 Vital societal functions that are robust and resilient also require that Danish companies have adequate digital security and that the police have the capacity to prevent and investigate cyber-related financial crime. At present 40% of Danish SMEs have an inadequate level of digital security compared to their risk profile, and many companies lack basic measures in their digital security1. As a result, there is a need to strengthen the digital resilience of Danish enterprises, especially SMEs. Reports of financial cybercrime have increased significantly in recent years. Since its establishment in December 2018, the police’s Nationwide Centre for IT-related Economic Crime (LCIK) has received 70,000 reports of financial cybercrime2. This underlines the need for enhanced prevention and investigation efforts. The strategy launches a series of strategic actions to strengthen the security of vital societal functions and ensure that government agencies and businesses have an adequate level of security.