DANISH CYBER AND INFORMATION SECURITY STRATEGY 2022-2024 The efforts made so far to ensure a high level of cyber and information security have increased a maturity across society. There is a greater awareness and attention to the area. Cyber security has been strengthened in the state and in six designated critical sectors (energy, health, transport, telecoms, finance and maritime) with the establishment of decentralised cyber and information security units (DCIS) and targeted strategies. In addition, government agencies are required to follow the international management standard, ISO 27001, and a set of technical minimum requirements has been introduced in government that establishes a framework for risk-based management of information security. 11 There has also been a general strengthening of the skills of citizens and businesses in terms of cyber and information security. At the same time, there is a strong focus in the EU on enhancing cyber security, including through the revision of the Network and Information Security (NIS) Directive. This also requires Denmark to increase the level of ambition, including in terms of management-based risk control, implementation of security measures and ICT preparedness. The EU Network and Information Security (NIS) Directive The NIS Directive The EU Network and Information Security (NIS) Directive from 2016 is an important instrument in enhancing cyber and information security in the vital societal functions of Denmark. In December 2020, the Commission proposed to revise the Directive to expand the scope. E.g. in the form of new cyber security requirements targeting companies and public authorities and member states’ supervision of cyber security. The goal is management-based risk control, implementation of organisational and technical measures, as well as control of emergency preparedness, which enables organisations to handle incidents (before, during and after) and operational cooperation across organisations and national borders in the EU.