strengthening capacity. Appropriate regulations and organisation are also key in protecting our assets. Businesses rely on complex digital value chains, and the vulnerability of others becomes their own vulnerability. It is necessary for businesses to have a sufficient overview of their own vulnerability. A good overview enables the enterprise to assess appropriate measures. Key measures:  set up a committee to assess legal regulation of the cyber security area and organisation of cross-sectoral responsibility  facilitate so that businesses can assess and prioritise cyber security measures through systematization and development of recommendations and requirements  develop and maintain a sound and accessible knowledge base that enables individuals, businesses and authorities to implement the correct measures to maintain adequate security in their ICT systems. 6.1 Legal regulation in the area of cyber security Meld. St. 10 (2016–2017) Risk in a safe and secure society points out that Norwegian businesses must relate to different regulations relating to cyber security. Some regulations are sector specific, while others are cross-sectoral. The regulations have different purposes and considerations and often use different concepts and methods. The rapid digitalisation of society has meant that regulations and legislation are not always adapted to today’s needs. In recent years, digitalisation has contributed to far more cross-sectoral challenges. Several of these challenges are related to security issues. There may be a different understanding of the threat and risk situation in the sectors and an inadequate overview of how security in their own sector may also have consequences for other sectors. This may lead to fragmented regulation and lack of comprehensive thinking when formulating cyber security requirements, which also makes it challenging for the businesses to keep track of and comply with the various requirements. The EU NIS Directive requires the member states to provide a minimum level of national cyber security. The Directive will ensure that each member state has a unified and cross-sectoral approach to cyber security. There is a possibility for various solutions in different countries for most sectors. The current Personal Data Act has cross-sectoral provisions on cyber security. The EU’s new Data Protection Directive sets out requirements for cyber security. In NOU 2016: 19 Cooperation on security the Committee proposes improved systematics for the regulation of preventive national security (see box 6.1). The Committee proposes an extended scope and extent in relation to the current security legislation. Box 6.1 The Security Committee’s assessments Through a sectoral identification of important social functions, businesses and infrastructures, a national and cross-sectoral security authority should be able to gain a comprehensive overview of our national security situation. The Committee also proposes that the businesses are required to protect their critical information systems. This will include everything from processing systems, office