Enterprises subject to the Security Act may request NSM for assistance. NSM has implemented such tests in the Ministry of Justice and Public Security, the Ministry of Defence and the Ministry of Foreign Affairs, among others. Other businesses may use private companies to carry out the testing. Different sectors may also build up their own expertise to carry out tests, such as Norsk Helsenett SF has done. Systematic implementation and follow-up of such tests could reduce the vulnerability of the businesses’ systems and make them more resilient to cyber attacks. The Government encourages businesses critical to society to use intrusion tests to identify vulnerabilities and test the resilience of own ICT systems. 6.6 Knowledge base Recently, several analyses on digital vulnerabilities have been produced. These serve several purposes. They contribute to public education and awareness, and provide the authorities and business leaders with a basis for decision-making to draw up policies and measures to reduce vulnerabilities. In 2015, NSM prepared its first Comprehensive ICT risks report. The report is published annually. The purpose of the reports is to provide a common status of the situation which enables businesses and authorities to make the right decisions. In addition, it provides a tool for businesses in their work on preparing risk assessments. NSM has been commissioned to develop the report in cooperation with other relevant businesses. Examples of other analyses are NorSIS’ annual report on threats and trends. The report shows security challenges to which individuals and society as a whole must relate. In addition, annual analyses are prepared by the Police Security Service, the Intelligence Service, Kripos, the Directorate for Civil Protection and Emergency Planning (DSB), the Financial Supervisory Authority and the National Communications Authority (Nkom). Different sectors and businesses’ risk analyses, evaluations following exercises and incidents, research in the field and private industry assessments contribute to the overall overview. The analyses have a somewhat different approach and target groups, but a common theme is that the challenges in the field of cyber security are usually crosssectoral. The Government will develop, maintain and support a sound and accessible knowledge base that enables individuals, businesses and authorities to take appropriate measures. 6.7 Culture and leadership In Meld. St. 10 (2016–2017) Risk in a safe and secure society the Government points out the importance of culture, management and attitude to public security in Norway. How we relate to risk, and how well prepared we are for a serious incident, is affected by our attitudes and the culture of which we are a part. This applies in particular to cyber security. Security was easier to assess when what was being secured was something physical, tangible and stable. Lockable cabinets and physical obstacles are easy to understand. In the digital world you can soon become alienated in terms of security. We no longer have the same overview of the vulnerability situation. A cyber attack will often not be visible to anyone affected. The need for increased awareness about vulnerability and security threats, as well as increasing the expertise of the individual, is becoming increasingly more relevant.