Country: Sweden QUESTION RESPONSE EXPLANATORY TEXT 4 Swedish procurement processes recognise international security certifications, and although some local security guidelines have been developed, they do not require additional local certification or accreditation. 1. Is there a national computer emergency response team (CERT) or computer security incident response team (CSIRT)? 4 CERT-SE <www.cert.se> was established in 2003 and is responsible for coordinating incident response measures for both government institutions and private entities across all Swedish networks. 2. What year was the computer emergency response team (CERT) established? 2003 12. Are requirements for public and private procurement of cybersecurity solutions based on international accreditation or certification schemes, without additional local requirements? OPERATIONAL ENTITIES 3. Is there a national competent authority for network and information security (NIS)? 4 The Swedish Civil Contingencies Agency (MSB) <www.msb.se>, in its role as protector of public safety, civil defence, and emergency management, acts as the agency responsible for network and information security. 4. Is there an incident reporting platform for collecting cybersecurity incident data? 4 CERT-SE <www.cert.se> is tasked with incident reporting and collecting information about cybersecurity incidents. They engage proactively by monitoring their constituency for cybersecurity incidents, and providing an email-based reporting structure to log cybersecurity incidents. 5. Are national cybersecurity exercises conducted? 4 Sweden conducted the National Cyber Security Exercise “NISÖ” in 2012. Sweden also participated in the multi-national International Watch and Warning Network Exercise 2013 organised by the United States. 6. Is there a national incident management structure (NIMS) for responding to cybersecurity incidents? The Swedish Civil Contingencies Agency’s Regulations on Government Agencies’ Information Security 2009, pursuant to Regulation 2006:942 <riksdagen.se/sv/ Dokument-Lagar/Lagar/Svenskforfattningssamling/Forordning-2006942-omkrisb_sfs-2006-942> compel each agency to develop its own information security management systems, based on standards supported by the Swedish Standards Institute. PUBLIC-PRIVATE PARTNERSHIPS 1. Is there a defined public-private partnership for cybersecurity? The National Telecommunications Coordination Group (NTSG) <www.pts.se/upload/ Faktablad/En/facts-about-ntsg.pdf> is a public-private partnership in Sweden that is composed of representatives from entities engaged with electronic communications critical infrastructure. While not dedicated to cybersecurity, the group carries out coordinating and advising functions in the area of electronic communications. 2. Is industry organised (i.e. business or industry cybersecurity councils)? While there is no industry-led cybersecurity-specific platform in Sweden, IT & Telekomforetagen <www.itotelekomforetagen.se>, a membership organisation for Swedish companies in the information technology and telecom sector, engages with cybersecurity in the course of its operations. 3. Are new public-private partnerships in planning or underway (if so, which focus area)? 6 There are no new public-private partnerships being planned in Sweden. SECTOR-SPECIFIC CYBERSECURITY PLANS 1. Is there a joint public-private sector plan that addresses cybersecurity? 6 Sweden does not have sector-specific joint public-private plans in place. 2. Have sector-specific security priorities been defined? 6 Sector-specific security priorities have not been defined. 3. Have any sector-specific cybersecurity risk assessments been conducted? 6 Sector-specific risk assessments have not been released. 6 As of August 2014, Sweden is preparing a national cybersecurity strategy that may contain education commitments. EDUCATION 1. Is there an education strategy to enhance cybersecurity knowledge and increase cybersecurity awareness of the public from a young age? EU Cybersecurity Dashboard www.bsa.org/EUcybersecurity | 2