Skr. 2016/17:213 Supervision in the area of cyber security Objective: There is to be appropriate supervision to create conditions for increasing society’s cyber security. A prerequisite for the intended impact of the cyber security rules is the existence of supervision that can be performed in an effective and appropriate manner. In its report on information security in the civil public administration (RIR 2014:23), the Swedish National Audit Office pointed to the need for supervision and recommended a number of measures, including expanding supervision of information security in the civil public administration. It is the Government’s assessment that several measures need to be taken. In the first instance, there is a need to develop the supervision of activities covered by the protective security legislation and critical infrastructure within the sectors identified in the NIS Directive. Supervision under the protective security legislation The Protective Security Act contains provisions on protective security, which refers to protection against espionage, sabotage and other crimes that might threaten the security of the realm, protection in other cases of classified information concerning the security of the realm, and protection against terrorism, even if it does not threaten the security of the realm. According to the protective security legislation, there are two supervisory authorities that have the main responsibility, the Swedish Security Service and the Swedish Armed Forces. In consultation with the responsible authorities (the public utility Svenska kraftnät, PTS, the Swedish Transport Agency and the county administrative board), these can also exercise supervision of the authorities of the sectors concerned. The responsible authorities also exercise their own supervision of the sector. All supervisory authorities have the right to issue regulations. The report A new Protective Security Act (SOU 2015:25) states, inter alia, that societal developments mean that security-sensitive activities are increasingly being conducted by private actors. A reasonable conclusion, according to the report, should be that the incidence of private forms of activity will probably increase within the supervisory area but that supervision will mainly continue to concern authorities and other public bodies. The inquiry stressed that access to intervention powers, e.g. in the form of sanctions, is characteristic of effective and appropriate supervision. Today, there are no such powers with respect to protective security. The inquiry nevertheless made the assessment that there were not sufficient grounds at that time for changing the focus and implementation of supervision. For this reason, no proposal to introduce sanctions was submitted. However, the inquiry pointed out that it is vital to closely monitor developments and to follow up the question in the not too distant future. On 23 March 2017, the Government commissioned a Public Inquiry to, inter alia, investigate and propose a system of sanctions in the protective security legislation (ToR 2017:32). The Public Inquiry is also to perform a review of the supervision provisions under the Protective Security Act and submit proposals on how appropriate supervision of security-sensitive activities should be designed. The inquiry report is to be presented in May 2018. Implementation of the NIS Directive The NIS Directive lays down measures with a view to achieving a high common level of security of network and information systems within the Union. Under the Directive, each Member State shall designate one or more national competent 11