Skr. 2016/17:213 already exist in society for enhancing cyber security. The strategy thus encompasses the whole of society, that is to say central government authorities, municipalities and county councils, companies, organisations and private individuals. In this Communication, cyber security refers to a set of security measures to preserve the confidentiality, integrity and availability of information. Confidentiality means that unauthorised persons cannot access the information. Integrity means that the information is not modified, manipulated or destroyed in an unauthorised manner. Availability means that authorised persons can access the information in the manner and at the time offered by the services. 1.2 Starting points for Sweden’s cyber security Cyber security efforts are necessary for enabling society to function and develop in line with the goals of various policy areas. Digital transformation means that an increasing proportion of all activities in society is to varying degrees dependent on networks and information systems, and thereby on cyber security. The cyber security strategy is based on the objectives for Sweden’s security: protecting the lives and health of the population, the functioning of society, and our capacity to uphold fundamental values such as democracy, the rule of law and human rights and freedoms (Government Bill 2008/09:140, Committee Report 2008/09:FöU10, Riksdag Communication 2008/09:292). The strategy is also based on the overall IT policy objective – for Sweden to become the world leader in harnessing the opportunities of digital transformation (Government Bill 2011/12:1, Committee Report 2011/12:TU1, Riksdag Communication 2011/12:87). The cyber security strategy builds on and embodies the focuses of cyber security set out by the Government in its national security strategy and in the digital strategy (N2017/03643/D). The national security strategy states that Sweden is to actively safeguard our national interests and defend them whenever they are at risk of being undermined, including in relation to the threats and risks found in the area of information technology. The digital strategy states that Sweden will provide the best conditions for securely taking part in, taking responsibility for and building trust in the digital society. Today, provisions on information security are found in different regulatory frameworks. Information security is one of three fundamental protective security areas under the Protective Security Act (1996:627). The legislation applies to the most security-sensitive activities in Sweden and entails far-reaching requirements for various protective measures. Other central government authorities operate under the information security requirements set out in the Ordinance (2015:1052) on Emergency Preparedness and Surveillance Responsible Authorities’ Measures at Heightened Alert. Provisions on information security are also found in the Archives Act (1990:782), the Personal Data Act (1998:204) and the Electronic Communications Act (2003:389). In addition to these statutes, there are authority regulations governing information security in a number of sectors. Several statutes governing information security will be amended or added in the coming years. The protective security legislation is currently being reviewed, with proposals that include broadening the scope of application to achieve better protection for Sweden’s security (SOU 2015:25). Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (the NIS Directive), which is to have been implemented in Swedish legislation no later than 4