Skr. 2016/17:213 May 2018, includes an obligation for all Member States to adopt a national strategy on the security of network and information systems. Another piece of EU legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), will begin to be applied in May 2018 and entails higher requirements on the handling of personal data. In recent years, several inquiries and reviews in the area of cyber security have indicated deficiencies in relation to current threats and risks. These include the Swedish National Audit Office’s audits of information security in public administration (RIR 2016:8, RIR 2014:23). The report Cyber security in Sweden also contains several proposals in the area of cyber security (SOU 2015:23). In its defence policy bill, the Government assessed that Sweden’s overall capability to prevent, counteract and actively manage consequences of civil and military threats, events and attacks in the cyber environment must be developed and strengthened (Government Bill 2014/15:109). What is to be protected? The open democratic society is dependent on the ability to maintain the desired confidentiality, integrity and availability when handling information. This means that both the information itself and the systems used to store and transfer that information must be protected. Cyber security efforts are a necessary activity for safeguarding the quality and effectiveness of societal functions and a prerequisite for being able to harness the opportunities of digital transformation. Such opportunities involve everything from developed digital public services to connected and automated vehicles and factories. Ultimately, cyber security involves safeguarding fundamental societal values and goals, such as democracy, human rights and freedoms, Sweden’s freedom, security and right to autonomy, and growth and economic stability. If individuals are to be able to exercise their rights and freedoms, they need access to accurate and readily available information. This is a prerequisite for being able to make well-founded decisions and raises the quality and effectiveness of all types of activities and contacts in society. Some information in society is sensitive and therefore needs to be protected. If sensitive information is lost, stolen, manipulated or disseminated to unauthorised persons, this can have serious consequences. There are large quantities of information that are of decisive importance to the functioning of society or that contain information sensitive with respect to privacy. Other examples of sensitive information have to do with law enforcement, technological products, business relations, total defence or circumstances concerning other states. Today, the systems for handling information are mainly based on digital information and communications technology. This applies not least to the systems that Sweden depends on to govern and lead the country during extensive strains that might result from crisis or war. Such systems must be secured. Furthermore, many societal activities are based on functioning digital information and control systems that continuously handle large quantities of sensitive information in order to control, e.g. electricity distribution, water supply, transportation, transport infrastructure or hospital equipment. Industrial activities such as engineering and processing are also dependent on functioning digital information and control systems today. Incidents and attacks with regard to Swedish trade and industry can have far-reaching consequences, both for individual companies and entire value chains, thus threatening Swedish jobs. 5