Skr. 2016/17:213 include the annual submission of a report to the Government compiling the incidents that have been reported to the authority. Prior to this compilation, MSB is to obtain information from the Swedish Security Service and the Swedish Armed Forces about the incidents that have been reported to those authorities under the protective security legislation. The next step in developing IT incident reporting will be taken through the NIS Directive. This will include making it mandatory for stakeholders within the NIS sectors to report incidents that have a significant impact on the continuity of essential services. All in all, this IT incident reporting will improve the general knowledge of incidents that have occurred and effective security measures. In order to support the stakeholders’ preventive cyber security efforts, the Government considers it important to develop methods to provide reporting stakeholders with feedback on IT incidents that have occurred. If it is to be possible to detect attacks, there needs to be access to sensors and other mechanisms that detect events and such traffic that is part of an attack. FRA provides a technical detection and warning system (TDV) focusing on the most security-sensitive activities among central government authorities and state-owned companies. In spring 2017, the Government referred a memorandum on technical sensor systems (Ju2017/02002/L4) for consideration, proposing that MSB may support the cyber security of operators in critical infrastructure by providing sensor systems that can enhance the opportunity of society to detect and manage IT incidents. MSB’s sensor systems are not to be provided to the organisations that are offered TDV. Specially designed security networks can be a further method for safeguarding security-sensitive activities from attack. Such networks can be common to several authorities so as to allow them to detect and impede attacks in a cost- and resource-effective manner. Managing IT incidents requires a capability to withstand the consequences of the event and to restore systems. To be able to manage serious cyberattacks or other IT incidents, every stakeholder conducting activities that are security-sensitive or that are part of a critical infrastructure has a responsibility to develop contingency and continuity plans based on relevant risk analyses, including risk and vulnerability analyses and protective security analyses. In connection with an IT incident, the affected organisation might be in need of external support to manage the incident. Such support can be obtained from private companies, but MSB also offers support through CERT-SE, which is Sweden’s CSIRT unit (Computer Security Incident Response Team). Some central government stakeholders with particularly securitysensitive activities have the opportunity to receive support from FRA. If it is a question of an IT incident concerning the security of the realm, it is managed by the Swedish Security Service and the Swedish Armed Forces. Where the event has its origin in criminal activities, the Swedish Police Authority or the Swedish Security Service performs a criminal investigation. It is the Government’s assessment that there is a need to develop the capability of society to act in a coordinated manner to resist a cyberattack or other serious IT incident. A developed capability of this kind is an important part of strengthening Sweden’s total defence capability. Cyber defence A Swedish cyber defence that is sufficiently robust to withstand and manage cyberattacks while also being prepared for any need to quickly take active measures, requires coordination of competencies, as well as designated and exercised decision paths between different authorities and societal functions. Sweden’s overall cyber defence capability is therefore based on a broad understanding of the existence and nature of the relationship between, for example, measures taken to raise the lowest level of cyber security efforts, and the work of protecting society against cyberattacks. 17