A STRONGER COOPERATION 2 2 A stronger cooperation There are several governmental bodies with a crosssectoral responsibility for cyber security (see Appendix A). It is important to ensure a good cooperation among these actors. One key collaborative hub is the Joint Cyber Coordination Centre (Felles cyberkoordineringssenter – FCKS), which comprises representatives from NSM, the Norwegian Intelligence Service, the Norwegian Police Security Service (PST) and the National Criminal Investigation Service (Kripos). The purpose of FCKS is to help improve the national capability to detect and withstand serious cyber attacks, provide strategic analysis and maintain a comprehensive threat and risk assessment for cyberspace. The authorities cannot achieve good cyber security on their own. The business community has the requisite skills and resources and functions as a driving force for digitalisation and innovation. As such, it has a key role to play in the solution. In order to protect the digital society, private individuals, companies, sectors and nations must all look beyond the boundaries of their own interests. All companies have a responsibility to ensure their own cyber security, but the dependency of society on digital solutions makes it essential to establish stronger cooperations and partnerships both at international level and in all areas of society. 2.1 Public-private partnership Digital services and products are often developed by private companies or research and development communities. A substantial part of Norway’s critical digital infrastructure is owned and operated by private companies. Consequently, important decisions related to the development of – and security in – cyberspace are made by commercial, non-state actors, i.e. outside the conventional intergovernmental arenas. As a result, the role of the authorities in the development of cyberspace is limited, which in turn calls for an extensive public-private partnership. Public and private companies have different capacities, knowledge and skills, which supplement one another. The authorities have an important role as legislator, facilitator and supervisory body; law enforcement have designated powers to investigate and prosecute cyber crime. Moreover, the authorities also has the duty to collect foreign and domestic intelligence, collaboration within international bodies and share information about potential threats. Increased collaboration inevitably leads to better situational awareness and better decisions, as well as allowing greater access to resources. In order to tackle ever-changing security challenges, cooperations should be intensified and developed even further. Guiding principles: •• The authorities and the business community work together to identify and discuss cyber security challenges, and to exchange experience about them. •• This cooperation should carry obligations for both parties and be based on transparency, trust and mutuality. •• The authorities contribute to establishing a business community where cyber security services are in demand, developed and provided. •• When building up national capacity in cyber security, is should be facilitated for inclusion of capabilities from the business community. 2.2 Civilian-military collaboration The defence sector is dependent on civilian digital infrastructures and services. As a result, cyber security challenges in the civilian sector are also of significance to Norway’s ability to handle security-political crises and to carry out military operations. In a worst-case scenario, cyber attacks on civilian infrastructures may challenge Norway’s ability to safeguard national security. The total defence concept encompasses both military support for civilian society and civilian support for the Armed Forces. The contribution of the Armed Forces to public security also translates into improved ability to safeguard state security, given that a well-functioning civilian society and robust public security form an important foundation for well-functioning military defence. In order to meet common cyber security challenges, military and civilian actors must work more closely together. This includes conducting exercises in how to handle crisis situations, development of joint competence, mutual incident notification, and exchanging information about threats and vulnerabilities. National Cyber Security Strategy for Norway | 9