PRIORITISED AREAS 3 3.1 Preventive cyber security Subsidiary goals: Strategic goal: Norwegian companies digitalise in a secure and trustworthy manner, and are able to protect themselves against cyber incidents. 1. Companies take a risk-based approach to cyber incidents and use recognised frameworks, standards and management systems for cyber security. Cyber security is primarily a responsibility at company level. Corporate managers are responsible for conducting risk assessments and then, on the basis of these, implementing appropriate measures. The authorities are to provide conditions that enable companies to protect themselves against cyber incidents in order to uphold their own security and to increase the robustness of society as a whole. Preventive cyber security and a systematic approach to address risk will help reduce the possibility of cyber incidents having negative consequences for businesses, private individuals, or society as a whole. Prioritised advice and recommendations better enable companies and private individuals to initiate appropriate measures to increase the level of security in society. Part 2 of the list of measures is therefore a key resource to increase companies’ own ability to protect themselves against and handle cyber incidents. Preventive cyber security in society entails ensuring that digital services and products are secure and reliable from the moment of creation, and throughout their lifespan. 2. The public sector exercises strong management and control of its cyber security. The companies’ cyber security management systems underpin their primary function and contribute to ensuring that cyber security incidents in one company do not cause serious damage to others. 3. Private individuals, the business community and the public administration have confidence that public digital services are secure and reliable. 4. The authorities and the business community share information about threats, vulnerabilities, incidents and efficient measures with relevant actors to make society better able to withstand cyber incidents. 5. The authorities share advice, recommendations and guidelines on cyber security to provide companies with knowledge for their security work. 6. The authorities act as a driving force for cyber security in digital consumer services and products. 7. The authorities establish conditions conducive to cooperations within the public sector and between public and private sectors. 8. The population has good judgement on cyber-related issues and a good cyber security culture. National Cyber Security Strategy for Norway | 13