Publications of the Prime Minister’s Office 2024:13 government and ministerial working groups. The key body in matters of foreign and security policy significance is the Ministerial Committee on Foreign and Security Policy of the President of the Republic and Parliament (TP-UTVA). Strategic level The government and its ministries oversee the preparation of legislation concerning national cybersecurity, general policies, resource allocation, operating principles, strategic steering, preparedness, and countermeasures and cooperation. The Office of the National Cyber Security Director bears national responsibility for coordinating and harmonising cybersecurity development, planning and preparedness, and for the preparedness of critical ICT infrastructure. The National Cyber Security Director coordinates and harmonises national cybersecurity development, planning and preparedness, and advises the government in matters of cybersecurity. A cybersecurity coordination group appointed by the Ministry of Transport and Communications also works strategically to ensure that the national ministries in charge of cybersecurity, cyber defence and cyber diplomacy, and the cybersecurity authorities share consistent situational awareness concerning the state of cybersecurity in society, events that affect cybersecurity, and the evolution of the cybersecurity environment. Supervisory authorities (NIS2 and others) The supervisory authorities are defined as such in national legislation implementing the NIS2 directive, meaning the upcoming Cybersecurity Act and the Act on Information Management in Public Administration. The supervisory authorities monitor compliance with statutory duties in the private and public sectors. Finland applies a decentralised model, whereby sectoral public authorities supervise actors in their respective sectors. The National Cyber Security Centre also serves as a national coordination point. The supervisory authorities include the Finnish Transport and Communications Agency Traficom, the Energy Authority, the Finnish Safety and Chemicals Agency (Tukes), the National Supervisory Authority for Welfare and Health, the South Savo ELY Centre, the Finnish Food Authority, the Finnish Medicines Agency Fimea, and the Financial Supervisory Authority. Hacking and other cyberattacks can, for example, enable an attacker to access personal data, which constitutes a personal data breach. The national supervisory authority for personal data breaches is the Office of the Data Protection Ombudsman, which supervises compliance with data protection legislation. 55