Publications of the Prime Minister’s Office 2024:13 Service providers and their supply chains Service providers are organisations that provide services or products for society. A service provider is responsible for cybersecurity in the life cycle of its service and product throughout the value chain. The cybersecurity of the supply chain is ensured through risk management methods in accordance with the upcoming Cybersecurity Act or by agreement. Service providers also include research institutions and institutes of higher education, and some civil society organisations. These generate competence and knowledge capital and innovations in cybersecurity, and support preparedness and crisis recovery. Organisations and fourth-sector actors Finland is internationally renowned for its numerous civil society organisations and the willingness of people to participate in the activities of civil society. Civil society organisations and volunteers are playing an increasingly important role in ensuring national cybersecurity. Integrating these organisations into cybersecurity networks promotes national resilience, and they also need the support of other actors in developing cybersecurity. Civil society organisations are approachable and trusted, strengthening their role in developing civic skills. The National Defence Training Association of Finland (MPK) in particular provides support for enhancing cyber defence by arranging courses and developing and increasing the cyber reserve. Organisations are nevertheless not yet an established part of the cybersecurity ecosystem. Both organisations and actors in the fourth sector of unorganised civil activity have a great deal to contribute in supporting incident management, and there is already experience of the support that they provide to authorities in managing significant incidents. Citizens Individual competence strengthens the cyber resilience of organisations and society. The fact that new technology solutions are an increasingly integrated part of daily life also highlights the role of individual members of the public in national cybersecurity. Vigilance is needed both at home and at work, and everyone can influence how incidents in the cyber domain impact their lives through their own actions. There is a need for continuous development and maintenance of competence when cybersecurity is a natural part of every citizen’s social responsibility. Support provided to family and friends and timely reporting of personal observations help to maintain and develop national cyber resilience and facilitate cybercrime investigations. 59