Publications of the Prime Minister’s Office 2024:13 P R E FAC E Our revised cybersecurity strategy responds to evolving geopolitical circumstances and technological development. It continues a tradition of more than 20 years of ensuring cybersecurity in Finnish society. While the cybersecurity situation in Finland remains good, staying abreast of continual change requires continuous improvement. Cybersecurity is a vital component in the Finnish model of comprehensive security. Our society is almost entirely digitalised, and as part of a trust-based society, we also want to continue ensuring that people in Finland can rely on the cybersecurity of digital services. Cybersecurity calls for responsible leadership and commitment from all stakeholders in society. The EU cybersecurity directive also requires stronger participation from various sectors of society to ensure the reliability of all digital services. The European Union is Finland’s most important political and economic frame of reference and community of values in cybersecurity. Most current cybersecurity regulation and other policy measures originate in the European Union. Finland actively influences these policies. While NATO membership strengthens Finland’s cybersecurity and cyber defence, it also imposes new obligations. We seek to be a strong cybersecurity partner in the European Union and NATO. The forthcoming cyber defence doctrine will provide national operating principles for responding to state-sponsored threats and threats against national security. We shall prepare nationally for active cyber defence and the possibility of attribution and countermeasures. The strategy is, and necessarily must be bold and ambitious. The core of the Finnish cybersecurity operating model is cooperation between various stakeholders. Implementing the strategy will require a review of official powers, and of conditions for exchanging information. Trust-based cooperation between public authorities and the private sector must be maintained. We can combat ever-increasing and diversifying cybercrime through cooperation and adequate resourcing of public authorities. 8