Publications of the Prime Minister’s Office 2024:13 6 Resource allocation, implementation and monitoring 6.1 Resource allocation Cybersecurity actors combat threats in Finland on a daily basis. The evolving operating environment increases and diversifies cyber threats and risks. Current resource allocation for cybersecurity has been inadequate in relation even to the need to maintain the current state. New resource allocation will be needed to ensure and strengthen future cybersecurity in an evolving operating environment with the implementation of new legislation and supervisory functions in various sectors. Finland currently spends nearly EUR 300 million on ensuring cybersecurity in central government. Regional administration, wellbeing services counties, municipalities and local administration also use resources for their own cybersecurity, and there is a need for more effective monitoring of such resources. It should be noted that a significant share of Finnish critical infrastructure is owned by businesses that are responsible for ensuring its cybersecurity. A conservative estimate suggests that businesses invest at least ten times more in cybersecurity than the funds allocated by central government for this purpose. The resources that businesses devote to cybersecurity are also increasingly important from the perspective of security of supply. Indirect investments are also made in cybersecurity. For example, investments in cyber competence are made at all educational levels, and in various research projects in Finland. The reinforcement of cybersecurity provided by funds invested in cybersecurity education and research often takes time to manifest. Current difficulties in central government finances, the technology maintenance backlog, the labour shortage caused by a skills shortfall in the cybersecurity sector and growing EU regulation will affect the prospects for developing cybersecurity. The relative competitiveness of the public sector as an employer is declining compared to the private sector. These factors pose challenges to implementing the Finnish cybersecurity strategy and the plan for doing so, and for national growth in the cybersecurity sector. 41