In 2017, NSM will also establish an arena for transfer of experience so that public and private businesses will to a greater extent receive coordinated, adapted and appropriate advice and guidance in the area of cyber security. The Government will continue to support the Norwegian Centre for Information Security (NorSIS) (see box 6.3) in its work. NorSIS is an important contributor that provides advice and guidance to small and medium-sized businesses and creates greater awareness in the population about cyber security challenges. Box 6.3 NorSIS NorSIS is an independent organisation that works to increase knowledge about and understanding of cyber security. NorSIS receives funding from the Ministry of Justice and Public Security and is a part of the authorities’ national commitment to cyber security. An important task for NorSIS is to provide advice and guidance to the public, companies and public businesses. The largest single initiative is “National Security Month”, which is held in October each year. The Security Month is a national exercise to create awareness about information security that is relevant to businesses and individuals. In 2016, 420,000 employees had access to e-learning during the Security Month. This is an increase of almost 60,000 from 2015. In addition, a number of security-related lectures were held throughout Norway. NorSIS has prepared several guidelines intended for private businesses. NorSIS cooperates with NSM and Nkom on nettvett.no. This is a service where you can find information, advice and guidance on safer use of the internet. The information is aimed at consumers and small and mediumsized businesses. The purpose of the services is to provide a more uniform and coordinated flow of information on security and security culture related to ICT. NorSIS operates and has editorial responsibility for the service, while NSM and Nkom contribute to further development and funding. 6.4 Outsourcing Many businesses choose to acquire ICT services from one or more external providers instead of producing them themselves. The services may be provided internally in the enterprise or externally by national or international providers. There may also be combinations of these. Outsourcing of ICT services to professional providers could provide improved security and more stable and available services. It can also provide lower and more predictable costs and contribute to better prioritisation of core business areas. This requires the enterprise to have the expertise to follow-up the providers. At the same time, the enterprise must be aware of the assets that are exposed through outsourcing and implement the necessary measures. The need for confidentiality, integrity and accessibility should be particularly emphasised in the assessments, and which laws, requirements and regulations apply to the sector nationally and internationally. There are currently few cloud providers with facilities in Norway. Therefore, outsourcing using cloud services involves storage and processing primarily being carried out at the cloud providers’ facilities outside Norway and thus outside national control. A more detailed discussion of outsourcing and cloud services is found in section 22.10. See box 6.4 for ICT outsourcing in the health service.