Good security management in the businesses lays the foundation for satisfactory protection of assets. Management commitment to information security as well as commitment through the allocation of resources to secure information and information systems is important. All protection starts with a valuation - what input factors and assets are important for our enterprise, business partners, society as a whole, etc. Structured value and risk assessments provide an overview of assets and to what extent these are exposed to risk. The assessments are both a management tool - what must be done to achieve a satisfactory security level - and they contribute to risk recognition in the businesses. The Government will work to make a general improvement in the security culture in businesses and society as a whole through competence-enhancing measures and improved risk recognition. 6.8 Privacy and preventive cyber security When implementing security measures, the potential impact of the measure on privacy must be considered. If the measure has an impact on privacy, national and international regulations set forth requirements for implementation of the measures. NOU 2016: 19 Cooperation for security describes the relationship between preventive security and privacy. The Committee listed five items with the principles and guidelines that were used as a basis for the work on considering a new legislation for preventive national security. The list may also serve as a basis for the cyber security work:      precision in the formulation of the legal authority for the security measure (the statutory requirement) assess the impact of the security measure on existing measures (the purposefulness) assess the proportionality between the security effect and how much the measures intervene in privacy and legal protection (proportionality) consider alternative and lower level of intervention that may give the same effect (the principle subsidiarity) establish adequate privacy or guarantee of due process where there is intervention in the individual’s legal sphere (procedural mechanisms) As stated under section 6.5, intrusion testing is considered a sound cyber security measure. Many ICT systems process personal data. This is an example of a security measure where the principles must be used before implementation, and where security considerations must be weighed against privacy considerations. 7 Detecting and managing cyber attacks The Government is committed to strengthening our national capability to detect and manage cyber attacks. Cyber attacks may be difficult to detect and in extreme circumstances may pose a threat to national interests and violation of Norwegian sovereignty. The victims may be other states, organised non-governmental groups and private legal persons. The goal of the attackers may be crime for profit, blackmailing or destroying or changing information or functionality. It may also be to acquire information on state and trade secrets, research findings or technological innovations from commercial companies. The problems are often global, and the risk of punishment and consequences is low.