common arena for the various sectors’ key supervisory authorities. The purpose is to contribute to information sharing and transfer of competence and in this way increase the quality of the sectors’ supervision of cyber security. NSM will lead the arena. See also section 22.7. It is a goal that the supervisory authorities themselves will have greater expertise to conduct supervisory activities in the field of cyber security. NSM, together with the sectoral supervisory authorities, will considering providing a central capacity with cyber security competence that will be used as a resource for the supervisory authorities. This central capacity can assist people from the supervisory authorities. It may also be considered whether there are commercial services that can provide help in case of any lack of competence. 8.7 Exercises Exercises are a useful tool for better prevention, detection and management of undesirable cyber incidents. All parties and businesses in charge of critical societal functions and that rely on having a functioning ICT infrastructure and services, have an individual responsibility for conducting exercises. Many large, national cross-sectoral exercises carried out on behalf of DSB have included digital vulnerabilities. Digital vulnerabilities were the main topic of the national "IKT16" exercise and in Nkom’s national cyber exercise for the electronic communication and energy sector (NCEK 2015). Several of the recommendations from the Lysne Committee highlight exercises as a means of reducing the digital vulnerability. In Part III of this report, exercises are described as important measures for several sectors when the status of the recommendations from the Lysne Committee is reviewed. Learning from exercises is demanding. Meld. St. 10 (2016–2017) Risk in a safe and secure society emphasises the systematic follow-up and learning from exercises and incidents. The Government wants to learn as much as possible from exercises and incidents. Therefore, the Government will introduce new requirements for follow-up of findings from incidents and exercises in government administration in the civil sector. All incidents and exercises will be evaluated. Findings and points of learning will be followed-up through a management-based action plan. Follow-up of exercises and incidents will not be considered completed until all the points of the action plan have been followed-up satisfactorily or signed off through a management-based assessment. The results of the follow-up of exercises and incidents over a certain size or severity will be reported to a superior authority. The Ministry of Justice and Public Security, together with other relevant ministries, will place greater emphasis on also using international exercises to work on prevention and management of cyber incidents, particularly NATO-based exercises (see box 8.2 about NATO and exercises). Box 8.2 NATO and exercises NATO's Crisis Management Exercise improves the Alliance’s strategic military-political level, in Allied capitals, and in NATO's organisation. The scenarios for the exercise vary from year to year between crisis management operations in peacetime and collective defence. Protection against