Skr. 2016/17:213 2 Strategic priorities 2.1 Securing a systematic and comprehensive approach in cyber security efforts Systematic cyber security efforts Objectives: – Central government authorities, municipalities, county councils, companies and other organisations are to have knowledge of threats and risks, assume responsibility for their cyber security and conduct systematic cyber security efforts. – There is to be a national model to support systematic cyber security efforts. Having good cyber security is important for most activities to achieve their quality and effectiveness requirements. Improving cyber security is therefore not only a matter of satisfying external requirements, but is also a way of improving an activity. At the same time, cyber security cannot be viewed as only being the concern of the activity itself. Services and products flow in several stages, and deficiencies in cyber security can therefore have repercussions far beyond the boundaries of the activity. Responsibility, risk awareness and a comprehensive view Successful cyber security efforts presuppose clarity in terms of who is responsible for them. This applies at all levels – both within organisations and in society as a whole. Both public and private stakeholders need to be aware that risks related to cyber security have an effect on the goals of their activities and that their ability to handle information might also have an effect on other stakeholders in society. Investments to incorporate and improve security should always be compared to what it might cost not to make them. The goal is to find the right levels of security and for those responsible to be aware of the risks that exist so that they will be able to make active decisions to eliminate, reduce or accept these risks. Such risk awareness constitutes the foundation of effective investments in cyber security. In order for information management and IT use in society to develop in a safe and secure manner, it is necessary for all stakeholders to have a comprehensive view of cyber security, which is a complex and multidisciplinary area, covering fields including technology, administration, economics and law. Cyber security is to be a natural and integral part of all work at all levels of society: within and between organisations and within and between the different sectors of society. Security measures should aim to create a more robust information management when society is in a normal state and to manage more serious disruptions and crises. National model for systematic cyber security efforts At present, the different stakeholders in society conduct their cyber security efforts in partly different ways, according to different conditions and needs, based on several different regulatory frameworks and partly different perceptions of threats and risks. The same information can receive different levels of protection in different organisations and many stakeholders have insufficient knowledge of which type of protection is appropriate and available for a certain type of information. 8