NORWAY Law and Practice Contributed by: Hedvig Moe, Pål Lieungh, Espen Randen and Elin Ibsen Gustavsen, Advokatfirmaet Thommessen AS
• Personnel Security (Chapter 8), including the clear - ance of personnel requiring access to classified information, or critical objects or infrastructure. • Classified Procurements (Chapter 9), including the rules for conducting a procurement involving a supplier’s access to or production of classified information or access to critical objects or infra - structure. • Ownership Control and FDI Screening (Chapter 10), including the rules of acquisition of a qualifying ownership stake in an entity subject to the Act. The Act is supplemented by regulations, of which the most important are the Enterprise Security Regulation ( virksomhetsikkerhetsforskriften ), setting out detailed security requirements including for classified procure - ments, and the Clearance Regulation ( klareringsfor- skriften ), governing clearance procedures. The principal authorities responsible for administration and enforcement are as follows. • The sectoral ministries – each ministry is respon - sible for identifying fundamental national functions and critical entities within its sector, issuing desig - nation orders, and classifying protectable objects and infrastructure. • NSM – a cross-sectoral supervisory body for preventive security work responsible for supervis - ing Security Act compliance, approving informa - tion systems, and acting as the national clearance authority for facility security clearance. Further, the Civilian National Security Clearance Authority is responsible for personnel clearances in the civilian sector, while the Defence Security Agency clears personnel within the defence sector. 5.2 Security Vetting and Clearance Requirements Personnel security clearance is required for any per - son accessing information classified CONFIDENTIAL or above. The assessment is based on a background check considering factors relevant to the individual’s reliability, loyalty and judgment, as well as links to Norway.
Access clearance is a separate personal clearance which a sectoral ministry may require for access to all or parts of a protectable object or infrastructure classi - fied under Chapter 7 of the Security Act. The process mirrors that for personnel security clearance, but is tied to physical access to designated sites. Facility security clearance applies to entities and is required where a supplier to a classified procurement will have access to information classified CONFIDEN - TIAL or above in its own premises, will have electronic access from its own systems or premises to objects or infrastructure classified CRITICAL or above, or will have custody of such objects or infrastructure. Clearance may only be granted where there is no rea - sonable ground to doubt the entity’s security fitness, assessed based on its ability to carry out preventive security work, its financial position, ownership struc - ture, and any other factors indicating a risk to national security. For private entities, personnel security clearances and access clearances are issued by the Civilian National Security Clearance Authority, while personnel working within the defence sector are cleared by the Defence Security Agency. NSM is the clearance authority for facility security clearances. The same authority may downgrade or revoke a clearance where the condi - tions for granting it are no longer met. 5.3 Classified Information and Official Secrets Classified information is governed by the Security Act. Information must be classified where national secu - rity interests could be harmed if it becomes known to unauthorised persons. The Act establishes four classification levels – RESTRICTED, CONFIDENTIAL, SECRET and TOP SECRET – depending on the sever - ity of potential harm. Access to classified information is subject to a dual requirement: the individual must have a legitimate need to know and must be authorised for access to the relevant classification level. Defence contractors are subject to obligations under Security Act, Chapter 9. Before a classified procure - ment commences, a security agreement must be concluded (see 2.4 Restricted and Classified Pro -
148 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook