NORWAY Law and Practice Contributed by: Hedvig Moe, Pål Lieungh, Espen Randen and Elin Ibsen Gustavsen, Advokatfirmaet Thommessen AS
curement ), specifying the classification level for each contract phase, personnel with access, how classified information is to be transmitted, information systems to be used, security incident reporting, and return or destruction of classified information upon completion. Breach of the duty of confidentiality regarding classi - fied information may give rise to criminal liability under the Penal Code. 5.4 Critical National Infrastructure and Defence Assets The Security Act establishes a regime for the designa - tion and protection of critical objects and infrastruc - ture. An object or infrastructure is protectable where it could harm fundamental national functions or national security interests if their functionality is reduced or they are subjected to vandalism, damage or unlawful seizure. The responsible sectoral ministry designates and classifies such assets; NSM does so for assets outside any ministry’s sector. Entities which control objects or infrastructure identified as such shall be notified of such designation. There is no publicly avail - able information identifying designated assets. 5.5 Cybersecurity Requirements for Defence Contractors Norway does not operate a single mandatory cyber - security certification scheme equivalent to the US CMMC framework. Instead, cybersecurity require - ments for defence contractors derive from security obligations under the Security Act and Enterprise Security Regulation, applied through the classified procurement regime. Any information system processing classified infor - mation must be approved before use. The Enterprise Security Regulation specifies operational require - ments, covering protection against unauthorised access, modification and disruption, identification and authentication, logging, and systematic verifica - tion of measures. For systems handling SECRET or TOP SECRET information, or systems connected to other entities’ networks, NSM is the approval author - ity; other systems may be approved by the entity itself, subject to notification.
For defence contractors specifically, the security agreement concluded under Section 9-2 must spec - ify which information system will be used to process classified information, and who is responsible for its approval. 5.6 Supply Chain Security There are no blanket restrictions on components or software from specific countries. Supply chain secu - rity is addressed through procurement-level controls, security agreements and risk-based screening mech - anisms. The most direct instrument is the security agreement required before any classified procurement (see 2.4 Restricted and Classified Procurement and 5.3 Clas- sified Information and Official Secrets ). Its obliga - tions flow down the supply chain: a contractor or sub- contractor handling classified information in its own premises must hold facility security clearance and conclude a separate security agreement. FOSA gives contracting authorities broad powers to vet and reject sub-contractors: exclusion grounds applicable to prime contractors apply equally to sub- contractors, including the defence-specific ground that the entity is not sufficiently reliable (see 2.10 Exclusion Grounds ). The contracting authority may require disclosure of intended sub-contractors and notification of changes. FOSA also contains provisions on supply security, under which the contracting authority may require the supplier to demonstrate appropriate supply chain organisation and geographic location, notify changes in organisation or industrial strategy, and maintain pro - duction capacity for increased crisis demand. The Security Act requires entities to assess whether a procurement to a protectable information system, object or infrastructure could entail a non-negligible risk of compromise. Where such a risk is identified, the responsible ministry must be notified, and the King in Council may prohibit the procurement or impose conditions.
149 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook