DENMARK Law and Practice Contributed by: Thomas Maaberg Hansen and Peter Sand, Gorrissen Federspiel
See also 5.7 Counter-Espionage and Insider Threat Obligations . 5.4 Critical National Infrastructure and Defence Assets Certain defence-related assets, activities and services are subject to specific protection under Danish law. For instance, certain non-public military installations and other military assets are subject to specific pro - tection under Section 110a of the Danish Criminal Code, including restrictions on unauthorised photog - raphy. Military areas may also be subject to access restrictions under the Act on Access to and Passage Through Military Areas. Please refer to 6.1 FDI Screening Legislation and Regulation in respect of Danish FDI regulation. 5.5 Cybersecurity Requirements for Defence Contractors Denmark does not operate a single, cross-industry cybersecurity certification scheme for defence con - tractors comparable to the US Cybersecurity Maturity Model Certification (CMMC). The applicable require - ments are layered and turn on the classification of the government information being handled, the contrac - tor’s activities, and the individual contract. The most important layers are: • the general classified-information regime adminis - tered by the Danish Defence Intelligence Service in the defence sector; • the Network and Information Systems 2 Directive (“NIS2”) baseline (subject to a defence carve-out); • the national cybermonitoring arrangements now run by the Danish Agency for Societal Security ( Styrelsen for Samfundssikkerhed , or SAMSIK) together with the FE; and • the contractual security clauses that flow from the defence and security procurement regime. 5.6 Supply Chain Security Denmark has no general statute prohibiting com - ponents or software from specific countries in the defence sector. Instead, supply chain risks are addressed case-by-case under a targeted regime, complemented by foreign investment screening.
See also section 6.1 FDI Screening Legislation and Regulation in respect of FDI regulation. 5.7 Counter-Espionage and Insider Threat Obligations Security Clearance Access to classified information is controlled through a formal security clearance system set out in the Dan - ish Security Circular ( Sikkerhedscirkulæret ) governing the protection and handling of classified information shared within Denmark, NATO and the EU. Only per - sons cleared for the relevant classification level may access such information, with “top secret” clearances generally valid for up to five years and “secret/confi - dential” clearances generally valid for up to ten years. The Danish Security and Intelligence Service con - ducts the underlying security investigation, while the relevant public authority makes the decision on whether an individual may be security cleared. The clearance decision is based on an overall assessment of the information available concerning the individual, including in particular the individual’s loyalty, conduct, character, habits, associations and discretion. Access is further restricted by a “need to know” principle, which applies even to personnel who already hold the relevant security clearance. For companies performing classified work for the Danish defence sector, additional requirements apply under the military security regime administered by the Danish Defence Intelligence Service. Notably, a company may be required to obtain a facility security clearance ( områdesikkerhedsgodkendelse ) where it is to handle classified information at company level. The applicable security requirements may cover, among other things, personnel security, physical security, information security, access controls, and procedures for the handling and storage of classified information. These requirements are also relevant to the preven - tion and management of insider threats. Companies must, among other things, ensure that only appropri - ately authorised personnel have access to classified information and that access is limited to persons with a genuine need to know. The security regime therefore operates not only through initial security clearances
48 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook