NORWAY Law and Practice Contributed by: Elisabeth Roscher, Tine Vigmostad, Geir Sviggum and Kristin Nordland Brattli, Wikborg Rein Advokatfirma AS
New Requirements to Safeguard Critical Digital Infrastructure A law on digital security is expected to come into force in 2025. The law shall implement the EU NIS-1 Directive and stipulate an obligation for companies providing critical functions (such as energy, transportation, health and financial services) to, among others: • perform risk assessments; • have adequate security measures in place; and • report security breaches. The government is working on further legisla- tive amendments to increase control over criti- cal digital infrastructure; following the expert committee’s report dated 28 February 2025, legal updates are expected, strengthening the government’s ability to control the influence of foreign countries on such infrastructure. The expected impacts of these amendments on crisis management remain to be seen. Several amendments are aimed generally at increasing the public authorities’ powers if a crisis occurs, while others are aimed more at preserving and strengthening the rights of private companies and individuals (eg, the revised Bar Association Guidelines for Private Investigations). 2.3 Government Role The Overall Responsibility for Crisis Management The overall responsibility for co-ordinating crisis management and preparedness actions lies with the Ministry of Justice and Public Security, as well as with other ministries in relevant sectors (eg, the Ministry of Health and Care Services with regards to pandemic preparedness and response). Additionally, numerous public enti- ties have been established under the responsi-
ble ministries, including the Norwegian National Security Authority (NSM), the Norwegian Direc- torate for Civil Protection (DSB), and three newly established committees for emergency prepar- edness and crisis management in the health sector. Sector-Specific Authorities and Agencies To a large extent, the government monitors and evaluates crisis response efforts on a sectoral basis. The oil security system is generally governed by the Ministry for Trade, Industry and Fisher- ies, which is responsible for the security of sup- ply of fuel, emergency preparedness and crisis management within the sector. The Norwegian Radiation and Nuclear Safety Authority (under the Ministry of Health) bears the responsibility of preparedness actions related to nuclear acci- dents. There have been suggestions of establishing more cross-sectoral structures to strengthen the co-ordination of preparedness work. Local governments (municipalities and counties) are often consulted in such processes, and also have specific responsibilities in relation to cer- tain aspects of crisis management – for instance, with respect to facilitating the work of the Nor- wegian Civil Defence. However, since many cri- sis management questions warrant a State-level approach, the role of local governments may be There is no independent body that continuously oversees crisis management preparedness by companies or public entities. Nevertheless, in 2022 the government established a provisional commission responsible for the assessment of overall crisis response and preparedness in Nor- subordinated in some cases. 2.4 Independent Oversight
115 CHAMBERS.COM
Powered by FlippingBook