DenmarkAct on Security and Preparedness in the Telecoms Sector (Lov om sikkerhed og beredskab i telesektoren), Security Risk Management Measures
Lov nr. 435 af 6. maj 2025, §§ 3-7 og 31
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are an essential or important telecoms provider under Sections 3 and 4, meaning you make public electronic communications networks or publicly available electronic communications services available in Denmark for commercial purposes, this Act binds you; local authorities and regions providing such networks or services are outside it.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use and to prevent incidents or minimise their impact, covering at least risk-analysis and information-system security policies, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability handling and disclosure, effectiveness assessment, cyber hygiene and training, cryptography, personnel security, access control and asset management, and multi-factor authentication and secured communications (Section 5(1)).NIST CSF 2.0GV.PO-01
- Where you do not meet a Section 5 requirement or a rule made under Section 5(3), take all necessary, appropriate and proportionate corrective measures without undue delay (Section 5(2)).NIST CSF 2.0ID.RA-06
- Have your management body approve the measures and supervise their implementation, and have its members attend courses on managing information-security risks (Section 6).NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- Register with the Agency, giving your name, address and contact details and the other EU member states where you provide services, within two weeks of falling under the Act, and report changes within two weeks (Section 7(1) to (3)).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of . Also read by: Styrelsen for Samfundssikkerhed (Danish Agency for Societal Security, SAMSIK) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 31 punishes a violation of Section 5(1) or (2), among others, with a fine (bøde); a legal person can be held liable under Chapter 5 of the Criminal Code.
Who enforces it
Enforcement body
Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed), which can apply enforcement measures under Sections 20 to 23.
Settledness
- As of
- Guidance link
- https://samsik.dk/tele/
- Guidance body
- Styrelsen for Samfundssikkerhed (Danish Agency for Societal Security, SAMSIK)
- Open questions
- Against what benchmark will the Agency judge whether the security level a provider has set through its own risk management is appropriate and proportionate under Section 5(1) of the Act, when its guidance says that 'det i praksis er teleudbyderne selv' (in practice the providers themselves) set that level?
What this law does
Act No. 435 of on security and preparedness in the telecoms sector (Lov om sikkerhed og beredskab i telesektoren), published in Lovtidende A on , implements parts of the European Electronic Communications Code (Directive (EU) 2018/1972) and parts of NIS2 (Directive (EU) 2022/2555) for providers that make public electronic communications networks or publicly available electronic communications services available in Denmark for commercial purposes.
Under Section 3 a provider is essential if it employs 50 people or more, or has an annual turnover and a balance sheet each above EUR 10 million, and a provider that meets one of the listed criteria, such as being the only provider of a network or service essential for critical societal or economic activities, is essential whatever its size; under Section 4 the other providers are important.
Section 5(1) requires essential and important providers to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems they use and to prevent incidents or minimise their impact, covering at least ten categories that mirror NIS2 Article 21. Section 5(2) requires a provider that does not meet a Section 5 requirement to take all necessary corrective measures without undue delay.
Under Section 6 the provider's management body must approve the measures and supervise their implementation, and its members must attend courses on managing information-security risks. Section 7 requires a provider to register with the Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed) within two weeks of falling under the Act and to report changes within two weeks. Section 31 punishes a violation of Section 5(1) or (2) with a fine. The Act entered into force on .
When LexLint raises it
When your app profile says your app provides telecom services or runs an essential service.