NorwaySecurity Requirements for Providers of Essential Societal Services and Digital Services
Lov om digital sikkerhet (digitalsikkerhetsloven), §§ 7 and 10
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors (reached by declaring that you operate an essential service), and to providers of online marketplaces, online search engines and cloud services. Reached by declaring that you operate an essential service, provide financial services, handle health records or operate a social platform.
- A provider of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million is outside the digital-service security duty (digitalsikkerhetsforskriften section 2, as the National Security Authority's guide states it).
- Carry out a risk assessment of the network and information systems you use to deliver the service (sections 7 and 10).
- Put in place appropriate and proportionate technical and organisational security measures that together secure a level of security adapted to the risk (sections 7 and 10).
- Put in place proportionate measures to prevent, detect and reduce the consequences of incidents, so that delivery of the service can be maintained (sections 7 and 10).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Security Authority, which the guide says is the supervisory authority for undertakings that do not fall under a designated sector supervisory authority.
Settledness
- As of
What this law does
Section 2 of the Digital Security Act applies the Act to providers of essential societal services in the energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure sectors, and to providers of digital services. Section 9 of the Act defines a provider of digital services as an undertaking offering online marketplaces, online search engines or cloud services.
Section 7 of the Act requires a provider of an essential societal service to carry out a risk assessment of the network and information systems it uses to deliver the service and to put in place appropriate and proportionate technical and organisational security measures that secure a level of security adapted to the risk.
Section 10 of the Act imposes the same risk assessment and security measures on a provider of a digital service, with regard to security of systems and facilities, incident handling, continuity management, monitoring, auditing and testing, and recognised international standards. Section 2 of the Act excludes undertakings covered by the Act on electronic trust services.
The National Security Authority's guide states that the digital-service security requirement does not apply to providers of digital services with fewer than 50 employees and an annual turnover or balance sheet not above EUR 10 million. Section 17 of the Act lets the supervisory authority impose an administrative fine on a provider that intentionally or negligently breaches sections 7, 8, 10, 11 or 14.
The National Security Authority's guide to the Act states that the administrative fine can reach 25 times the National Insurance basic amount or four percent of the preceding year's turnover for an undertaking, whichever is higher, and cannot in any case exceed NOK 50 million. The Act and its regulation entered into force on .
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.