NSM raises Norway’s cyber risk level to HIGH
This is what critical infrastructure organizations have been preparing for. Now is the time to test that our resilience works.
The Norwegian National Security Authority (NSM) has raised Norway’s national cyber risk level to HIGH, calling on organisations to implement preventive measures immediately. For many organisations, this will not come as a surprise. From technical experts to leadership teams, organizations operating critical infrastructure are well aware of the increasing threat and many have been preparing for more frequent and advanced cyber-attacks. Now is the time to test that preparation.
At DNV Cyber, we recommend that critical infrastructure organizations take the following three steps to respond to the increased threat level in the short term:
- Test that your critical security measures work and that your organization is ready to respond
- Ensure your most critical operations can continue if an attack is successful
- Drive preparedness across your critical suppliers
Test that your critical security measures work and that your organization is ready to respond
Focus on the systems and services that matter most, and verify that critical preventive and detection measures are operating as intended.
Then test the response. Run focused simulations of realistic attack scenarios to see whether you can detect and contain an attack and respond effectively.
Testing should include people as well as technology. Bring together security, IT, operational teams and management around a realistic scenario. Make sure responsibilities are understood, escalation routes work and the people who may need to make difficult decisions know when and how to make them.
Ensure your most critical operations can continue if an attack is successful
Test whether your critical operations can continue when something you depend on becomes unavailable. What happens if a critical system becomes unavailable? Do people know what to prioritise, who makes decisions and what the alternatives are?
Having a continuity plan does not necessarily mean an organisation is resilient. Testing can reveal dependencies, unclear responsibilities and missing alternatives before an incident does.
Drive preparedness across your critical suppliers
Press your most critical suppliers and partners to demonstrate that they are prepared and testing their own resilience, particularly where your essential operations depend on their systems or services.
At the same time, test your response to their failure. If a critical supplier becomes unavailable, can you continue operating?
10/28/2026 11:18:00 AM
