ORGSEC
Security governance that holds

Security governance that holds

For the head of the organisation and the board in operators of essential services who must approve a management system and want to know it has been tested before they sign, and for security managers who must present it.

Start the assessment

Why now

Many leaders will sign off on something they have never seen tested

NSM sums up in Risk 2026 that there are significant shortcomings in preventive security work in Norwegian organisations, and that the shortcomings recur across sectors. Three are singled out: employees hold security roles they are not aware of or lack the competence to fill, baseline security is not tested, and additional measures and contingency plans are often missing. The report's title, «Today's choices – tomorrow's risk», is NSM's own attempt to get management to act.

The framework around it has tightened. The Digital Security Act applies from 1 October 2025 to providers of essential services, without phasing in, and requires the head of the organisation to approve the management system every year, with notification within 24 hours and administrative fines that also reach the parent company. The winter of 2027 is thus the first ordinary approval round for many leaders. NIS2 and CER are expected in Norwegian law during 2027, with requirements for risk assessment, background checks of personnel, training and exercises, but the timing and the Norwegian design are still unclear. We measure the organisational side of this, not the technical; the technical security we leave to those who know it.

Sources: NSM: Risk 2026 (Norwegian) · Deloitte on the Digital Security Act (Norwegian) · KPMG on CER (Norwegian)

NSM's three gaps

What recurs across sectors

Roles nobody knows

Employees hold security roles they are not aware of, or lack the competence to fill, so that the responsibility exists on paper and nowhere else.

Baseline security that is not tested

The measures are in place, but the organisation has not carried out tests, controls or exercises that show whether they work, and therefore does not know whether they do.

Plans that are missing

Additional measures and contingency plans are often missing, so that the organisation has no description of what should happen when baseline security does not hold.

What the law requires of management

The Digital Security Act in brief

Risk assessmentIdentify threats, vulnerabilities and possible consequences, and keep the assessment up to date.
Management systemA documented security management system that the head of the organisation approves annually, with organisational, technical, physical and personnel measures.
NotificationProcesses for notifying incidents within 24 hours, also when the incident occurs at a supplier or partner.
SuppliersEnsure that suppliers maintain the security level the organisation itself is required to, preferably by contract.
AccountabilitySupervision, administrative fines and a responsibility that does not stop with the security manager, but goes all the way up to the head of the organisation and the parent company.

Who is covered is decided by thresholds in the regulation, and the organisation must assess for itself whether it is. We note that NIS2 and CER may change both scope and requirements when they are implemented in Norway.

In the ORGSEC assessment

Where the theme lands in the assessment

Area 01
Security governance
Whether management actually owns the management system, whether the roles are known and staffed, and whether the measures have been tested before they are approved.
Area 04
Cyber and technology
The organisational side of digital security: notification routines, supplier follow-up, fallback solutions and whether those who are to use them know it.

The assessment gives the leader a basis for approving the management system with open eyes, and the board documentation that can be followed year by year. See the six areas →

What we deliver

Assessment, e-learning and talk

Assessment

Security governance before approval

A review of the organisational side of the management system before the leader approves it: roles, responsibilities, testing and exercising, read against the Digital Security Act and what NIS2 and CER will require. All services →

E-learning in ORGSEC+

Approving a management system

For the head of the organisation and the board. What it means to approve the management system under the Digital Security Act, what must have been tested, and which questions the leader should ask before signing. About the subscription →

Talk

The plan that was never tested

Security governance that holds up to supervision and to reality – NSM's three gaps, the leader's annual approval and what NIS2 and CER will require.

Talk

The talk within the theme

Talk 03