sou · H9B363 · 2021-07-02 00:00:00 — Dependency on digital infrastructure and services through widespread Internet connectivity and connected devices results in increased vulnerability, which places higher demands on information security and cybersecurity. Even though digital trans- formation is progressing rapidly, information security and cyber- security are not pace. This gap, and if it increases further, also increases the risk of being subjected to cyber-attacks or other IT incidents. However, this gap can be reduced by means of various measures that help to strengthen information security and cyber- security. New threats, vulnerabilities and risks Just as the digitalisation of society’s various activities continues to bring benefits, it can also bring with it new or changed threats, vulnerabilities and risks which can have an impact on information security and cybersecurity in the network and information systems of various operators. This means that the risk of cyber-attacks against various critical infrastructures is increasing, in particular against security-sensitive activities and other essential services, many of which have critical assets. The threats come primarily from state actors who carry out cyber-attacks for various purposes, including pre- parations for cyber-attack and as industrial espionage. The threats also come from criminal actors and ideologically motivated actors who have the capacity to carry out cyber-attacks for various purposes. Various factors that can cause significant change, such as the development of 5G systems, cloud services, artificial intelligence and computers, bring with them new opportunities, but also increased vulnerabilities and risks that can be exploited and cause harm to various security-sensitive and essential services and activities, but also to business and industry, such as the defence industry. Furthermore, dependencies between various essential services and activities, such as electronic communications and the energy sector, create vulnerabilities and risks, and cyber-attacks on an essential service can have serious and extensive consequences for one or more of these services and also for the activities of 's total defence. Serious shortcomings in information security and cybersecurity Adequate information security and cybersecurity can only be achieved when all the different conditions required for such security are met: uniform governance of information security and cybersecurity measures and how they are organised; systematic information security work in activities and technical measures; and supervision of com- pliance with the regulations and set requirements. It has emerged from Swedish Government Official Reports and government agency reports that there are serious shortcomings in information security and cybersecurity in many different areas in a range of societal activities. This includes the activities of central government authorities as well as the regions and municipalities, but also the activities of organisations and the business community. It has emerged from Swedish Government Official Reports and govern- ment agency reports that there are serious shortcomings within the activities of many operators, both in terms of systematic informa- tion security work and the security of various network and informa- tion systems. Furthermore, there are serious shortcomings in gover- nance and how information security is organised, as well as know- ledge and skills and resource allocation in the area of information security and cybersecurity. The Inquiry makes no other assessment of the identified short- comings in and level of information security and cybersecurity than that which is described in the Swedish Government Official Reports and government agency reports published over the last five years, and these have been that a need for powerful and comprehensive measures in many different areas to strengthen information security and cybersecurity must be deemed to exist; on the one hand, more generally in various societal activities, but in particular with regard to security-sensitive activities and other essential services. The serious shortcomings entail manifest risks of cyber-attacks against network and information systems that can have serious consequences for society as a whole as well as for actors in different spheres of activity, which thus can also have serious con- sequences for activities in ’s total defence. The remit is limited to considering whether there is reason to introduce a specially adapted national certification scheme for ICT products, services and processes in network and information systems in security-sensitive operations and/or to introduce requirements for administrative approval before such ICT products, services and processes in network and information systems can be deployed. At the same time, the Inquiry can conclude that individual measures of this kind do not alone constitute sufficient measures to meet general requirements on information security and cybersecurity, or even to meet the security requirements of network and information systems in security-sensitive operations, since other conditions for adequate information security and cybersecurity must also exist. Because the Inquiry’s remit is focused on considering the measures set out in the terms of reference of the Inquiry, the Inquiry has therefore not considered in detail the other measures that ought to be taken to strengthen information security and cybersecurity more generally or in security-sensitive activities, apart from the need for governance and coordination, since these needs also constitute fundamental conditions for the Inquiry’s considerations in its report. for increased governance and coordination Swedish Government Official Reports and government agency reports have highlighted the need to strengthen the governance and coordina- tion of digitalisation, in particular with regard to the expansion of infrastructure and the coordination of work with information security and cybersecurity. The national market is a deregulated market with different layers of infrastructure producers, operators and service developers. Nationally, is in a situation where almost all basic social functions presuppose and are based on a functioning digital infrastructure. However, rules and a systematic approach to and co- ordination of the digital transformation and its expansion are lacking. In view of the large number of public actors, this is a considerable task, since the matter concerns, among others, more than 200 central government administrative authorities, 21 county administrative boards, 20 regions, 290 municipalities, 80 courts, 37 higher education institu- tions, and 40 state-owned companies. This is an extensive administration which is complicated by large differences between these activities in terms of remit, size, financial resources and powers. In addition, there are the activities of the business community and all companies that develop, operate and manage society’s digital infra- structure in some way. The same applies to the overall work to strengthen information security and cybersecurity in society at large, but also in security- sensitive activities and other essential services. Each operator is responsible for their own information security and cybersecurity, including the security of their network and information systems. However, there is currently no supervision of either the activities of central government authorities or those of the regions and munic- ipalities in the area of network and information systems, except in the area of national security and activities relating to certain essential and digital services. However, supervision of information security and cybersecurity in these regulated areas is exercised by a number of responsible consultation and supervisory authorities with, in some cases, the application of different regulations. Responsibility for in- formation security and cybersecurity thus lies with many different actors, and governance and coordination are lacking at the central, regional and municipal levels. The lack of governance and coordina- tion increases the vulnerability of and risks in network and informa- tion systems in security-sensitive activities and other essential services. The Inquiry considers that there is a need for national governance and coordination in the development of a common threat, vulnerability and risk assessment to support work with information security and cybersecurity. The relevant authorities and other actors therefore need to cooperate and consult more extensively than is currently the case on questions relating to information security and cybersecurity. Insufficient conditions for a national certification scheme for network and information systems of importance to national security A specially adapted national certification scheme for ICT products, services and processes used in network and information systems in security-sensitive activities may – when certain conditions are met – be a measure that can strengthen the security of these systems. The Inquiry considers that the provisions in the Act and the Ordinance already give the relevant authorities the powers to prescribe the use of certified ICT products, services and processes that meet certain security require- ments in network and information systems in security-sensitive activities, and additionally admit the possibility of derogation from such a requirement. A specially adapted scheme for security-sensitive activities is pre- dicated on the existence of a nationally developed and common threat, vulnerability and risk assessment that can serve as the basis for security requirements and the development of protection profiles for different ICT products, services and processes in these systems. Such an assessment is also essential to the focus of national efforts with cybersecurity certification framework. Today, however, there is no organisation or activity that is responsible for and produces such a national threat, vulnerability and risk assessment. Furthermore, cybersecurity certification frame- work is still in the process of being produced and developed. How- ever, there is currently a lack of clarity on the extent to which certified ICT products, services and processes will be available under this frame- work, including ICT products, services and processes at the highest level, that can also be used – if necessary after adaptation – in security-sensitive activities. There is also uncertainty as to whether the market conditions exist for introducing a specially adapted national certification scheme for security-sensitive activities, as the Swedish market is judged to be too small for companies to have any financial incentives for having their ICT products, services and processes certified for use in net- works and information systems in such activities. Even if mandatory certification were to be introduced, it would not imply any require- ment to sell such products on the Swedish market. In addition, the national certification body CSEC of the is already responsible for a national scheme for the certification of IT security in products and systems, although the national Common certification scheme may come to be replaced by a European cybersecurity certification scheme (EUCC). Ultimately, the national certification scheme can be developed to cover the certification of ICT products, services and processes in network and information systems in security-sensitive activities. All in all, the Inquiry considers that there are currently insuffi- cient grounds for proposing the introduction of a specially adapted national certification scheme for ICT products, services and pro- cesses used in network and information systems in security-sensitive activities. However, there is a need for affected government agencies to produce joint threat, vulnerability and risk assessments and protec- tion profiles for the ICT products, services and processes to be used in network and information systems in security-sensitive activities. The Inquiry therefore proposes that, in consultation and coopera- tion with the government agencies that are part of the nationellt cybersäkerhetscenter [national cybersecurity centre] in particular, the Government tasks the () with developing the forms for how common threat, vul- nerability and risk assessments and protection profiles can be pro- duced to support prescribing requirements on ICT products, services and processes to be used in network and information systems in security-sensitive activities. Such a nationally developed assessment with attendant prescribing of requirements can also be used as the basis for national efforts in the context of cybersecurity certification framework. Furthermore the Inquiry considers that information security and cybersecurity in the activities of central government authorities in general need to be strengthened. Measures should therefore be taken that contribute to the use of certified ICT products, services and processes in network and information systems by government agencies in their activities unless this seems inappropriate or impos- sible to implement. () is already judged to have the authority to specify such requirements for central government authorities in regulations. Such a system could also contribute knowledge and experience about the needs and uses of certified ICT products, services and processes in network and information systems in public sector activities and also serve as the basis for work with threat, vulnerability and risk assessments at the national level, which the Inquiry proposes should be implemented. Expanding the consultation requirement and powers to issue remedial orders and prohibitions in relation to the deployment of information systems in security- sensitive operations Based on the terms of reference of the Inquiry and in light of the serious shortcomings in information security and cybersecurity that have emerged from Swedish Government Official Reports and government agency reports, the Inquiry finds that there is reason to consider a number of measures relating to the deployment of and substantial changes in information systems in security-sensitive ac- tivities. These include checkpoints such as requiring administrative approval, special protective security assessment, suitability assess- ment, consultation, orders and prohibitions. The Inquiry can conclude that introducing requirements on in- formation systems that process secret and/or top secret information to be approved by a designated central government agency prior to deployment could help to strengthen the protection of information systems of importance to national security. This type of approval procedure is common in other countries and can in itself be regarded as a reasonable measure for strengthening the protection of national security. The Inquiry considers that the ongoing legislative measures, in- cluding the amendments proposed by the Government to the Pro- tective Security Act (Govt 2020/21:194), cannot be equated with a formal administrative approval, nor can they be considered to constitute sufficient measures to protect information systems in security-sensitive activities. A requirement for formal prior approval by a central authority ought in itself to entail an independent third- party assessment which would contribute to the creation of a min- imum standard for checking security and more uniform security requirements among operators. At the same time, the Inquiry assesses that the introduction nationally of a general requirement for administrative approval of information systems in security-sensitive activities would entail a significant need for reorganisation and increased resources for the consultation and supervisory authorities. In addition, such an adm- inistrative approval requirement would need to be designed in line with other protective security requirements for information systems, which would still mean that a large amount of security-sensitive information, albeit at a lower level, would fall outside the scope of the regulation. Therefore, before further consideration is given to the introduction of an administrative approval requirement, there ought to be an evaluation of whether already proposed legislative amendments in the area of protective security, combined with a strengthened consultative role for the and the Swedish Armed Forces, constitute sufficient measures when it comes to information systems in security-sensitive activities (see below). In addition, within their existing mandates certain central authorities can already make provision for requiring certified ICT products, services and processes in information systems in security- sensitive activities (see above) and also, as a protective security measure, order an operator to use such products, services and processes. An expanded consultation procedure and greater powers In order to make the use of an information system in security- sensitive activities more secure, and thereby strengthen the protec- tion of ’s security, the Inquiry proposes amendments to the Act. The proposed amendments include the following measures. –The provisions of the Ordinance on preparatory measures prior to the deployment of information systems should be transferred to the Act. –Existing requirements on operators to perform a special security assessment are extended to also cover planned substantial changes in information systems that may be of importance to security- sensitive activities. –Operators are to examine the suitability of a planned deployment of or substantial change in an information system that is of im- portance to security-sensitive activities. If the suitability assess- ment leads to the conclusion that the planned procedure is un- suitable from a protective security point of view, the procedure is not to be commenced. –The suitability assessment, as well as the special security assess- ment, must be documented. –If the operator’s suitability assessment leads to an assessment that the intended procedure is not unsuitable from a protective security point of view, the operator – provided that other necessary prerequisites for consultation are met – is to consult with the consultation authority (the or the Swedish Armed Forces). –The operator’s requirement to consult with the Service or the Swedish Armed Forces prior to the deployment of, or a substantial change in, certain information systems, should not be limited to a written process. –In their capacity as consultation authorities under the Act, the and the Swedish Armed Forces are to be permitted to initiate consultation and within the context of a consultation to issue remedial orders to the operator to take a protective security measure in the information system. –The consultation authorities are to also be given the power to prohibit a deployment of, or change in, an information system that is unsuitable from a protective security point of view, and to impose an administrative fine on a person who fails to comply with the consultation requirement, or acts in contravention of a prohibition that has been issued.1 –The supervisory authorities are given a new power of investiga- tion through the possibility, under penalty of a fine, of gaining access to operators’ information systems. The Inquiry assesses that its proposals strengthen the protection of ’s security. The Inquiry’s proposal that the Swedish Defence Materiel Admin- istration (FMV), in consultation and collaboration with other author- ities, should be given the task of developing the forms for a common threat, vulnerability and risk assessment at national level entails 1The expanded powers correspond in substance to what is proposed to apply (Govt 2021/ 21:194) for supervisory authorities when operators acquire and transfer ownership of security- sensitive activities. However, with regard to requirements on the operator, especially far- reaching security requirements are justified in particular in connection with the deployment of, and substantial changes in, information systems which may process classified information. to these costs, FMV's appropriations should be increased. costs for other authorities are assessed to be within the existing appropriations. For the operators who will be affected by the proposals, they may entail certain administrative burdens and increased costs, particularly in respect of the expanded consultation procedure, which are assessed as being limited. The proposals also entail certain increased administrative costs for the authorities that will be the consultation authorities (the and the Swedish Armed Forces). These costs will depend primarily on the extent to which consultations will take place and are currently difficult to estimate. However, any costs are assessed as being limited and able to be accommodated within the existing appropriation framework and the anticipated increased appropria- tion (see Govt 2020/21:30). Furthermore, the proposals are ex- pected to lead to an increased need for collaboration between the consultation and supervisory authorities, which may generate limited costs. These costs are assessed as being accommodated within the authorities’ appropriations. The proposal for a new power of investigation for the supervisory authorities increases the chances of effective supervision and is not considered to have any significant impact on the costs for the super- visory authorities. The proposal that the supervisory authorities should have the right to gain access to operators’ information systems may lead to the need for assistance from the Swedish Enforcement Authority on a number of occasions, but the increase is not assessed as being particularly great and is not anticipated to affect the Authority’s activities more than that the consequences can be accommodated within the existing appropriation for the Authority. The new provision on an administrative fine may also contribute to increased compliance with the regulations and more effective supervision, and to a limited extent increase the number of enforce- ment cases at the Swedish Enforcement Authority. Furthermore, the proposals concerning appeals against the deci- sions of the consultation authority mean that the administrative courts may have a slightly higher influx of cases and thus more tasks. However, the Inquiry assesses that the increase in the number of cases will be limited and that the increase in costs for the courts ought to be accommodated within the existing appropriation frame- works. The proposals affect municipal self-government to some extent. However, the proposed regulation does not go beyond what is nec- essary to protect the society’s most critical assets. Even if no new criminalisation is proposed, the proposals can be assumed to have some crime prevention effects. Since the increased powers ought to facilitate the ’s law enforce- ment activities in the area of protective security, and since more stringent requirements are imposed on the deployment of, and changes in, information systems in security-sensitive activities, it is assessed that the proposals will counteract computer fraud, among other things. Beyond what has been stated above, the Inquiry assesses that the aforementioned proposals do not concern other areas specified in section 15 of the Committees Ordinance. The proposals and assess- ments otherwise, including that certified ICT products, services and processes should be used by government agencies to a greater extent, are assessed to have no consequences that need to be reflected in more detail in the impact assessment. 1.1Förslag till lag om ändring i säkerhetsskyddslagen (2018:585) Härigenom föreskrivs i fråga om säkerhetsskyddslagen (2018:585) dels att 6 kap. 3 och 4 §§, 7 kap. 9 § samt 8 kap. 4 § ska ha följande