Cybersecurity law & regulation in Norway (2026)

Legal framework

Lov om digital sikkerhet (digitalsikkerhetsloven, Act 2023-12-20-108) and its implementing regulation (digitalsikkerhetsforskriften), supervised by the National Security Authority (Nasjonal sikkerhetsmyndighet, NSM); complemented by the national Security Act (sikkerhetsloven) for national-security functions.

Key points: cybersecurity in Norway

1. 01Primary law in force

   The Digital Security Act (Act of 20 Dec 2023 no. 108) and the Digital Security Regulation (Regulation of 20 Jun 2025 no. 1131) entered into force on 1 October 2025, transposing the EU NIS1 directive as an overarching framework law with detail in regulation.

   lovdata.no lovdata.no nsm.no

2. 02Scope

   Applies to operators of essential services and digital service providers across sectors including energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure; covered entities must register their services with NSM and the relevant sectoral authority.

   lovdata.no nsm.no

3. 03Incident-reporting duties

   Covered entities must notify significant incidents to NSM and the sectoral authority without undue delay, reporting within 24 hours, an update within 72 hours, and a full incident report to NSM within one month of the first notification.

   norway.dlapiper.com nsm.no

4. 04Supervisor and national response body

   The National Security Authority (NSM) is the supervisory authority and national incident-response environment; it hosts the Norwegian National Cyber Security Centre (NCSC), home to the national CERT (NorCERT).

   nsm.no

5. 05Enforcement

   NSM may impose administrative fines for non-compliance, up to 25 times the National Insurance base amount or 4% of the prior year's turnover, whichever is higher, capped at NOK 50 million.

   cms.law

6. 06NIS2 / CER still pending

   As of May 2026 the EU NIS2 directive (2022/2555) and the CER directive have not yet been transposed into Norwegian law; a new act expected during 2026 is set to replace the current Digital Security Act and significantly broaden the regime's scope.

   norway.dlapiper.com cms.law

Timeline of decisions

1. 1 Jul 2026Law
   NIS2 Implementation via Security Act Amendment, Registration Phase Opens

   Norway's amendment to the Security Act to transpose the EU NIS2 Directive (2022/2555) enters its registration phase, bringing roughly 5,000 organisations into scope across expanded critical sectors; NSM will act as central CSIRT coordinator, with first audits scheduled from 1 October 2026.

   DLA Piper Norway

2. 1 Oct 2025Law
   Digital Security Act (Digitalsikkerhetsloven) Enters Full Force

   Norway's Digital Security Act, implementing EU NIS1 Directive 2016/1148 and enacted in December 2023, entered full force for all covered operators of essential services and relevant digital service providers, ending transitional provisions and triggering mandatory cybersecurity risk management and incident reporting.

   DLA Piper Norway

3. 1 Oct 2025Law · official
   Digital Security Act (Digitalsikkerhetsloven) Enters into Force

   Norway's Digital Security Act, implementing EU NIS1 Directive (2016/1148) into EEA law, took effect, the first cross-sector framework mandating risk assessments, technical/organisational security measures, and 24-hour initial incident notification to NSM, with penalties up to 4% of annual turnover.

   NSM (Nasjonal sikkerhetsmyndighet)

4. 1 Oct 2024Guidance · official
   Meld. St. 9 (2024-2025): Total Preparedness White Paper

   The government presented a comprehensive white paper on total societal preparedness to the Storting, elevating cybersecurity alongside conventional defence and civil-emergency planning and setting direction for integrated crisis resilience.

   Norwegian Government (Regjeringen)

5. 23 Dec 2023Law
   Cybersecurity Act (Digitalsikkerhetsloven) enacted, NIS Directive transposed

   Parliament passed the Cybersecurity Act on 23 December 2023 implementing EU NIS Directive obligations on operators of essential digital services, including payment infrastructure. It imposed mandatory security measures and incident-notification duties for fintech and payment firms, complementing PSD2's existing security requirements.

   Global Legal Insights — Norway Fintech 2025

6. 20 Dec 2023Law
   Digital Security Act (Digitalsikkerhetsloven) Enacted by the Storting

   Parliament enacted the Digital Security Act implementing EU NIS1, establishing mandatory cybersecurity risk management, incident-reporting obligations, and supervisory powers for NSM (the National Security Authority) over operators of essential services such as energy, transport, health, water, and digital infrastructure providers.

   Schjødt

7. 24 Jul 2023Incident
   Ivanti Zero-Day (CVE-2023-35078) Exploited Against 12 Government Ministries

   Hackers exploited a critical CVSS-10 authentication-bypass zero-day in Ivanti EPMM to breach mobile-device management systems at 12 ministries; NSM deliberately delayed public disclosure to limit wider exploitation, later alerting CISA and partner nations.

   The Record (Recorded Future News)

8. 1 Dec 2022Guidance · official
   Meld. St. 9 (2022-2023): Cyber Resilience and National Control White Paper

   The government submitted a landmark white paper to the Storting framing cyber resilience as a national-security imperative, addressing hybrid threats, critical-infrastructure protection, and the need for tighter foreign-ownership screening, directly shaping the subsequent Digital Security Act.

   Norwegian Government (Regjeringen)

9. 10 Mar 2021Incident
   Storting Breached Again via Microsoft Exchange ProxyLogon Vulnerabilities

   Attackers exploited the ProxyLogon zero-days (CVE-2021-26855 et al.) to exfiltrate data from Norwegian Parliament email accounts just six months after the 2020 breach; parliamentary leadership described it as more severe than the prior attack.

   Nasdaq / AFP wire

10. 24 Aug 2020Incident
    APT28 (GRU) Breaches Norwegian Parliament Email Systems

    Russia-linked APT28/Fancy Bear used brute-force credential attacks to access a limited number of Storting email accounts; Norway's Foreign Minister publicly attributed the intrusion to Russia in December 2020, marking a rare state-level public attribution.

    BleepingComputer

11. 30 Jan 2019Guidance · official
    4th National Cyber Security Strategy Published

    Norway released its fourth, and most comprehensive, national cyber security strategy, allocating ~NOK 1.6 billion to 46 measures across five priority areas, cementing NSM's cross-sector coordination role and recommending ten baseline security measures for all public and private entities.

    Norwegian Government (Regjeringen)

12. 1 Jan 2019Law · official
    Revised Security Act (Sikkerhetsloven) Enters into Force

    Norway's new Lov om nasjonal sikkerhet (passed by the Storting 1 June 2018) replaced the 1998 Act, creating binding obligations for all entities handling classified information or critical national functions: mandatory risk assessments, ICT security measures, and immediate incident notification to NSM.

    Lovdata (official Norwegian legislation portal)

13. 1 Jan 2012Guidance · official
    Third National Cyber Security Strategy Published

    Norway issued its third revision of the national cyber security strategy, adapting the national framework to an increasingly sophisticated threat landscape; the document entrenched NSM's cross-sector mandate and remained the operative policy guide until the 2019 fourth strategy.

    Norwegian Government (Regjeringen)

14. 1 Jan 2003Law · official
    NSM Established and First National Cyber Security Strategy Published

    Norway established the National Security Authority (NSM) as the state's lead protective-security and cyber coordination body, and simultaneously published its first national cyber security strategy, making Norway one of the first countries in the world to adopt such a strategy, laying the institutional foundation for the entire current framework.

    NSM (Nasjonal sikkerhetsmyndighet)

Sources

1. 1.lovdata.no/dokument/NL/lov/2023-12-20-108
2. 2.lovdata.no/dokument/LTI/forskrift/2025-06-20-1088
3. 3.lovdata.no/dokument/LTI/forskrift/2025-06-20-1131
4. 4.lovdata.no/artikkel/lover_i_kraft_1__oktober_2025/5227
5. 5.nsm.no/aktuelt/ny-digitalsikkerhetslov-i-norge
6. 6.nsm.no/regelverk-og-hjelp/veiledere-og-handboker/digitalsikkerhetsloven-og-f
7. 7.nsm.no/areas-of-expertise/cyber-security/norwegian-national-cyber-security-c
8. 8.norway.dlapiper.com/en/news/digital-security-act-and-related-regulation-enters-force
9. 9.norway.dlapiper.com/en/news/new-rules-digital-security-2025-implementation-eu-directives-
10. 10.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se