Norway Raises Its National Cyber Risk Level to High and Tells Every Organization What to Fix

Norway’s National Security Authority (NSM) has raised the national cyber risk level to “high” and, for the first time, published that assessment openly and unclassified. The announcement on October 27, 2026, came with a package of measures that NSM says all Norwegian organizations must review, and a stark statistic: successful cyber operations against Norwegian organizations have tripled in the past six months.

The decision is Norwegian, but the reasoning is not. NSM points to the rapid spread of artificial intelligence as a factor that raises risk even before AI-driven attacks have been documented in the country. Any organization that relies on suppliers, runs exposed infrastructure or holds personal data at scale can use NSM’s list as a benchmark. (Quotes below are translated from Norwegian.)

What “high” means on NSM’s scale

NSM assesses cyber risk to Norwegian public and private organizations continuously, on a five-step scale: very low, low, moderate, high and extremely high. “Moderate” is the normal state, in which cyber operations against Norwegian organizations are expected. Moving to “high” signals that the threat has risen above that baseline and that preventive measures are needed immediately.

“NSM has not gone public with this type of assessment before. We are doing it now because it is absolutely necessary to strengthen both resilience and the ability to handle cyber operations in Norwegian organizations,” said NSM director Arne Christian Haugstøyl.

Who is most exposed

NSM singles out several sectors as facing high risk:

• the defense sector and defense industry;
• the space sector;
• critical infrastructure; and
• service providers to organizations that matter for national security.

These organizations face reconnaissance, attempted and successful compromises, ransomware and denial-of-service attacks. “In the last half year we have seen a tripling of successful cyber operations against Norwegian organizations. Several of these have had serious consequences and still carry a potential for harm to national security,” Haugstøyl said.

NSM also notes that attackers target subcontractors as a way to reach organizations higher up the supply or value chain. That makes the last group on the list, service providers, the widest: it can include IT vendors, consultancies, logistics companies and software suppliers with no direct link to defense.

The AI factor

NSM says the fast escalation in AI use is affecting the threat picture. Language models and agentic AI systems used in cyber operations pose “a serious risk” to Norwegian organizations, the authority says, while acknowledging that such use “is not currently documented in Norway.” The potential for harm alone is enough to raise the national level.

“AI analyzes large amounts of data and finds vulnerabilities faster than humans have been able to. This opens new possibilities for cyberattacks at a higher frequency and greater volume. That means risk increases, and the pace of security measures must go up,” Haugstøyl said.

NSM’s measure package

NSM is clear that the measures are not new. Many come from its Basic Principles for ICT Security. What is new is the urgency. The announcement highlights:

1. Phishing-resistant multifactor authentication. NSM stresses that MFA must withstand social engineering and phishing attempts to bypass it, not just exist.
2. Hardening. Configure devices so only known software runs, switch off unnecessary functions and change all default passwords before systems go live.
3. Logging and detection. Good logs and the ability to spot abnormal activity.
4. Updating and phasing out devices. Patch centrally and retire equipment that can no longer be kept secure.
5. Network zoning. Divide networks by risk, control data flows between zones and limit software in sensitive zones.
6. Supply chain risk management. Cover the origin of components, services and software, and what information flows back to suppliers through orders and specifications. Require that suppliers manage security properly and impose the same requirements on their own subcontractors.
7. Asset mapping. Map devices and software in use. NSM suggests tools such as NIST’s Common Platform Enumeration so organizations can quickly tell whether a new vulnerability affects them.
8. Validation. Verify that controls are correctly implemented and actually work as intended.
9. Continuity. Maintain at least a minimum system that can keep a function running during an incident.

NSM lists 21 specific measures from its basic principles as relevant to every Norwegian organization, and it recommends starting with its self-assessment site, cybersjekk.no. It adds a caveat worth repeating: the measures “do not remove all risk,” but they improve an organization’s ability to handle an attack and limit the damage.

Reading the package as a privacy professional

Most of the list sounds like a security team’s job. Several items, though, overlap directly with privacy obligations under the GDPR, which Norway applies through the EEA Agreement.

• Supply chain mapping is close kin to processor and sub-processor oversight. The requirement that suppliers flow security duties down to their own subcontractors mirrors Article 28.
• Asset and software mapping supports the records of processing that controllers must keep, and helps answer the first question in any breach: which systems and data were exposed?
• Validation echoes Article 32’s requirement to regularly test and evaluate the effectiveness of security measures.
• Logging provides the evidence needed to decide whether a breach must be reported within 72 hours.

The same themes run through EU law. The Cyber Resilience Act puts security duties on product makers, and the Digital Operational Resilience Act imposes third-party risk management on financial firms. In the United States, New York’s updated third-party risk rules and insurers’ demands that make MFA effectively mandatory point the same way.

How Captain Compliance can help

Captain Compliance supports the governance side of NSM’s list. Our vendor assessments and third-party risk tools help teams record which suppliers handle which data and what security commitments they have made, and our data mapping tools tie those suppliers to systems and processing activities. Our compliance resources and incident response workflows help organize evidence when something goes wrong. We are not a security monitoring or MFA provider, and a completed vendor questionnaire is not proof that a supplier’s controls work. For a structured approach to supplier reviews, see our guide to third-party risk identification and assessment.

Frequently asked questions

What is NSM?

Nasjonal sikkerhetsmyndighet, Norway’s National Security Authority, responsible for preventive national security work, including cybersecurity.

Is this the first time NSM has raised the level?

It is the first time NSM has shared its national cyber risk level openly and unclassified. NSM did not say when the level last changed internally.

Are the measures mandatory?

NSM says it expects Norwegian organizations to implement them. Specific legal duties depend on sector rules, the Security Act and data protection law.

Has AI been used in attacks in Norway?

NSM says AI-enabled cyber operations are not currently documented in Norway, but their potential for harm contributes to the higher risk level.

Does this matter to companies outside Norway?

Yes, if they supply Norwegian organizations, especially in defense, space or critical infrastructure. The measures are also a sound baseline anywhere.

A risk level everyone can lower

NSM ends its message with an unusual point: when organizations put these measures in place, they do not only protect themselves, they help bring the national risk level back down. Few security agencies frame the problem as a shared score. The tripling of successful attacks suggests Norway needs every organization to see it that way.