New rules for IT security: Executives to face greater responsibility
Norwegian business leaders and board members must prepare for stricter requirements regarding digital security in the coming years. A new European regulatory framework is expected to be implemented in Norway towards the end of 2026, which will change how companies handle data attacks.
Today, it is often the IT manager who holds the primary responsibility for a company's digital defense. With the new regulations, this responsibility will be elevated to the top management level. This means that board members and CEOs must have better control over the risks associated with cyberattacks than they have had in the past.
The purpose of the new rules is to ensure that companies take IT security seriously as part of their overall business strategy. A briefing from the IT department will no longer be sufficient to meet legal requirements. Management must now actively follow up on security measures and ensure that the company is equipped to handle digital threats.
Experts point out that this is a necessary development at a time when digital attacks are becoming increasingly advanced and frequent. By placing the responsibility with management, authorities hope that Norwegian companies will be better protected against financial losses and the loss of sensitive information.
Companies in Norway now have two years to adapt to the new requirements. It is recommended that boards and executives begin the work of reviewing their procedures now, so that they are ready when the regulations come into force in 2026.