National Cyber Security Centre (Sweden)

National Cyber Security Centre (Sweden)
Agency name	National Cyber Security Centre (Sweden)
Native name	CERT-SE (historical) / Nationellt cybersäkerhetscentrum
Formed	2015
Preceding1	Swedish Civil Contingencies Agency (MSB) cyber unit
Jurisdiction	Sweden
Headquarters	Stockholm
Chief1 name	Director-General
Parent agency	Swedish Civil Contingencies Agency (MSB)
Website	Official site

National Cyber Security Centre (Sweden) is a Swedish government agency-level entity responsible for national cyber resilience, incident response, and information security coordination. The centre traces its roots to Swedish civil protection reforms and builds on capabilities from the Swedish Civil Contingencies Agency, the Armed Forces, and national intelligence services. It operates as a focal point linking Swedish authorities, critical infrastructure operators, and international partners for cyber crisis management.

History

The centre emerged from restructuring after high-profile incidents and policy reviews influenced by actors such as Swedish Civil Contingencies Agency, Swedish Defence Research Agency, Swedish Armed Forces, Swedish Security Service, and reports tied to the Government Offices of Sweden. Early development drew on lessons from incidents involving entities like Telia Company, Vattenfall, and municipal IT outages; policy debates referenced thinkers in European Union cybersecurity policy and frameworks promulgated by NATO and ENISA. Creation was motivated by national strategies similar to those in United Kingdom, Germany, and Estonia, and formal establishment reflected directives from the Riksdag and ministerial decisions within the Ministry of Justice (Sweden) and Ministry of Defence (Sweden).

Mission and Responsibilities

The centre’s mandate includes protecting critical information infrastructure operated by companies such as Swedish Transport Administration, Vattenfall, Svenska Kraftnät, and municipal authorities like Stockholm Municipality. Responsibilities align with national strategy documents authored by the Government Offices of Sweden, interlinking with statutory bodies such as Swedish Post and Telecom Authority and law-enforcement institutions like Swedish Police Authority and Swedish Prosecution Authority. Core tasks mirror international peers including United Kingdom National Cyber Security Centre, US Cybersecurity and Infrastructure Security Agency, and ENISA: incident handling, vulnerability coordination, threat intelligence sharing, and public guidance to entities such as Folkhälsomyndigheten and Swedish Tax Agency.

Organisation and Leadership

Structurally the centre operates within or in close coordination with the Swedish Civil Contingencies Agency while interfacing with leadership from the Prime Minister of Sweden office and parliamentary oversight by the Riksdag Committee on Civil Affairs. Executive appointments often involve officials with backgrounds in Swedish Armed Forces, Swedish Security Service, Swedish Defence Research Agency, or the private sector including firms like Ericsson and Securitas AB. Leadership roles include director-level positions responsible for technical operations, policy, and liaison with entities such as European Commission and bilateral partners like United States Department of Homeland Security.

Operations and Capabilities

Operational capabilities encompass a national Computer Security Incident Response Team role akin to CERT-EU and US-CERT, delivering 24/7 incident handling, digital forensics, and malware analysis comparable to labs used by Fraunhofer Society and FOI (Sweden). The centre develops guidance on standards such as ISO/IEC 27001 and cooperates with research partners like KTH Royal Institute of Technology, Chalmers University of Technology, and Uppsala University to advance cyber defence techniques. Tools and services include alert dissemination to operators such as Svenska Kraftnät, threat dashboards for agencies like Swedish Transport Administration, and joint exercises modeled on scenarios used by NATO Cooperative Cyber Defence Centre of Excellence.

National and International Cooperation

The centre engages bilaterally with counterparts including United Kingdom National Cyber Security Centre, US Cybersecurity and Infrastructure Security Agency, Finnish Transport and Communications Agency (Traficom), and Estonian Information System Authority, and multilaterally through ENISA, NATO, and EU structures such as the European Commission DG CONNECT. Collaboration extends to private-sector partners including Telia Company, Ericsson, ABB, and banks represented by Svenska Bankföreningen, as well as research collaborations with institutions like RISE Research Institutes of Sweden. It supports cross-border incident coordination with entities such as CERT-EU and participates in exercises alongside Folke Bernadotte Academy-linked civil protection simulations.

Incidents and Notable Actions

Notable actions include coordinated responses to large-scale incidents impacting utilities and municipal services, joint vulnerability advisories concerning software from vendors like Microsoft and Cisco Systems, and public warnings during campaigns linked to state-aligned actors comparable to incidents attributed to groups active in Russia-related campaigns or Chinese-speaking clusters noted by NATO reporting. The centre has led tabletop exercises with stakeholders including Svenska Kraftnät and Swedish Transport Administration, and issued mitigation guidance during high-profile vulnerabilities such as those in widely used enterprise products deployed by organizations like Telia Company and Swedish Tax Agency.

Legal and Policy Framework

The centre operates within Swedish legal instruments including statutes overseen by the Riksdag, and regulatory frameworks from agencies like the Swedish Post and Telecom Authority and directives transposed from the European Union NIS Directive and subsequent NIS2 legislation. It supports enforcement and information-sharing under law-enforcement frameworks administered by Swedish Police Authority and cooperates with intelligence activities coordinated with the Swedish Security Service and policy direction from the Ministry of Justice (Sweden) and Ministry of Defence (Sweden). Policy outputs connect to national strategies articulated by the Government Offices of Sweden and technical standards such as ISO/IEC 27001 and EU cybersecurity certification schemes promoted by ENISA.

Category:Government agencies of Sweden Category:Cybersecurity