Systems and facilities necessary for society's basic functions - including power supply, water systems, telecommunications, and transport.
Definition
Critical national infrastructure comprises facilities, systems, and services upon which society depends in order to function - and which, if they fail, can have serious consequences for the population, businesses, and national security. In Norway, this includes the electricity supply and power grid (operated by StatnettNorway's system operator for the transmission grid - owns and operates the high-voltage network and operates Elhub. and distribution system operators), water supply, telecommunications, financial systems, healthcare, and transport. The energy sector is defined as particularly critical because most other sectors depend on a stable electricity supply. EU directives such as NIS2EU directive on network and information security - imposes strict security requirements on critical infrastructure. and the Norwegian Security Act set requirements for the protection of such infrastructure - including requirements for contingency plans, incident reporting, and supply chain security. For IT systems in the energy industry, this means heightened requirements for access control, logging, incident handling, and resilience against cyber attacks.
In practice, critical national infrastructure means that energy companies and their IT vendors are subject to strict requirements that go far beyond ordinary GDPR compliance. The NIS2 directive (implemented in Norway from 2024–2025) obliges power companies to report security incidents within 24 hours, maintain documented risk management, and impose requirements on their subcontractors. For Tvimenning, this means that SAMTYGD and RUNA are built with security as a design principle - not as an afterthought. Customers in the power industry cannot opt out of security requirements; they are part of the operating framework.
In practice
In practice, critical national infrastructure means that energy companies and their IT vendors are subject to strict requirements that go far beyond ordinary GDPRGeneral Data Protection Regulation - EU's data protection regulation, applicable in Norway via the EEA Agreement. compliance. The NIS2EU directive on network and information security - imposes strict security requirements on critical infrastructure. directive (implemented in Norway from 2024–2025) obliges power companies to report security incidents within 24 hours, maintain documented risk management, and impose requirements on their subcontractors. For TvimenningOld Norse meaning 'two bound together' - one who solves a task shoulder to shoulder with another., this means that SAMTYGDTvimenning platform for Elhub integration - handles all message types and processes to Elhub. and RUNATvimenning's component register for electrical installations - providing structure and traceability for the components installations are built from. are built with security as a design principle - not as an afterthought. Customers in the power industry cannot opt out of security requirements; they are part of the operating framework.
