Status report: Digitisation, threats and opportunities in the public sector

Cyber threats and strained finances: External pressure on the public sector

The geopolitical situation has fundamentally changed the digital conditions. State actors and criminal networks are targeting critical societal infrastructure, with municipalities and regions in the line of fire. SÄPO, MCF and FRA report increased incidents and threat actors mapping Swedish networks for future attacks.

At the same time, the economy is under pressure. Inflation and tighter budgets create a need for efficiencies. This creates a dual pressure: the need to invest in security, which costs money, alongside the mandate to streamline in order to save. The promise of digitalisation remains, but resources are shrinking.

The expectations of residents drive digitalisation

If the external driver concerns threats and economics, the internal driver is considerably brighter: The desire to create better conditions for the residents, and expectations are high. The public administration's e-services will be compared to the banking app and travel booking.

The systems must be fast, smooth and available around the clock; anything else will create frustration and erode trust. A developed digital workplace is also a prerequisite for employees to be able to deliver that service. This should influence your IT investments.

NIS2, the AI Regulation and the Data Act: Regulations that show the way

In this complex reality, several new frameworks have emerged. Used correctly, they give your business a clear structure to strengthen security and navigate a changing threat landscape. What they have in common is that they move the responsibility from the IT department into the boardroom:

• NIS2. Stricter requirements for cybersecurity and incident reporting, with formal managerial responsibility.

• The AI Regulation. Regulates AI based on risk level, with special requirements for the public sector.

• Data Act. Counters lock-in and gives you tools to retain control over your data.

• DOS Act. Requires digital services to be accessible to all.

How to build a secure digital foundation in public sector

How do you avoid getting stuck in complicated regulations? Which parts must be secured and standardised, and where can we speed up?

Certain areas require a strict, standardised approach. Regulations must be followed, standards must be used, and security must be prioritised even when it takes longer and costs more. These include:

• Identity and access. Secure authentication and clear role and permission management ensure legal certainty and traceability.

• Protection of systems and information. Standardised network architecture, segmentation and technical protection measures reduce the attack surface and strengthen resilience.

• Data protection and information management. Classification, correct storage, encryption and controlled access to sensitive data.

• Vulnerability and monitoring. Logging and monitoring that make it possible to detect deviations and demonstrate compliance during supervision.

• Continuity and robustness. Recovery plans as well as tested backup and redundancy so that essential public services can be maintained during incidents.

• Availability and operational reliability. Compliance with accessibility requirements and stable operation that meets the needs of the organisation and citizens.Secure foundation enables digital innovation

Secure foundation enables digital innovation

With a stable foundation in place, you can begin exploring new solutions in the form of innovative digital services, pilot projects in AI, and other innovative ways to meet the needs of residents. The risk becomes lower when the foundation is secure and any failures become lessons, not catastrophes.

Therefore, management must own the digital risk

Every digital initiative involves trade-offs. Speed versus security, innovation versus stability, cost versus value. It is management that must own these trade-offs. It can no longer be delegated to an IT manager; it must be part of how the organisation is governed. With NIS2 and other regulations, the responsibility for cybersecurity, availability, and risk management has formally moved into the boardroom.

Digital risk should be treated as financial risk, with regular follow-ups, clear ownership, and resources to act. Management teams that integrate this into their regular governance are better prepared when it really matters.