Norway NSM Basic Principles
Norwegian National Security Authority basic principles for ICT security - identify, protect, detect, respond.
Norwegian National Security Authority basic principles for ICT security - identify, protect, detect, respond.
| Short name | NSM NO |
| Region | Europe |
| Country or scope | Norway |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers NSM NO
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for NSM NO.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for NSM NO and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
NO-NSM-12 Map Devices and Software | Organizations must map and maintain an overview of the devices and software in use in their ICT environment; a populated software component inventory is the direct SBOM analogue (NSM Basic Principles, Principle 1.2) | Scan |
NO-NSM-12V Versioned Software Overview | The software overview must be precise enough to support security decisions, meaning each mapped component should carry its version (NSM Basic Principles, Principle 1.2) | Scan |
NO-NSM-21 Security in Procurement and Development | Security must be addressed in procurement and development processes, which requires knowing which suppliers stand behind the software components brought into the environment (NSM Basic Principles, procurement/development principle in the Protect category) | Scan |
NO-NSM-UPD Keep Software Updated | Software must be kept updated and unmanaged version drift avoided; vague or floating version declarations (latest, wildcards, ranges) defeat controlled update management (NSM Basic Principles, software-update principle in the Protect category) | Scan |
NO-NSM-INT Protect Integrity of the ICT Estate | The Protect function requires safeguarding systems against unauthorized change; cryptographic hashes over deployed components provide verifiable integrity evidence (NSM Basic Principles, Protect-category integrity principles) | Scan |
NO-NSM-RESP Incident Response Readiness | Detection and response require quickly determining which assets are affected by an incident, which presupposes unambiguous component identification (NSM Basic Principles, Detect/Respond categories) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
NSM-1.1 | Identify and Categorise Assets (Principle 1.x) |
NSM-1.2 | Risk and Vulnerability Assessment (Principle 1.x) |
NSM-2.1 | Access Control and Least Privilege (Principle 2.x) |
NSM-2.2 | Network Security and Segmentation (Principle 2.x) |
NSM-2.3 | Patch and Vulnerability Management (Principle 2.x) |
NSM-3.1 | Security Monitoring and Logging (Principle 3.x) |
NSM-4.1 | Incident Response and Recovery (Principle 4.x) |
NSM-4.2 | Business Continuity and Resilience (Principle 4.x) |
Policy templates
Written for NSM NO:
- NSM: Personvernerklæring / Privacy Notice
- NSM: Information Security Policy
- NSM: Incident Response and Breach Notification Procedure
And 22 from the standard set, adapted to NSM NO.
North Macedonia Law on Personal Data Protection 2020
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Poland KSC Act
Polish Act on the National Cybersecurity System - operators of essential services, CSIRT obligations.