Vulnerable and central – are Norwegian municipalities equipped for a digitally troubled time?

The municipality – more than one sector

A Norwegian municipality is not a single enterprise, but rather many. It is a health trust, child welfare service, school owner, water utility, and social services office all in one. The municipality's IT systems handle everything from medical records and child welfare cases to pump control in waterworks and diploma printouts. This also means that the information values the municipality manages are among the most sensitive in society, and the consequences of errors, leaks or attacks can be very serious.

The Crucial Trinity

To secure these values, municipalities need three things: Personnel, Money and Papers – i.e. competent people, financial resources and good information management. But many municipalities lack one or more of these.

• Personnel: There is a major shortage of ICT security expertise in municipalities in Norway. In many places, the responsibility for safety is assigned to one person with many roles, often without specialised training.
• Money: Information security and privacy are often given low priority in budgets, especially in financially squeezed municipalities. It is difficult to defend investments in what "has not happened yet".
• Papers (information): Without an overview of what data exists, where it is stored, who has access and how it is processed, it is impossible to comply with the requirements of the GDPR and the Security Act. Many municipalities lack up-to-date risk assessments and systematic internal controls.

Critical infrastructure – and critically underfunded

At the same time, more and more services are being digitalised – including drinking water supply and sewage systems. These are now increasingly controlled via networked technology, often without adequate segmentation or security. This makes them vulnerable to cyber attacks, which in the worst case can have consequences for public health.

A sharpened threat picture in 2025

In May 2025, the international threat landscape is characterised by geopolitical conflicts, hybrid attacks and state-sponsored digital espionage. Norwegian municipalities can be indirect targets in such conflicts, either as the weakest link in national infrastructure or as tools for destabilisation through breaches of trust.

National security authorities have warned of an increased risk of digital attacks against the municipal sector, especially due to a lack of preparedness and low resilience. At the same time, expectations are high. Municipalities must comply with the law, ensure privacy and protect citizens' data – regardless of size or budget.

The way forward – the need for interaction and strengthening

To solve these challenges, the local government sector must think holistically and long-term. The solutions are not just about technology, but about management and prioritization.

• Political and administrative support: Information security must become part of overall management – not just an IT project.
• Long-term financing: Investments must be made in security in the same way as other critical infrastructure.
• Ownership of information: The municipalities must have control over their own data and set stricter requirements for suppliers and data processors.

Norwegian municipalities are the glue in the welfare state – but in 2025 they will also be vulnerable nodes in a global digital reality. If the municipalities are to succeed in safeguarding privacy and protecting citizens' vital services, they must receive – and use – the right resources. This is not luxury. It is a necessity for municipal and national preparedness.

At Diri, we meet many municipalities with challenges related to information security and privacy. That's why we're attending the KiNS Conference 2025 – to be part of the conversation, not just as a technology provider, but as a partner in the long-term work to protect people's data, trust and rights.

We hope to meet you there!

‍