Document 3:12 (2024−2025) / Published Securing of port facilities to ensure public security
Norwegian authorities lack an overview of which port facilities are important for public security. This is objectionable.
-
(PDF, 2.65 MB)
The document is in Norwegian
Brief summary
- Ninety per cent of all goods entering orleaving the country have passed through a port.
- Norway has over 600 port facilities that handle ships in international traffic. The port facilities are also important to the fishing industry and domestic traffic.
- Due to their size and importance some of the port facilities are vital to society as a whole and to Norway’s national security.
- The increased security policy tension also makes the ports more vulnerable to undesirable actions.
- Public security can be endangered by threats to inadequately secured port facilities of importance to society
- The National Audit Office of Norway has investigated what the authorities are doing to secure ports of critical importance to society.
- The audit was initiated because the threat situation has changed, and Norway must be prepared for rapid changes.
Overall assessment
Objectionable – illustration
The Ministry of Trade, Industry and Fisheries has begun work on obtaining an overview of ports that may be of importance to national security. It is nevertheless objectionable that the Ministry
- lacks an overview of which port facilities are important for public security and has no plans for alternative supply lines if such port facilities are put out of action
- has not ensured that port facilities of importance to public securityare adequately secured to protect the public security
The investigation shows:
- The Ministry of Trade, Industry and Fisheries has not investigated the port facilities’ critical importance to society.
- The Ministry of Trade, Industry and Fisheries has been slow to begin the value assessment of ports in accordance with the Security Act, despite being aware of vulnerabilities.
- The Ministry of Trade, Industry and Fisheries does not utilise the opportunity to see the maritime security regulations and the Security Act in conjunction with each other.
The authorities must keep an overview of the important supply lines in order to secure them. The maritime security regulations are intended to ensure that port facilities and shipping traffic are secured against acts that may threaten them, but they are not enough to ensure that society’s need for goods is met. The authorities must therefore put other measures in place.
The major changes in the security policy situation mean that the Ministry of Trade, Industry and Fisheries’ overall responsibility for securing the maritime sector has become even more important. Given the current threat situation, it is objectionable that the Ministry of Trade, Industry and Fisheries has been slow to begin the value assessment of ports that may be of importance to national security, despite being aware of vulnerabilities.
It is also objectionable that the Ministry has not mapped the port facilities’ importance for security of supply or planned alternative supply lines. When the authorities do not have an overview of which port facilities are of strategic importance to public security, it is not possible for them to ensure that these port facilities are adequately secured. This can jeopardise public security.
The investigation shows:
- The Norwegian Coastal Administration's raising of the security level contributes to public security.
- The Norwegian Coastal Administration points out weaknesses in the port facility security assessment, but does not ensure that the strategic importance of the port facilities is adequately assessed.
- The Norwegian Coastal Administration does not ensure that the port facilities make new assessments when the threat situation changes.
In the opinion of the National Audit Office of Norway, the Norwegian Coastal Administration's practice does not ensure that the consequences of a port facility’s strategic importance are consistently assessed in the security assessment. If the assessment takes into account the strategic importance of the port facility, it is more likely that the security measures will reduce the risk of attacks against the port facility and thus also attacks that can threaten public security.
The Norwegian Coastal Administration’s practice is not adequate to ensure that the port facilities assess the consequences that changes in the threat situation or the geopolitical situation may have for their vulnerability. In the opinion of the National Audit Office of Norway, there is a risk that the port facilities do not have security measures in place that take into account the fact that the port facilities may become more strategically important when the threat situation changes.
The investigation shows:
- The Ministry of Trade, Industry and Fisheries has spent a long time establishing a sectoral CERT in the maritime sector.
- The Norwegian Coastal Administration approves port facility security assessments that contain inadequate analyses of cyber security.
In the opinion of the National Audit Office of Norway, the establishment of the CERT in the maritime sector has taken too long, as this is an important area for public security. The consequence of not having established this earlier is that the maritime sector—including the port facilities—has lacked a body that could serve as a link between the Norwegian National Security Authority’s NorCERT and the industry. As a result, each port facility has had to assess which of the cyber threats should be prioritised in its own operations.
In the opinion of the National Audit Office of Norway, the Norwegian Coastal Administration plays too passive a role in ensuring that port facilities are adequately protected against IT/OT attacks. A cyberattack can have major consequences for port facilities of strategic importance to public security. Port facilities of vital importance to society are among those most dependent on electronic systems. By helping to ensure that port facility security assessments and plans take more account of this reliance on electronic systems, the Norwegian Coastal Administration also contributes to public security.
As of May 2025, the Ministry has still not decided whether the maritime security regulations will also apply to ships in domestic traffic and the ports that serve them. The consequence is that there is currently no requirement to secure these port facilities. The analysis revealed a significant risk for Norwegian port facilities and large passenger ships in Norwegian domestic traffic. In the opinion of the National Audit Office of Norway, this decision has taken too long.
Recommendations
The investigation shows that the authorities lack a comprehensive overview of which port facilities are important for public security and that they have no plans for alternative supply lines if such port facilities are put out of action. On this basis, the National Audit Office of Norway recommends that the Ministry of Trade, Industry and Fisheries
- obtain an overview of which port facilities are important for public security
- ensure that plans are in place for alternative supply lines should these port facilities be put out of action
- continue the value assessment of ports in accordance with the Security Act
The investigation also shows that the authorities have not ensured that port facilities of importance to public security are sufficiently secured to protect the public security. On this basis, the National Audit Office of Norway recommends that the Ministry of Trade, Industry and Fisheries
- ensure that cyber security is taken into account in the port facilities’ security work
- ensure that changes in the threat situation are taken into account in the port facilities’ security work
- assess whether port facility security assessment and security measures under the maritime security regulations and the Security Act can be viewed in conjunction with each other in cases where a port facility is also subject to the Security Act.