Metode for identifisering og rangering av kritiske samfunnsfunksjoner

Making priorities about societal critical functions and entities is a political and not a technocratic process. The blind usage of a methodology does not meet the purpose – there must also be clear ideas about the purpose of priority and what other concerns that may have to be considered in different situations. The following are some examples of emergency planning problems that highlight the need for priorities: determining key assets to be protected by military forces in a crisis situation, classifying critical infrastructures to determine levels of security, and determining priority for vaccines during a pandemic. Making priorities possible is also a significant aspect of a national cross sector risk assessment, juxtapositioning sectors, entities, or even persons and positions. The problem of prioritising relative to ICT must not only include the ICT systems themselves, but also users that depend upon them. BAS5 has developed a method for the identification and ranking of all critical functions of society, not only critical ICT systems. Furthermore, the project has described a system for decision support, and not a system for making automatic priorities. This means that relevant decision making environments have to be involved in the use of the method. In the BAS5 project, the criticality of various sectors of society is related to vulnerabilities derived from various events that might befall them, in addition to thoughts about their significance or importance to society. It is therefore hardly possible to prioritise the critical functions of society without, at the same time, making up one’s mind about the risks that they are subjected to or subject others to. That means that risk assessments must be assumed to be performed at sector and entity levels. The developed method describes a system for decision support for situations that make prioritising between various critical societal functions necessary. The method is risk based, and contains two main aspects. Firstly, a permanent and ongoing process between ministries and others with responsibilities within their own sectors is established. Secondly and to support this process, a risk assessment based technique is applied, as assumptions about criticality should be preceded by some analysis and assessment. The process requires that “somebody” is appointed as coordinator at national level and across sectors, that the normal principle of sector responsibility is exploited to structure the work, that cross-sectoral common procedures are implemented, including the establishment of permanent fora meeting frequently, and the establishment of cross-sectoral standards. The choice of risk assessment methodologies should be left to sectors and entities, adapted to their particular circumstances. The reporting of results from risk assessments should however be subjected to a rigidly standardised format. It will also be necessary to develop a simple standard database for the management of cross-sectoral information.