Act on strengthened preparedness in the energy sector

Preparing emergency preparedness plans for level 1 companies(in Danish)

Preparing emergency preparedness plans for level 2–5 companies(in Danish)

Mapping of supply-critical network and information systems(in Danish)

Backup management(in Danish)

Supplier management(in Danish)

Contracts with IT security services(in Danish)

Controls and assessment of competencies in OT (operational technology)(in Danish)

Perimeter protection of solar PV installations(in Danish)

Public access to critical infrastructure(in Danish)

Guidance on evaluating emergency preparedness exercises, version 1.2(in Danish)

Template for evaluating emergency preparedness exercises, version 1.2(in Danish)

Guidance on planning and conducting emergency preparedness exercises(in Danish)

Preparing five-year exercise plans(in Danish)

Template: five-year exercise plan(in Danish)

Guidance on applying for coordinated emergency preparedness(in Danish)

Template for applying for coordinated emergency preparedness(in Danish)

Guidance on applying for an exemption(in Danish)

Template for applying for an exemption(in Danish)

Guidance on risk assessment of projects(in Danish)

If your energy company is subject to the Act on strengthened preparedness in the energy sector and you have not received a letter from us concerning your level classification, please contact the Danish Energy Agency at beredskab@ens.dk.

Read more about the types and sizes of companies covered by the preparedness regulation in Section 2(1)–(2) of the Act. 

The Danish Energy Agency classifies companies subject to the Executive Order on resilience and preparedness in the energy sector into five levels according to the threshold values set out in Annex 1 to the Executive Order, “Tables of threshold values for the classification of companies into levels”. 

The level classification determines which requirements of the Executive Order the company must comply with, as well as the amount of the fee payable.

The level assigned is based on the data available to the Danish Energy Agency. If the level classification does not correspond to the company’s own information regarding the volume of energy it handles, the company is requested to notify the Danish Energy Agency separately by email at beredskab@ens.dk.

The Danish Energy Agency sends a level-classification letter and a welcome letter to the company’s CVR number via Digital Post. These include, among other things, relevant information on becoming subject to the energy sector preparedness regulation and information on how to submit both contact details for the preparedness roles and the information required for level classification and facility classification.

Read more about the respective levels for the different energy supply sectors in Chapter 2 of the Executive Order and in the relevant annexes. 

Read the Executive Order on resilience and preparedness in the energy sector

A facility is a major technical installation, or a group of major technical installations, used to produce, convert, transport, store or consume energy.

A facility may, for example, be a power plant or combined heat and power plant, a transformer substation, sections of electricity lines or pipelines, compressor stations, pumping stations, control rooms, production facilities, electrolysers, energy storage facilities, heat pumps, etc.

Examples of what does not constitute a facility include: 

• Locations containing only network equipment and spare parts.
• Office facilities, unless they contain a control room.
• A charging point.

Examples of facilities in the respective subsectors are set out in Annex 3, Nos. 10–15, to the Executive Order on resilience and preparedness in the energy sector and, in simplified form, include the following:

Facilities in the electricity sector

Generation facilities, facilities with system-supporting capabilities, electricity distribution and transmission substations and connections within the electricity system, including power plants, black-start facilities, transformer substations, cable transition stations, substations, cable installations, overhead line installations, line sections, reverse-flow facilities, interconnectors, wind turbine installations (including offshore wind turbines), solar PV installations, batteries and hydrogen production facilities.

Hydrogen production facilities that consume or exchange electricity, as well as hydrogen storage and hydrogen transmission facilities handling volumes corresponding to the threshold values applicable to facilities in the gas sector.

Facilities in the gas sector

Compressor stations, gas storage facilities, protection facilities, stations (metering and regulating (M/R) stations, reverse-flow facilities, line valve stations and pipeline sections), pipelines (transmission pipelines), upstream pipeline networks, natural gas refineries and processing facilities, gas production facilities, upgrading facilities, LNG facilities, and control rooms that control, regulate or monitor gas supplies.

Facilities in the oil sector

Oil production facilities, oil refineries, oil processing facilities, oil storage facilities, oil terminals and oil transmission facilities, including oil pipelines.

Facilities in the district heating and district cooling sector

Distribution lines from combined heat and power plants, district cooling facilities, peak-load and reserve-load facilities, distribution networks, pumping stations, heat-exchange stations, heat pumps and control rooms.

Read more about the requirements for facilities in the supporting tool Overview of requirements for companies’ facilities based on the classification of facilities into classes (1–5).

Companies must have one preparedness coordinator and one cyber coordinator. Companies with facilities in classes 4 and 5 must have one or more security coordinators.

Companies must notify the Danish Energy Agency of up-to-date contact details for the coordinating roles.

Preparedness coordinator

The preparedness coordinator is responsible for coordinating preparedness planning, including assisting with the preparation of risk and vulnerability assessments and preparedness plans. The appointed coordinator will often have in-depth knowledge of the company, may in some cases be closely involved in operations, and must participate in inspections carried out by the Danish Energy Agency.

Cyber coordinator

The cyber coordinator focuses on cybersecurity in relation to the company’s supply-critical network and information systems. The cyber coordinator must coordinate the measures intended to support the security of network and information systems and oversee preparedness planning for the company’s network and information systems. The cyber coordinator must participate in inspections carried out by the Danish Energy Agency.

Security coordinator

A security coordinator is required only for companies with facilities in classes 4 and 5.

The security coordinator is responsible for coordinating physical security within the company and at its facilities. It is important to note that the Executive Order allows several security coordinators to be appointed, which may be relevant for large companies with many facilities. In such cases, the security coordinators must coordinate between themselves the measures at the company’s class 4 and 5 facilities. It may be appropriate for one or more security coordinators to participate in inspections carried out by the Danish Energy Agency.

Cooperation between the preparedness, cyber and security coordinators

The preparedness coordinator, cyber coordinator and security coordinator must work together to coordinate the various areas so that the company’s preparedness is planned on the basis of an overall risk picture.

The preparedness coordinator, cyber coordinator and security coordinator must meet with the management body four times a year to consider the company’s organisational preparedness, physical security and cybersecurity.  

Please note that it is not necessarily the company’s highest level of management that must participate in the preparedness meetings. In such cases, members of the executive management may participate instead. This has been the practice to date and will be clarified in the next amendment to the Executive Order.

The preparedness coordinator and cyber coordinator are also the persons whom the Danish Energy Agency will contact in connection with supervision and the processing of the company’s preparedness documentation.

In companies classified at levels 4 and 5, the preparedness coordinator and cyber coordinator may not also be members of the company’s management body responsible for approving risk assessments and preparedness plans. The security coordinator may, however, also be a member of management.

Coordinated preparedness is an umbrella term for two ways in which preparedness activities under the Executive Order may be carried out jointly for a larger or smaller group of companies, each of which is subject to the Executive Order.

The first and historically most commonly used form of coordinated preparedness (type 1) is where one company carries out the preparedness activities for two or more companies on behalf of the other company or companies.

The second and less commonly used form of coordinated preparedness (type 2) is where the participating companies jointly carry out preparedness activities across all of the companies involved.

There are a number of practical and legal consequences associated with coordinated preparedness. Further information on these, and on how and where companies can apply for approval of coordinated preparedness, is available in the guidance on applying for coordinated preparedness:

Guidance on applying for approval of coordinated preparedness

Template for an application for approval of coordinated preparedness

A policy describes an organisation’s overall approach to, and practical organisation of, a particular area. The policy helps to ensure a link between the overarching objectives and their practical implementation. A policy describes which measures and processes are to be implemented, which procedures or measures are to be used, and who within the organisation has specific responsibility for ensuring that the policy is implemented in practice.

Management is responsible for ensuring that the responsibilities and powers set out in the policy are delegated to the relevant persons and communicated throughout the organisation.

There are various policies that are important to an organisation, including an information security policy, a cybersecurity policy and a risk management policy. The policies must be relevant to the organisation’s specific activities and working methods so that they reflect the tasks carried out by the company as closely as possible. The policies must also set out objectives for the activities and tasks, so that the company can follow up internally on compliance with its policy in a particular area.

Read more under the questions ‘What is a procedure?’ and ‘What is an inventory?’.

A procedure describes an established method for a particular area of work or for one or more tasks. Unlike a policy, which may set out an overall framework, a procedure describes a specific method that is more closely linked to practical work. A procedure describes how a task is to be carried out, including who is responsible for the task, the agreed process steps, and when the task is considered complete and approved. 

A procedure may be documented either in writing or in digital format. It should be set out in writing or presented in a process diagram so that it can be distributed digitally to the relevant employees.

Read more under the questions ‘What is a policy?’ and ‘What is an inventory?’.

An inventory is a consolidated overview or list of, for example, an organisation’s processes, assets or allocation of responsibilities within a particular area or for a particular system. An inventory provides an organisation with an overall picture of a particular area, making it clear whether changes need to be made to existing processes and assets or, for example, whether new ones need to be added.

For inventories of, for example, network and information systems, the inventory must include, among other things, information on the function, criticality and allocation of responsibility for the system concerned.

Inventories must be kept up to date so that they remain accurate at all times. 

Read more under the questions ‘What is a procedure?’ and ‘What is a policy?’.

The Danish Energy Agency supervises companies’ preparedness activities to ensure that individual companies comply with the Executive Order and are prepared to deal with a crisis situation. Supervision consists of two elements. 

First, the Danish Energy Agency continuously processes and assesses companies’ preparedness plans, risk and vulnerability assessments, reports, etc. to ensure that they comply with the applicable legislation. 

Second, the Danish Energy Agency carries out on-site visits to companies, during which it interviews employees and management, carries out spot checks, discusses preparedness matters and inspects facilities, etc. 

Companies must pay for supervision and regulatory processing carried out by the Danish Energy Agency pursuant to the Act on strengthened preparedness.

Companies in levels 2–5 pay on the basis of the level classification assigned by the Danish Energy Agency, the number of class 4 facilities and whether the company is a transmission system operator in the electricity or gas system. The applicable rates are set out in the Executive Order on payment for regulatory processing by the Danish Energy Agency. 

In addition to payment for ordinary regulatory processing and supervision under the Act on strengthened preparedness in the energy sector and rules issued pursuant to it, companies must pay for any ad hoc supervision carried out pursuant to Section 19(2), no. 3 of the Act.

Finally, companies must pay fees for submitting applications and requests for exemption under the Act or the Executive Order on resilience and preparedness in the energy sector. The relevant application types and fees are:

• Application for approval of coordinated preparedness: DKK 790
• Application for exemption from the rules: DKK 2,923
• Application concerning overlapping roles: DKK 790
• Application for prior confirmation of the class classification of planned facilities: DKK 2,923
• Application for the company itself to perform the function of IT security service provider: DKK 790

Read the Executive Order on payment for regulatory processing by the Danish Energy Agency

Read the Act on strengthened preparedness in the energy sector 

Read the Executive Order on resilience and preparedness in the energy sector. 

Fees are charged retrospectively on 1 January and 1 July each year.

The fee invoice will be sent to the company’s Digital Post mailbox. The invoice will generally state “Collection of fees under the Act on strengthened preparedness in the energy sector”. The company may provide purchase order numbers and the name of a contact person to be indicated in the “ATT” field on the invoice, so that the invoice can be forwarded promptly to the appropriate person within the organisation. This information should be sent to beredskab@ens.dk. 

The invoice must be paid within 30 days of the date of issue. If the invoice is not paid on time, interest may be charged pursuant to the Danish Interest Act. If the invoice remains unpaid after a payment reminder has been issued, it will be referred for debt collection. 

Companies are charged on an ongoing basis for the Danish Energy Agency’s preparedness supervision. The amount covers the ongoing preparedness supervision provided to companies, such as approval of risk and vulnerability assessments and preparedness plans, as well as on-site supervision, provided that there are no changes to the fee rates or other rules governing payment for preparedness supervision in the intervening period.

Companies participating in coordinated preparedness where preparedness is handled on their behalf by another company subject to the Act (type 1 coordinated preparedness) are not required to pay a fee. Instead, the company responsible for the preparedness activities will be charged the fee. 

Where companies participate in coordinated preparedness in which they jointly carry out the preparedness activities (type 2 coordinated preparedness), both companies will, in principle, be liable for payment of the fees. For practical reasons, only one of the companies will be charged the amount; this will be clarified as part of the approval of the application for coordinated preparedness. 

Read more under the question ‘What is coordinated preparedness?’.

The Executive Order on resilience and preparedness in the energy sector imposes requirements on companies’ “management body” (Section 10).

The management body is defined as “the central governing body, as defined in the Danish Companies Act, or the management, as defined in the Act on Certain Commercial Undertakings (LEV Act), depending on the company’s legal form”.

The persons constituting the “management body” must be determined in accordance with the definitions of the “central governing body” in Section 5, no. 4, of the Danish Companies Act and “management” in Section 4a, no. 2, of the LEV Act, respectively. 

Under the Danish Companies Act, the central governing body is:

• the board of directors in companies that have both an executive board and a board of directors;
• the executive board in companies that have only an executive board;
• the executive board in companies that have both an executive board and a supervisory board.

Under the LEV Act, “management” means the members of a board of directors, an executive board or an equivalent governing body.

The relevant definition of the management body depends on the company’s legal form. The Danish Companies Act applies only to public and private limited companies, while the LEV Act applies to commercial undertakings that are not subject to the Danish Companies Act, such as sole proprietorships, partnerships, limited partnerships, cooperative societies, and foundations or associations carrying on commercial activities.

It is for each individual company to determine whether its corporate structure falls within the scope of the Danish Companies Act or the LEV Act.

In partnerships established pursuant to Section 60 of the Danish Local Government Act, the board of directors will generally constitute the highest governing body where it is designated in the articles of association as the governing body or highest governing body, even where an executive board has also been established. In such cases, the board of directors acts as the highest governing body, determining the company’s strategic direction and exercising overall supervision of its operations. The executive board, by contrast, is responsible for day-to-day management within the framework and instructions laid down by the board of directors. The executive board therefore cannot be regarded as the highest governing body, irrespective of how extensive its powers may be in relation to day-to-day operations.

In summary, in municipally governed partnerships with both a board of directors and an executive board, the board of directors must be regarded as the highest governing body where it is designated as such in the articles of association. The executive board constitutes a subordinate level of management responsible for day-to-day operations, but does not have independent authority as the highest governing body, unless the articles of association explicitly state that the executive board is to be regarded as the highest governing body, with responsibility for, among other things, the partnership’s strategic management.
Preparedness documentation must therefore be approved by the board of directors, except where a company does not have a board of directors or where it can provide explicit documentation demonstrating that its executive board constitutes its highest level of management.

It should be noted that the wording of the Executive Order is expected to be revised in future to clarify what constitutes a company’s highest governing body. 

Read the Executive Order on resilience and preparedness in the energy sector

The management body, for example, the board of directors in the case of limited companies, must determine what constitutes an appropriate level of security for the company. This means, among other things, that the board of directors must decide, at an overall and strategic level, which measures the organisation should have in place and when the level of protection is sufficient. 

In this context, the board of directors must also, among other things, approve risk and vulnerability assessments and preparedness plans pursuant to Section 10 at an overall and strategic level. This responsibility should be regarded as part of the board’s risk management responsibilities under Section 115 of the Danish Companies Act, as described above. The board should be presented with the content of the relevant material in a way that enables it to gain a sound overall understanding of that content, and the board should have a corresponding level of knowledge in this area. 

The board of directors is therefore not expected to be presented with or approve the material in detail. Approval of the material at a detailed level may be delegated by the board to the executive board and the company’s day-to-day management.

Pursuant to Section 10, the management body must approve:

• Risk and vulnerability assessments pursuant to Section 18.
• Risk assessments in connection with projects that must be submitted to the Danish Energy Agency pursuant to Section 28(1).
• Preparedness plans pursuant to Section 19.

Pursuant to Section 11(5), the management body must:

• Meet at least four times a year with the coordinating preparedness roles, the preparedness coordinator, cyber coordinator and security coordinators, to consider the company’s organisational preparedness, physical security and cybersecurity. Minutes of the meetings must be retained.
• Determine what constitutes an appropriate level of security for the company’s network and information systems and physical security, taking into account the company’s exposure to risk and the societal importance of the services it provides. This means, among other things, that management must decide, at an overall and strategic level, which measures the company should have in place and when the level of protection is sufficient.

Please note that it is not necessarily the company’s highest level of management that must participate in the preparedness meetings. In such cases, members of the executive management may participate instead. This has been the practice to date and will be clarified in the next amendment to the Executive Order.

The company’s management body must follow up to ensure that decisions taken by management on the basis of the risk and vulnerability assessments are implemented, including mitigation measures relating to cybersecurity and the resilience of facilities set out in the preparedness plans.

Management must therefore follow up on and monitor whether the security measures it has initiated are implemented and have the intended effect. Follow-up may take various forms, for example through periodic management reports providing the management body with a status update on strategic objectives, action plans, and selected key performance indicators and control metrics relating to the company’s work on, for example, network and information security.

The management body may also follow up on decisions by establishing processes for internal or external audits of compliance with the resilience and preparedness requirements. In both cases, the results must be reported to management.

Members of a company’s management body must participate in relevant courses or training on organisational preparedness, physical security and cybersecurity.

There are no specific requirements as to the form or content of the courses, but the training requirement must be considered in light of the role and responsibilities of the management body in relation to risk assessment and preparedness within the company under Section 10 of the Executive Order (see above).

The courses must enable management to assess risks and to make decisions on, and follow up on, cybersecurity measures and physical security measures. There is no requirement for all members, or a specified number of members, of the management body to complete a given number of courses, but the management body as a whole must have the necessary competencies to manage the company’s organisational preparedness, cybersecurity and physical security.

Relevant courses may include, for example: 

• Courses on cyber and information security, either general or specifically aimed at management
• Workshops on managing cyber and information security risks
• Courses and certifications in recognised European and international security standards
• Internally organised courses and seminars on cyber and information security and/or physical security aimed at management

Training activities must be documented, for example by means of a course certificate or confirmation of participation in a course.

Some companies and organisations have established a cyber and information security committee, audit committee or similar body as part of their organisational structure, with representatives from the management body. These committees typically perform tasks relating to the governance and oversight of the company’s cybersecurity.

The management body may delegate its responsibilities to this type of committee, but the management body as a whole will remain collectively responsible for ensuring that the company complies with its obligations under the Executive Order on resilience and preparedness in the energy sector, including the requirements applicable to the management body itself. The management body should therefore monitor and ensure that the committee carries out its responsibilities.