Skip to content

National Annex — Denmark

Status as of September 2026: In force. Community-maintained orientation, the reference annex for the framework. This is not legal advice; verify against retsinformation.dk and samsik.dk before relying on it. Corrections welcome, see contributing.

Review Status
Confidence Maintainer reviewed
Checked line by line against the legal text No
Reviewed by a lawyer No
Last reviewed September 2026
Reviewed by Frederik B. Krogsgaard, maintainer
Second reviewer Wanted, see CONTRIBUTING
Next review due March 2027

The Danish implementation landscape

Denmark implemented NIS2 and CER through a family of laws in force since 2025, rather than a single act:

Law Covers In force Selector tag
NIS 2-loven: Lov nr. 434 af 6. maj 2025, Lov om foranstaltninger til sikring af et højt cybersikkerhedsniveau Horizontal NIS2 implementation for most sectors 1 July 2025 dk-nis2
Lov om styrket beredskab i energisektoren: Lov nr. 258 af 6. marts 2025, detailed in bekendtgørelse om modstandsdygtighed og beredskab i energisektoren, BEK nr. 260/2025 Energy sector. Combines the cyber side of NIS2 and the physical side of CER into one regime, supervised by Energistyrelsen. Requirements scale with five preparedness levels and go beyond the EU minimum at the top levels 7 March 2025 dk-energi
Lov om sikkerhed og beredskab i telesektoren, L142 Telecom sector NIS2 implementation 1 July 2025 dk-tele
CER-loven, lov om kritiske enheders modstandsdygtighed Physical resilience of critical entities across ~11 sectors 1 July 2025 dk-cer
Lov om finansiel virksomhed § 333 et seq. Financial sector, aligned with DORA — dk-fin

Note on naming: "Lov om styrket beredskab" in Danish practice usually refers to the energy-sector act above; the NIS 2-loven and CER-loven are separate acts. If your organisation spans sectors, several regimes can apply simultaneously. The NIS 2-loven explicitly yields to the energy, tele and financial acts for entities they cover, per § 1, stk. 2.

Key Danish specifics for your CDC

  1. Registration duty: entities covered by the NIS 2-loven must register on virk.dk. The initial deadline was 1 October 2025, and new entities register when they come into scope.
  2. Incident reporting channel: entities under the NIS 2-loven and the tele act report significant incidents via virk.dk; the national CSIRT function is performed by Styrelsen for Samfundssikkerhed (SAMSIK). Energy-sector entities report to Energistyrelsen under BEK 260 §§ 77–79, and incidents that compromised network and information security also go to the CSIRT, through the reporting channel it designates; electricity, gas and hydrogen entities also alert Energinet. Timelines follow the NIS2 pattern in both channels: early warning ≤ 24 h, notification or status ≤ 72 h, final report ≤ 1 month.
  3. Authorities to know:
    • Styrelsen for Samfundssikkerhed (SAMSIK) — overall coordination, cross-sector guidance, technical advisories and incident reception as the national CSIRT, at samsik.dk/nis2
    • Sector-responsible authorities supervise their own sectors: Digitaliseringsstyrelsen for digital sectors, Energistyrelsen for energy, Finanstilsynet for finance, Trafikstyrelsen for transport
  4. Guidance materials: SAMSIK publishes cross-cutting NIS2 vejledninger structuring measures as skal meaning must, bør meaning should with deviations justified, and kan meaning may. That is a useful evidence structure for your maturity assessments; map OCDF capability evidence to the skal and bør items.

  5. Energy-sector extras under Lov om styrket beredskab i energisektoren and BEK 260. Energistyrelsen places each entity on one of five preparedness levels, from thresholds in the order's annex 1, and the requirements scale with the level. Checked against BEK 260:

    • every entity segments its supply-critical systems behind a DMZ or equivalent; levels 4 and 5 separate those networks physically, § 62;
    • levels 4 and 5 log and monitor to identify incidents in real time, respond in real time, keep logs for 13 months and hand them to their IT security service within 24 h, §§ 66–69;
    • preparedness exercises yearly at levels 3 to 5 and every second year at level 2, with a yearly recovery exercise of supply-critical systems at levels 4 and 5, and the management body takes part where relevant, § 21;
    • at levels 4 and 5 the preparedness and cyber coordinators must not be the management body that approves the risk assessments and preparedness plans;
    • supervision yearly at levels 4 and 5, every third year at level 3 and every sixth at level 2, § 108.

    Key personnel may also need security clearance under the separate bekendtgørelse om sikkerhedsgodkendelser i energisektoren. Confirm your level with Energistyrelsen, then set DETECT and GOVERN targets to match: Level 3–4 at levels 4 and 5, the ordinary targets below them.

    These requirements apply to the whole entity, OT included, while OCDF is scoped to IT. The IT/OT interface shows which of them a CDC can cover at the boundary and which must be covered by OT operations.

CDC checklist for Denmark

  • GOVERN: applicability determined per legal entity and sector, NIS 2-loven versus the sector acts, and recorded in the regulatory applicability register
  • Registered on virk.dk where required
  • Reporting procedure drilled against the right channel, virk.dk or Energistyrelsen, with the 24 h early-warning clock
  • Energy sector: preparedness level confirmed with Energistyrelsen and the level's requirements mapped to your targets
  • Energy sector: split between CDC and OT coverage recorded, per the IT/OT interface
  • Sector authority contact list maintained; relationship established with SAMSIK before an incident
  • Datatilsynet contact and GDPR Art. 33 flow prepared. This runs in parallel with NIS2 reporting
  • SAMSIK vejledninger mapped to your control evidence across skal, bør and kan

Sources

Open CDC Framework, licensed CC BY 4.0. Contributions correcting or extending this annex are welcome.