Centre for Cyber Security (CFCS)

CFCS was established in 2012 as a unit of the Danish Defence Intelligence Service (Forsvarets Efterretningstjeneste, FE), absorbing the government CERT function (GovCERT) that had previously sat in the civilian National IT and Telecom Agency (IT- og Telestyrelsen). Its legal basis came with lov om Center for Cybersikkerhed, lov nr. 713 af 25. juni 2014, in force from 1 July 2014 and amended in 2018 and 2019, the latter broadening its monitoring powers. The law made CFCS the national IT security authority, gave it a network security service (Netsikkerhedstjenesten) and allowed it to operate as both GovCERT and MILCERT.

The operational core was the sensor network: authorities and companies connected to Netsikkerhedstjenesten had traffic at their internet boundary analysed by CFCS sensors, combined with FE's foreign intelligence on state-sponsored actors. This intelligence link was the unit's distinctive feature and also its most debated one, since it placed defensive cyber services inside a military intelligence service subject to oversight by the Danish Intelligence Oversight Board rather than an ordinary civilian regulator. Outward-facing work included the recurring threat assessment "Cybertruslen mod Danmark", which rated threat categories such as cyber crime, espionage and destructive attacks on a published threat-level scale, targeted warnings, and practical guidance on topics such as logging, segmentation and supply-chain security. Under the first Danish NIS implementation it also received incident notifications from operators of essential services and acted as a national CSIRT.

In August 2024 responsibility for cyber security matters was moved from the Ministry of Defence to the newly created Ministry for Societal Security and Emergency Preparedness (Ministeriet for Samfundssikkerhed og Beredskab). On 29 January 2025 the civilian-facing parts of CFCS became part of the Danish Resilience Agency (Styrelsen for Samfundssikkerhed, SAMSIK), which now handles advice, communication and coordination of the NIS2 implementation. Netsikkerhedstjenesten stayed with FE, and FE acts as the national CSIRT, so technical incident handling and sensor-based detection remain military-intelligence functions while policy and guidance are civilian.

In practice, older references need translating. Guidance or procurement documents that say "report to CFCS" should now be read against the NIS2-loven (in force 1 July 2025) and SAMSIK's current guidance, where significant incidents are handled with FE as national CSIRT and supervision rests with the relevant sector authority. CFCS material itself remains technically useful, but the institutional name should not be used as the current authority in new policies, contracts or incident response plans. CFCS should also not be confused with Datatilsynet, which handles personal data breach notifications under GDPR Art. 33, or with Rigspolitiet's NC3, which handles cyber crime.