All enterprises within the private, non-financial urban trades 10-39 Manufacturing 41-43 Construction 45-56 Trade and transport etc. 58-63 Information and communication 68-74, 77-82, 95.1 Other business services

1. Implemented one or more types of IT security measures 1.1 Have strong passwords for authentication 1.2 Have systematic updating of software (incl. operating systems) 1.3 Have biometric methods for user identification and authentication 1.4 Encrypt data, files or e-mails 1.5 Have backup of data at alternative geographical location (incl. cloud) 1.6 Have access control to the enterprises network 1.7 Have VPN (virtual private network) 1.8 Store log files 1.9 Make risk analyses 1.10 Test IT security 2. Have experienced breach of IT security 2.1 Have experienced blocked access to IT services 2.2 Have experienced deletion or destruction of data 2.3 Have experienced disclosure of confidential data (whether intentional or not) 3.1 Increasing level of investments in IT security in the previous calendar year 3.2 Unchanged level of investments in IT security in the previous calendar year 3.3 Declining level of investments in IT security in the previous calendar year 4.1 Own employees handle activities related to IT security for the enterprise 4.2 External suppliers handle activities related to IT security for the enterpeise 5. Have documentation on precautionary measures, activities and procedures regarding IT security 5.1 Have documentation on management of IT access rights 5.2 Have documentation on storage, protection, access to data 5.3 Have documentation on procedures on IT security incident 5.4 Have documentation on the responsibilities of employees in relation to IT security 5.5 Have documentation on IT security training of employees

2023 2022 2021 2020 2019 2018 2017 2016