Where is the CS4CA Nordic Summit held?

The summit is held in Copenhagen, DNK.

What is the primary focus of the CS4CA Nordic Summit?

The summit focuses on cybersecurity for critical assets, addressing threats and protection strategies for essential services and systems.

When does the CS4CA Nordic Summit take place?

The summit spans two days in the first quarter of the year.

CS4CA Nordic: Cyber Security for Critical Assets Summit 2027

Name: CS4CA Nordic: Cyber Security for Critical Assets Summit 2027
Start: 2027-03-02T00:00:00Z
End: 2027-03-03T00:00:00Z
Location: Copenhagen

Mar 2–3, 2027Copenhagen, DenmarkIn-person

Registration open

The CS4CA Nordic: Cyber Security for Critical Assets Summit is an annual gathering focused on the protection of critical infrastructure from cyber threats. Held in Copenhagen, DNK, this event brings together experts and stakeholders to address the evolving threats to essential services and systems. It serves as a vital platform for sharing insights, discussing strategies, and fostering collaboration among professionals dedicated to enhancing cybersecurity resilience in the Nordic region and beyond.

Committees & topics

Topics
Cyber Regulation and the Future of Critical Infrastructure · Managing Third Party Risk · Securing Legacy OT Amidst Rapid Digitalisation · Integrating OT Architecture to the Cloud · Building a Team Capable of Managing IT and OT Security

Why it matters

The increasing sophistication of cyber attacks poses significant risks to critical infrastructure, which underpins national security, economic stability, and public welfare. Events like CS4CA Nordic are crucial for staying abreast of the latest threats and developing robust defense mechanisms. The summit's focus on critical assets highlights the interconnectedness of modern societies and the potential for cascading failures if these systems are compromised. This makes the discussions and collaborations forged at this event directly relevant to maintaining societal function and stability.

The discussions at the summit are particularly pertinent given the global landscape of cyber warfare and espionage. Nations worldwide are grappling with how to secure their vital systems against state-sponsored actors and sophisticated criminal organizations. The insights shared at this event contribute to a collective understanding of best practices in Critical Infrastructure Protection and Adaptive Cyber Defense, which are essential for mitigating risks and ensuring operational continuity. The exchange of knowledge among participants helps to strengthen the overall cybersecurity posture of the region, fostering a more secure digital environment for all.

How to prepare

Delegates preparing for the CS4CA Nordic summit should focus on understanding the multifaceted nature of cybersecurity threats to critical infrastructure. A key area of preparation involves familiarizing oneself with stakeholder mapping techniques, as effective cybersecurity strategies often require collaboration across diverse public and private entities. Understanding the roles and interests of various actors, including government agencies, private sector operators, and international partners, is crucial for developing comprehensive protection plans.

Furthermore, participants should consider the implications of emerging technologies on critical infrastructure security. This includes preparing to discuss topics such as the security of industrial control systems, the impact of artificial intelligence on threat detection, and the challenges of securing supply chains. Engaging with concepts like dynamic analysis in a cybersecurity context can also provide a valuable framework for understanding how vulnerabilities are identified and mitigated. Given the international nature of cybersecurity threats and solutions, delegates should also prepare to discuss the perspectives of various nations. For instance, understanding the cybersecurity priorities of the host nation DNK will be beneficial.

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Denmark

A key advocate for robust cybersecurity measures, particularly in protecting critical national infrastructure.

Role in topic

As the host nation for the summit in Copenhagen, DNK plays a central role in facilitating discussions and collaborations on cybersecurity for critical assets. The nation has a vested interest in sharing its experiences and learning from international best practices to enhance its own resilience against cyber threats, especially those targeting its <glossary_link:critical-information-infrastructure>Critical Information Infrastructure</glossary_link>.

Topics & background

The background behind each topic and the actors that shape it.

Cyber Regulation and the Future of Critical Infrastructure

Over the past decade, governments have moved from voluntary cybersecurity guidance toward binding regulation of operators of essential services. In the European Union, the original 2016 NIS Directive was substantially expanded by NIS2 (Directive 2022/2555), which entered into force in January 2023 and broadened sectoral scope, tightened incident reporting deadlines, and introduced personal liability for senior management. The Critical Entities Resilience (CER) Directive and the Cyber Resilience Act complement this by addressing physical resilience and product security across the supply chain. In parallel, the United States has issued binding directives through CISA, the SEC's cyber disclosure rule, and sector-specific TSA pipeline and rail security directives following the 2021 Colonial Pipeline incident. For the Nordic region, transposition of NIS2 has been uneven, with several member states missing the October 2024 deadline and the European Commission opening infringement proceedings in 2024-2025. Operators face a layered compliance picture: NIS2, DORA for financial entities, the Radio Equipment Directive, and national rules from authorities such as Norway's NSM, Sweden's MSB, Finland's Traficom, and Denmark's CFCS. Geopolitical pressure from sabotage incidents in the Baltic Sea — undersea cable and pipeline disruptions attributed to or suspected of state-linked actors — has accelerated the merger of cyber and physical resilience agendas. The forward debate centers on how prescriptive regulation should be without stifling operational flexibility, how to harmonize overlapping regimes, and how to extend obligations across complex OT supply chains. Questions of cross-border incident coordination, mandatory disclosure thresholds, and the role of certification schemes (EUCC, EUCS) remain contested as critical infrastructure becomes a recognized domain of hybrid conflict.

Key players

Managing Third Party Risk

Third-party and supply chain compromises have become one of the most consequential vectors in critical infrastructure cyberattacks. Incidents such as SolarWinds (2020), Kaseya (2021), MOVEit (2023), and the 2024 disruption to global IT systems caused by a faulty CrowdStrike sensor update demonstrated how a single vendor failure — malicious or accidental — can cascade across thousands of dependent operators. For OT environments, the risk profile is amplified by long-lived dependencies on a small set of automation vendors, integrators, and remote-access service providers. Regulators have responded by codifying third-party risk obligations. The EU's Digital Operational Resilience Act (DORA), applicable from January 2025, imposes prescriptive ICT third-party risk requirements on the financial sector and introduces an oversight regime for critical ICT third-party providers. NIS2 extends supply chain risk management duties to a broad set of essential and important entities, while the Cyber Resilience Act will require security-by-design across products with digital elements placed on the EU market. In the United States, Executive Order 14028 and the evolving CMMC framework similarly push SBOM adoption and vendor assurance. The operational challenge remains translating these mandates into practice: gaining visibility into nth-party dependencies, contractually enforcing security baselines, monitoring vendor remote access into OT zones, and exercising exit and substitution plans for concentrated providers. The Nordic discussion is particularly focused on shared-vendor concentration risk in energy, maritime, and telecoms, and on how smaller operators can pool assurance activities to manage the cost of compliance.

Key players

Securing Legacy OT Amidst Rapid Digitalisation

Operational Technology environments — SCADA systems, PLCs, DCS, and field devices — were largely designed in an era predating modern cybersecurity, prioritizing availability, safety, and deterministic performance over confidentiality or authentication. Many systems running today's electricity grids, water utilities, oil and gas facilities, and manufacturing plants were commissioned in the 1990s or earlier and were never intended to be exposed to IP networks. The convergence with IT, driven by demand for remote operations, predictive maintenance, and ESG reporting, has steadily eroded the air gaps that once provided implicit protection. High-profile incidents illustrate the stakes: Stuxnet (2010) demonstrated targeted PLC manipulation; the 2015 and 2016 attacks on Ukraine's grid showed coordinated OT disruption; Industroyer2, Pipedream/Incontroller (2022), and the FrostyGoop malware targeting Modbus in 2024 confirmed an expanding toolkit aimed specifically at industrial protocols. Regulatory frameworks such as IEC 62443, NIST SP 800-82, and sector-specific guidance from ENISA and national CERTs now define expected baselines, but retrofitting legacy estates remains capital-intensive and constrained by plant uptime requirements. The core dilemma is how to apply modern controls — segmentation, monitoring, secure remote access, patch and vulnerability management — to assets that cannot be easily updated or taken offline. Compensating controls, unidirectional gateways, OT-aware intrusion detection, and risk-based asset lifecycle planning are the focus of current practice, alongside debates over vendor responsibility for legacy device support and the long horizons of brownfield modernization programs.

Key players

Integrating OT Architecture to the Cloud

For decades the Purdue Reference Model treated Level 0-3 OT environments as strictly separated from enterprise IT, with no direct connectivity to external networks. The economics and analytics value of cloud platforms — combined with vendor strategies from Siemens, Rockwell, ABB, Schneider, Honeywell, AWS, Microsoft, and Google — have pushed industrial operators toward hybrid architectures where historian data, asset telemetry, and even some control functions traverse cloud services. ISA-95 and IEC 62443 have been updated and supplemented by guidance such as NIST's OT cybersecurity framework and ENISA's cloud security recommendations to address this shift. The drivers include AI-enabled predictive maintenance, digital twins, fleet-wide optimization, and regulatory reporting requirements that are easier to satisfy with centralized data. The risks are equally clear: expanded attack surface, dependency on hyperscaler availability, data sovereignty exposure, and the introduction of cloud identity and API risks into environments previously governed only by physical and network controls. Incidents involving misconfigured cloud-exposed OT historians and dashboards have already been documented by researchers and national CERTs. For Nordic operators, the debate intersects with EU data sovereignty initiatives (GAIA-X, EUCS), DORA's cloud concentration provisions, and national policies on where safety-critical data may reside. Architectural questions — read-only data diodes versus bidirectional integration, edge versus cloud analytics, zero-trust models adapted for OT, and the role of sovereign or sector-specific clouds — are now central design decisions for any digital transformation program in critical infrastructure.

Key players

Building a Team Capable of Managing IT and OT Security

The cybersecurity workforce gap is well documented — ISC2 and ENISA studies have repeatedly estimated shortages in the millions globally — but the gap is particularly acute at the IT/OT intersection. Effective defense of critical infrastructure requires personnel who understand both enterprise security disciplines (identity, SOC operations, incident response, GRC) and the engineering realities of process safety, control loops, industrial protocols, and plant operations. Historically these communities have reported through separate organizational lines, used different vocabularies, and held different risk priorities, with IT optimizing for confidentiality and OT for availability and safety. Regulatory pressure is now forcing organizational change. NIS2 introduces management accountability for cybersecurity and demands governance over OT-relevant essential services; sector regulators in energy, water, and transport increasingly expect a named accountable executive for OT cyber. At the same time, the threat landscape — ransomware groups targeting manufacturing, state-linked actors probing ICS, and insider risk in highly automated facilities — requires 24/7 monitoring capabilities that few asset owners can staff alone, driving growth in OT-specialized MSSPs and shared SOC arrangements. The Nordic discussion focuses on talent pipelines from technical universities, cross-training programs between control engineers and SOC analysts, retention in a competitive labor market, and governance models — federated, centralized, or matrixed — that allow a single accountable security function to span IT and OT without losing engineering credibility. Cultural integration, joint exercises, and shared metrics are emerging as the practical levers for building durable converged teams.

Key players

Resources

News, lessons, and country profiles to prep for CS4CA Nordic: Cyber Security for Critical Assets Summit 2027.

Recent reporting to ground your prep

Ken Martin's DNC Autopsy Reveals Party Strugg

DNC Autopsy Reveals Democrats' 2024 Failures

Trump's Legal Battles Impact 2026 Elections

GOP Conservative Factions Clash Over Trump

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

Conflict Resolution

The states in play, with the data that shapes their stance

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

By committee

Frequently asked questions

CS4CA Nordic: Cyber Security for Critical Assets Summit 2027

Mar 2–3, 2027Copenhagen, DenmarkIn-person

Registration open

Committees & topics

Topics
Cyber Regulation and the Future of Critical Infrastructure · Managing Third Party Risk · Securing Legacy OT Amidst Rapid Digitalisation · Integrating OT Architecture to the Cloud · Building a Team Capable of Managing IT and OT Security

Why it matters

How to prepare

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Denmark

A key advocate for robust cybersecurity measures, particularly in protecting critical national infrastructure.

Role in topic

Topics & background

The background behind each topic and the actors that shape it.

Cyber Regulation and the Future of Critical Infrastructure

Key players

Managing Third Party Risk

Key players

Securing Legacy OT Amidst Rapid Digitalisation

Key players

Integrating OT Architecture to the Cloud

Key players

Building a Team Capable of Managing IT and OT Security

Key players

Resources

News, lessons, and country profiles to prep for CS4CA Nordic: Cyber Security for Critical Assets Summit 2027.

Recent reporting to ground your prep

Ken Martin's DNC Autopsy Reveals Party Strugg

DNC Autopsy Reveals Democrats' 2024 Failures

Trump's Legal Battles Impact 2026 Elections

GOP Conservative Factions Clash Over Trump

Lessons

Bite-sized lessons to build the basics

Hidden Stakeholders

Engagement Strategies

Dynamic Analysis

Stakeholder Mapping Workshop

Courses

Guided courses that go deeper on the topic

Advanced Negotiation

Multilateral Negotiation

Policy Brief Writing

Conflict Resolution

The states in play, with the data that shapes their stance

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

Country dossier

By committee

CS4CA Nordic: Cyber Security for Critical Assets Summit 2027

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Cyber Regulation and the Future of Critical Infrastructure

Managing Third Party Risk

Securing Legacy OT Amidst Rapid Digitalisation

Integrating OT Architecture to the Cloud

Building a Team Capable of Managing IT and OT Security

Resources

Geopolitics & Business Security

V2 Security Copenhagen 2026

Copenhagen Democracy Summit 2026

VL Summit 2026

AARCON Summer Conference 2026: "Transitions: The Aftermath of War and Conflict"

International Conference on International Humanitarian Law and Armed Forces Regulations

Frequently asked questions

CS4CA Nordic: Cyber Security for Critical Assets Summit 2027

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Cyber Regulation and the Future of Critical Infrastructure

Managing Third Party Risk

Securing Legacy OT Amidst Rapid Digitalisation

Integrating OT Architecture to the Cloud

Building a Team Capable of Managing IT and OT Security

Resources

Geopolitics & Business Security

V2 Security Copenhagen 2026

Copenhagen Democracy Summit 2026

VL Summit 2026

AARCON Summer Conference 2026: "Transitions: The Aftermath of War and Conflict"

International Conference on International Humanitarian Law and Armed Forces Regulations

Frequently asked questions

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

Geopolitics & Business Security

V2 Security Copenhagen 2026

Copenhagen Democracy Summit 2026

VL Summit 2026

AARCON Summer Conference 2026: "Transitions: The Aftermath of War and Conflict"

International Conference on International Humanitarian Law and Armed Forces Regulations

Frequently asked questions

Committees & topics

Why it matters

How to prepare

Country perspectives

Topics & background

Resources

Related conferences

Geopolitics & Business Security

V2 Security Copenhagen 2026

Copenhagen Democracy Summit 2026

VL Summit 2026

AARCON Summer Conference 2026: "Transitions: The Aftermath of War and Conflict"

International Conference on International Humanitarian Law and Armed Forces Regulations

Frequently asked questions