Where is the Cyber Security 2027 conference being held?

The conference is being held in Oslo, NOR.

What is the format of the Cyber Security 2027 event?

The event is a conference, providing a platform for discussions and knowledge exchange on cybersecurity.

Cyber Security 2027

Name: Cyber Security 2027
Start: 2027-04-28T00:00:00Z
End: 2027-04-29T00:00:00Z
Location: Oslo

Apr 28–29, 2027Oslo, NorwayIn-person

The Cyber Security 2027 conference, held in Oslo, NOR, focuses on the evolving landscape of cybersecurity. This event brings together experts and stakeholders to discuss current threats, defensive strategies, and future challenges in the digital realm. Its location in NOR, a nation with a strong commitment to digital infrastructure and security, provides a pertinent backdrop for these critical discussions.

Committees & topics

Topics
Cybersecurity and the Protection of Critical Infrastructure · Securing Operational Technology (OT) and Industrial Control Systems · International Standards for Cybersecurity in Operational Technology

Why it matters

In an increasingly interconnected world, cybersecurity is not merely a technical concern but a fundamental aspect of national security, economic stability, and societal well-being. The proliferation of digital technologies has opened new avenues for malicious actors, ranging from state-sponsored groups to individual cybercriminals, to exploit vulnerabilities. Events like Cyber Security 2027 are crucial for fostering international cooperation and knowledge sharing, which are essential for developing robust defenses against these sophisticated threats.

The discussions at this conference are particularly relevant as cyberattacks continue to grow in frequency and complexity, impacting critical infrastructure, sensitive data, and democratic processes. Understanding the latest trends in cyber warfare, espionage, and crime is paramount for governments, businesses, and individuals alike. The insights gained from such gatherings contribute directly to the formulation of effective policies and the implementation of advanced security measures, safeguarding digital assets and preserving trust in the digital ecosystem.

How to prepare

Delegates preparing for Cyber Security 2027 should focus on understanding the multifaceted nature of cybersecurity, encompassing technical, policy, and geopolitical dimensions. A strong grasp of concepts such as cyber deterrence and adaptive cyber defense will be beneficial. Consider how different national approaches to cyber governance and defense mechanisms might intersect or diverge, particularly in the context of international cooperation.

Familiarize yourself with the various stakeholders involved in cybersecurity, from government agencies and international organizations to private sector entities and civil society groups. Understanding their respective roles and interests, as outlined in lessons like "What Is Stakeholder Mapping?" and "Hidden Stakeholders," will enhance your ability to engage constructively. Prepare to discuss how global cyber norms can be established and enforced to promote a more secure and stable cyberspace, considering the challenges of attribution and accountability in the digital domain. Effective engagement strategies, as discussed in "Engagement Strategies," will be key to contributing meaningfully to the dialogue.

Country perspectives

Where the most-relevant 1 countries stand on the core issues in play. Click through for the full country profile.

Norway

A proactive stance on cybersecurity, emphasizing national resilience and international cooperation.

Role in topic

As the host nation, NOR plays a significant role in facilitating discussions on cybersecurity. Its advanced digital infrastructure and commitment to international collaboration position it as a key player in developing and promoting best practices in cyber defense. NOR's perspective often highlights the importance of protecting critical national infrastructure and fostering public-private partnerships to counter cyber threats effectively.

Topics & background

The background behind each topic and the actors that shape it.

Cybersecurity and the Protection of Critical Infrastructure

Cybersecurity has moved from a technical concern to a central pillar of international security over the past two decades. Landmark incidents — the 2007 distributed denial-of-service attacks on Estonia, the 2010 Stuxnet operation against Iranian nuclear facilities, the 2017 NotPetya and WannaCry outbreaks, and the 2021 Colonial Pipeline ransomware attack — demonstrated that malicious cyber activity could disrupt economies, undermine state functions, and produce kinetic-scale consequences without crossing traditional thresholds of armed conflict. In parallel, the UN Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG) have sought to articulate norms of responsible state behavior in cyberspace, affirming that international law, including the UN Charter, applies online. The core dispute centers on how to operationalize those norms. Western states generally emphasize the applicability of existing international humanitarian law, attribution, and accountability for state-sponsored attacks, while Russia and China have pushed for a new binding treaty under UN auspices, partly to constrain offensive Western cyber capabilities and partly to legitimize broader information-security controls. Ransomware, supply-chain compromises (such as SolarWinds and MOVEit), and the targeting of hospitals, energy grids, and election infrastructure have intensified pressure for concrete cooperation, even as geopolitical rivalry has made attribution and joint enforcement increasingly difficult. Today, the OEWG's 2021–2025 mandate is winding down and member states are negotiating a successor mechanism. The UN Convention against Cybercrime, adopted by the General Assembly in late 2024, has drawn both support and sharp criticism from human-rights groups concerned about surveillance abuse. The debate now is less about whether cyberspace requires governance than about who writes the rules, how compliance is verified, and how to balance security, sovereignty, and civil liberties.

Key players

Securing Operational Technology (OT) and Industrial Control Systems

Operational Technology (OT) — the hardware and software that monitors and controls physical processes in power grids, water utilities, pipelines, manufacturing plants, transportation, and other industrial sectors — was historically isolated from public networks and built for reliability and safety rather than security. The accelerating convergence of OT with IT systems, driven by the Industrial Internet of Things, remote monitoring, and cloud-based analytics, has dramatically expanded the attack surface of critical infrastructure. Legacy programmable logic controllers (PLCs), SCADA systems, and proprietary protocols often lack basic security features such as authentication or encryption, making them attractive targets for state and criminal actors. A series of incidents has made OT risk concrete. Stuxnet (2010) demonstrated that malware could cause physical damage to centrifuges; the 2015 and 2016 attacks on the Ukrainian power grid, attributed to Russian groups, cut electricity to hundreds of thousands of customers; the 2017 Triton/Trisis malware targeted safety instrumented systems at a Saudi petrochemical plant, threatening human life; and the 2021 Colonial Pipeline ransomware attack, though striking IT systems, forced shutdown of OT operations and disrupted fuel supply across the U.S. East Coast. More recent intrusions attributed to groups like Volt Typhoon suggest pre-positioning in Western critical infrastructure for potential disruption during geopolitical crisis. Today, governments are moving from voluntary guidance to mandatory baseline requirements for OT operators in sectors such as energy, water, and transport. The challenge is reconciling the long lifecycles and safety constraints of industrial systems with the speed of evolving threats, while building cross-border incident-response capacity and protecting supply chains for industrial control equipment.

Key players

International Standards for Cybersecurity in Operational Technology

Because OT environments span jurisdictions, vendors, and decades-old equipment, international standards have become the principal lever for raising the cybersecurity floor. The most influential framework is the IEC 62443 series, developed jointly by the International Electrotechnical Commission and the ISA, which defines security requirements for industrial automation and control systems across asset owners, integrators, and product suppliers. Complementary standards include ISO/IEC 27001 and 27019 for information security management in energy utilities, NIST SP 800-82 for industrial control systems, and sector-specific frameworks such as NERC CIP for the North American bulk electric system. The core dispute is not whether standards are needed but how they should be made binding, harmonized, and enforced across borders. The European Union has taken the most assertive regulatory approach, with the NIS2 Directive expanding mandatory cybersecurity obligations to a broad set of critical and important entities, and the Cyber Resilience Act imposing security requirements on digital products — including industrial components — placed on the EU market. The United States relies on a mix of sector-specific mandates and voluntary frameworks anchored in NIST guidance. China has built a parallel domestic standards ecosystem under its Multi-Level Protection Scheme (MLPS 2.0) and Cybersecurity Law, raising concerns about market fragmentation and forced technology localization. The contemporary debate focuses on mutual recognition of conformity assessments, secure-by-design obligations on vendors, software bill of materials (SBOM) requirements, and how international bodies such as the ITU, ISO/IEC JTC 1, and the IEC can keep pace with rapidly evolving threats. For many developing economies, capacity to implement these standards — not their content — is the binding constraint, raising questions about technical assistance and equitable participation in standards-setting itself.

Key players