Critical infrastructure protection
A changing security environment and more diverse threats have increased the need to protect society’s critical infrastructure and improve the resilience of critical entities.
Critical infrastructure refers to facilities, equipment, systems and other assets that are necessary for providing an essential service for society. A key feature of critical infrastructure is that essential services are mutually dependent.
Most of Finland’s critical infrastructure and its protection fall under private operators. Cooperation between authorities and the owners of critical infrastructure is therefore important.
Critical Infrastructure Protection and Crisis Resilience Act
The Finnish Act on the Protection of Infrastructure Critical to Society and on the Improvement of Resilience (the CER Act) entered into force on 1 July 2025. The purpose of the act is to enhance national security and the resilience of society. It aims to ensure that essential services needed for the functioning and security of society operate with as few disruptions as possible in all circumstances.
The Ministry of the Interior coordinates and harmonises the national implementation of the act. Finnish legislation is based on the EU Critical Entities Resilience Directive (the CER Directive), which requires Member States to identify entities critical to society and strengthen their ability to withstand disruptions and crises.
The legislation governs eleven sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and the production, processing and distribution of food. The highest state institutions and security authorities fall outside the scope of the act.
