An attacker who takes over your company's support account may also gain a way into a customer. Restoring your own computers will not resolve that customer's exposure. For a Norwegian supplier with access to other businesses' systems, customer connections belong near the top of the response to NSM's new warning.
The management decision is immediate: which customer access should remain available, under what conditions, and who can restrict it when something looks wrong? A small headcount is a poor reason to postpone that decision when the company has substantial access to an important customer's operations.
What NSM announced
On 27 October 2026, Norway's National Security Authority (NSM) publicly shared its national cyber-risk level for the first time and set it to HIGH. It called for immediate preventive action. NSM identifies defence, space, critical infrastructure and relevant suppliers as particularly exposed. It also says AI-enabled cyber operations increase the potential harm, while such use has not yet been documented in Norway in its assessment.
The warning should change priorities before an incident occurs. My recommendation is to begin with the connections through which a problem in your own business could affect someone else's essential service. That includes access held by your staff, your IT provider and automated integrations operating on your behalf.
Follow the access, not the size of the contract
A modest maintenance agreement may give a technician powerful access. A larger customer may only receive finished products and have no connection to your systems. Rank the review by what the connection allows and the consequence of misuse, rather than by turnover alone.
Ask the operations and technical owners to identify which customer systems the company can reach, which accounts or integrations provide that access, and why it is still needed. Include unattended software connections and access used only during emergencies. An employee list will not reveal every account that can act for the business.
Check whether the actual access still matches the assignment. Has a project ended? Has a technician changed employer? Does the account reach more systems than the service requires? Can one compromised identity affect several customers? Management needs the answers without circulating passwords, technical secrets or customer diagrams in an ordinary board pack.
NSM's ICT security principles are intended to be adapted to the individual organisation. The priorities here are a practical application to a supplier relationship, not a complete security assessment or a new legal rule for every Norwegian AS.
One access change needs two businesses to agree
Consider a hypothetical Norwegian maintenance company with 60 employees and several industrial customers. It uses remote support for planned work and urgent assistance. During the review, management discovers a shared support account used across several assignments. Some permissions remain from completed projects, and nobody has recently tested what happens if the account must be suspended.
The commercial problem is not solved by sending the IT provider a general instruction to close remote access. A customer may depend on support during a breakdown. Equally, leaving unnecessary access open because “we might need it” preserves exposure without a clear business owner.
Have the responsible people on both sides agree a specific change. Replace unnecessary shared access with accountable access for the authorised task where the system supports it. Limit the systems and permissions involved, decide when access should be available, and establish who approves exceptional use. The technical team must assess safe implementation, particularly where industrial operations or safety could be affected.
Test that an authorised technician can still perform the agreed work, that withdrawn access actually stops working, and that the customer's contact can be reached if the normal arrangement fails. Check the recovery and emergency-access procedures as part of the change. A new control that locks out legitimate support without a workable alternative creates another operational risk.
This is an invented example. It illustrates a decision to investigate, not a claim that a particular customer connection has been compromised.
Check the way people sign in
NSM's guidance on phishing-resistant authentication recommends passkeys or other phishing-resistant methods and prioritises exposed users, cloud services and internet-facing services. It distinguishes these from ordinary one-time codes and approval prompts. Its guidance also addresses older sign-in methods that could otherwise remain available as a bypass.
For customer support, ask who controls the identity: your company, the customer or another provider. A stronger sign-in method on your own email does not establish that the account used to administer the customer's service is protected in the same way. Confirm the actual sign-in route and permitted alternatives with the party operating it.
People, integration accounts and emergency access may need different arrangements. Do not force a human sign-in method onto an automated connection without understanding how it works. Where the preferred control is not supported, ask the technical owner for a compensating measure, its limitation and a dated plan. Keep the unresolved exception visible to management.
Contact the customer with a concrete request
A useful first message is a request to coordinate, rather than a blanket assurance that everything is secure. For example:
“Following NSM's warning, we are reviewing our access to your systems. Please confirm who can approve access changes, which services depend on continuous access, and how we reach the responsible person outside working hours. We will share specific findings and proposed changes through our agreed secure channel.”
This is suggested wording, not a message sent to any customer. Adapt it to the service agreement and the information you already have. Use verified contact details. Agree where sensitive findings belong before sending technical details.
The response should produce an agreed owner and a change that can be checked. An unanswered email is an open dependency, not evidence that the customer has accepted the risk. Escalate unresolved questions through the agreed commercial and operational contacts. The outsourced IT accountability guide explains how to close gaps between providers.
Give the review capacity and a follow-up date
Ask the CEO to decide which important connections will be reviewed first, which planned work must move and when the first results will be available. Assign a deputy who can decide if the ordinary contact is absent. Use the existing incident process if the review uncovers signs of compromise; an access cleanup alone does not investigate an intrusion.
Useful AI work can continue while this review takes place. Approved tools can help organise permitted inventory information or draft questions for the technical team. A new agent that receives access to customer systems needs the same scrutiny as any other connection, including the customer's authorisation. A national warning is a reason to prioritise exposure, not an automatic reason to stop every low-risk AI task.
The cost of action includes staff time, possible service interruption and delayed development. Make that trade-off explicit. A small business may begin with its most consequential customer connection and its existing provider, rather than commission a large programme before making any improvement.
NSM's security-management principles place security within management's work and emphasise leadership responsibility. Management should report which important customer connections have been reviewed, what changed, which exceptions remain and when they will be resolved.
Where customer exposure is material, the board should challenge whether the priorities, resources and remaining risk are defensible. It should ensure management has an appropriate mandate, without selecting account settings or approving each technical change. The article on faster cyber response addresses the separate preparation for an urgent vulnerability, including the period before a patch exists.
Start with one question today: If our support access is misused, which customer's service is at risk, and can both businesses act quickly enough to limit the damage?
Sources checked on 28 October 2026. The maintenance company and customer message are hypothetical. Priorities, working methods and follow-up proposals are the author's recommendations. The cited guidance does not establish identical legal duties for all businesses. The illustration is AI-generated.