As part of the 2026 Total Defence Year, Havtil, in collaboration with KraftCERT, is organising the Grey Dawn Petroleum 2026 exercise for operators with topside or onshore facilities, as well as technical service providers (TSPs) on the Norwegian Continental Shelf.

The exercise is based on a complex scenario on the Norwegian Continental Shelf, in which cyberattacks, influence operations and incidents challenge the preparedness of both operators and suppliers.

Background

The national framework for handling digital attacks and cyber incidents was updated in 2025. The framework describes how enterprises, sector response groups (SRGs) and the Norwegian National Cyber Security Centre (NCSC) are to collaborate on incident response.

Havtil is the sector response group (SRG) for the petroleum industry and has an agreement with KraftCERT regarding operational tasks related to incident notification and response. Effective coordination and a clear flow of information between enterprises, SRGs, and government agencies are essential for enhancing digital resilience.

ICT incidents in the petroleum industry

The National Framework for Handling Digital Attacks and Cyber Incidents describes how organisations, sector response groups (SRGs) and the National Cyber Security Centre (NCSC) should collaborate to manage digital attacks and cyber incidents. The framework clarifies roles, responsibilities, information flows and expectations, and establishes a common national model for incident management.

The National Cyber Security Centre (NCSC) is part of the National Security Authority (NSM). The centre is responsible for national incident notification, coordination and response to serious cyberattacks, and is tasked with ensuring a shared situational awareness across sectors.

A sector response group (SRG) is a centre of expertise designed to assist its sector in preventing, detecting and handling digital incidents. The SRG serves as a liaison between enterprises, other sectors, and NCSC, and is responsible for information sharing, providing advice and coordination.

Havtil has the sector response group (SRG) role for ICT incidents (cyber incidents) in the petroleum industry. We have an agreement with KraftCERT regarding the performance of operational tasks (notification and response) related to this.

Cooperation, decision-making abilities and situational awareness

The main objective of Grey Dawn Petroleum 2026 is to strengthen cooperation, decision-making abilities and situational awareness among all stakeholders involved in incident management in the petroleum sector.

A secondary objective is to develop shared expertise in incident management based on the national incident management model (the SRG framework)

Topic

The exercise will take the form of a tabletop exercise, with a particular focus on:

  • Emergency preparedness and crisis management in the face of complex and hybrid threats, with an emphasis on information management and the establishment of a shared situational awareness.
  • Security in digital systems and the management of cyber incidents.
  • Cooperation between companies, government agencies and other partners in the management of adverse incidents.
    The target audience for the exercise includes managers and specialists in digital incident management, emergency response and risk owners, as well as communications personnel at operators with topside facilities on the Norwegian Continental Shelf.

The exercise will take place in Stavanger on 22-23 September 2026.