Cybersecurity Strategies of Digital Administrations: A Review of The EU and Finland

Abstract

This study examines the impact of increasingly complex cyber threats on public administration and policy-making processes through the cases of the European Union (EU) and Finland. The EU pursues normative leadership in cybersecurity by promoting integrated governance through legislation, institutional coordination, and resilience policies. The NIS2 Directive, the Cyber Resilience Act, the Digital Services Act, the General Data Protection Regulation (GDPR), and the Artificial Intelligence Act collectively form the normative foundation of the Union’s comprehensive digital security framework. However, implementation disparities among member states continue to limit the overall effectiveness and sustainability of these strategies. Finland’s 2024–2035 National Cybersecurity Strategy, on the other hand, represents an operationally robust model that integrates participatory governance, public–private cooperation, cryptography, artificial intelligence applications, and national monitoring mechanisms. Finland conceptualizes cybersecurity not merely as a technical defense tool but as an integral component of economic development, democratic governance, and the digital dimension of national sovereignty. The findings indicate that sustainable cybersecurity depends not only on technological capacity but also on institutional resilience, international cooperation, skilled human resources, and societal awareness. When the EU and Finland are considered together, Europe's potential to create a holistic and resilient digital security ecosystem is increasingly strengthened.