XML 152 R8.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Every year Ericsson identifies and manages numerous cyber-attack attempts, vulnerabilities, and cybersecurity incidents. In 2024, Ericsson detected and resolved cybersecurity incidents effectively, as none were considered to be material. Ericsson faces certain ongoing risks from advanced threat actors that, if realized and not timely detected and mitigated, are reasonably likely to materially affect the Company, including its operations, strategy, results of operations, or financial condition. The strategic and sensitive nature of the information and telecommunications industry also heightens exposure to cyber-attacks aimed at disrupting, damaging or infiltrating another’s critical infrastructure, network and systems and corporate espionage with respect to both technology and commercial matters, including in both cases from state-backed and criminal threat actors.
Ericsson has developed and implemented cybersecurity programs intended to protect the confidentiality, integrity, and availability of its critical systems and information as well as its products and services.
Ericsson is globally certified to ISO/ECN 27001:2022 for Information Security Management Systems, which is integrated into the Group Management System and encompasses Ericsson’s security requirements, including for third parties, as well as practices to assess security posture and performance. Ericsson has a central threat intelligence team and multiple security risk managers responsible for assessing security threats and vulnerabilities and identifying cybersecurity risks, including third-party risks. Ericsson’s Cyber Defense Center works to monitor, detect, respond, and limit any cybersecurity attacks from expanding in severity or scale. The incident management team function is designed and staffed for continuous availability and includes security and computer forensics specialists responsible for escalating and investigating incidents. If needed, business continuity plans are in place to help recover from the effects of a cybersecurity incident. Internal adherence to frameworks and processes is achieved through quantitative and qualitative measurements, including regular external and internal audits, and regularly recurring training, including on security awareness.
To secure Ericsson’s products and services, Ericsson’s Security Reliability Model mandates product and feature risk assessments, secure design, secure coding principles, use of analysis tools, and supply chain security requirements to avoid vulnerabilities. To mitigate security risks, Ericsson maintains a catalogue of externally developed components and code used in its products and thorough testing is performed to ensure high product quality. Training is provided to the workforce about the Security Reliability Model and its included tasks and activities. The Product Security Incident Response Team coordinates remediation for customers affected by vulnerabilities or security incidents in Ericsson products and actively monitors vulnerabilities in third-party software and alerts the relevant product development organization. Ericsson’s product development and lifecycle processes have been successfully audited to the GSMA Network Equipment Security Assurance Scheme since 2020. Several products are also externally evaluated against 3GPP Security Assurance Specification.
Ericsson’s cybersecurity programs do not imply that it always meets all technical specifications or requirements at all times, but that the aforementioned frameworks help to identify, assess, and manage cybersecurity risks relevant to its business.
Cybersecurity Governance
The Board considers cybersecurity risks as part of its risk oversight function and has delegated the specific oversight of cybersecurity risks to the Audit and Compliance Committee, which receives regular briefings from the Chief Security Officer on cybersecurity matters.
Ericsson’s President and CEO sets the overall direction for cybersecurity by approving Ericsson’s Security Strategy and its Security Policy. In addition, the Executive Team regularly receives briefings on cybersecurity risks, posture, investments and strategy execution and has established the Group Enterprise Security and Privacy Board, which manages the oversight of enterprise security, including cybersecurity and privacy. The Chair of the Group Enterprise Security and the Privacy Board is the Chief Operating Officer, and the Group Enterprise Security and Privacy Board’s agenda is driven by the Chief Security Officer, Maj. Gen. (Ret) Fredrik Robertsson. Maj. Gen. (Ret) Fredrik Robertsson serves as Ericsson’s Chief Security Officer and Head of Group Security. His diverse experience includes former roles at the Swedish Armed Forces Headquarters, such as Director of Plans, Chief Information Officer, and CISO, which included directing and developing the Swedish Armed Forces’ cyber capability and cyber defense. He holds a Master of Science degree in Political Science with a specialization in Security Studies. Additionally, Maj. Gen. (Ret) Robertsson has been an active member of the Swedish Contingencies Agency Cyber Security Council and serves as a board member for Sectra AB. The Group Enterprise Security and Privacy Board assembles executives and other senior business leaders a minimum of five times a year to review, recommend and endorse high-level security plans and monitor risks and security strategy execution.
Ericsson’s cybersecurity program is under the direction of the Chief Security Officer, who is responsible for enterprise security and reports to the Chief Operating Officer. The Chief Technology Officer is responsible for Product Security and Privacy and has delegated the handling of security requirements, standards and architecture related to product development and product management to the Chief Product Security Officer, Mikko Karikytö. Mikko Karikytö is Ericsson’s Chief Product Security Officer and Head of Product Security and was previously Head of Network Security and Head of Product Security Incident Response Team. Additionally, Mr. Karikytö is engaged in industry collaboration through organizations like ETIS (a collaboration community for the European Telecom industry), Forum of Incident Response and Security Teams, and EU Commission work groups. He has provided subject matter expertise for committee hearings of the UK parliament and the German Bundestag in connection with 5G security.
The respective Group function, market area and business area head are responsible for the implementation of security controls into Ericsson’s business processes and operations, which is mandated by the Chief Security Officer, the Chief Technology Officer or the Chief Product Security Officer, or through local laws, regulations or customer requirements. The Chief Security Officer and the Chief Product Security Officer regularly receive briefings and reports from the business areas, market areas and relevant Group functions on identified cybersecurity risks, vulnerabilities, and posture.
In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Financial Report – Risk factors – Risks related to cybersecurity matters” of the 2024 Swedish Annual Report (adjusted version).
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Ericsson is globally certified to ISO/ECN 27001:2022 for Information Security Management Systems, which is integrated into the Group Management System and encompasses Ericsson’s security requirements, including for third parties, as well as practices to assess security posture and performance. Ericsson has a central threat intelligence team and multiple security risk managers responsible for assessing security threats and vulnerabilities and identifying cybersecurity risks, including third-party risks. Ericsson’s Cyber Defense Center works to monitor, detect, respond, and limit any cybersecurity attacks from expanding in severity or scale. The incident management team function is designed and staffed for continuous availability and includes security and computer forensics specialists responsible for escalating and investigating incidents. If needed, business continuity plans are in place to help recover from the effects of a cybersecurity incident. Internal adherence to frameworks and processes is achieved through quantitative and qualitative measurements, including regular external and internal audits, and regularly recurring training, including on security awareness.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
The Board considers cybersecurity risks as part of its risk oversight function and has delegated the specific oversight of cybersecurity risks to the Audit and Compliance Committee, which receives regular briefings from the Chief Security Officer on cybersecurity matters.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Board considers cybersecurity risks as part of its risk oversight function and has delegated the specific oversight of cybersecurity risks to the Audit and Compliance Committee, which receives regular briefings from the Chief Security Officer on cybersecurity matters.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
The respective Group function, market area and business area head are responsible for the implementation of security controls into Ericsson’s business processes and operations, which is mandated by the Chief Security Officer, the Chief Technology Officer or the Chief Product Security Officer, or through local laws, regulations or customer requirements. The Chief Security Officer and the Chief Product Security Officer regularly receive briefings and reports from the business areas, market areas and relevant Group functions on identified cybersecurity risks, vulnerabilities, and posture.