Hovedstadens Beredskab

Denmark · owned by Independent (Denmark) · hbr.dk · 10 vendors

Hovedstadens Beredskab is the joint emergency and fire rescue service for the greater Copenhagen (Capital Region) area of Denmark, protecting approximately 1 million residents around the clock. It operates fire stations, ambulance services, alarm and operations centres, and civil preparedness functions across multiple municipalities including Copenhagen, Frederiksberg, Hvidovre, Glostrup, Brøndby, Dragør, Rødovre, and Albertslund. The organisation also provides fire prevention, fire safety inspections, training courses, and civil emergency preparedness services.

Resilience scores

Technology vendors

Insights

Last updated 2026-05-20 · revision 3

10 direct vendors, 143 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Hovedstadens Beredskab exhibits a medium level of migration readiness, with several significant challenges. The core internal tech stack, centered around WordPress, is not inherently cloud-native, containerized, or microservices-based, suggesting that a migration would likely involve re-platforming or significant re-architecture rather than a straightforward lift-and-shift. This increases the complexity and cost of migration. The regulatory environment is another major factor; compliance with GDPR and Danish national laws, coupled with the requirement for a NIS2 assessment, means that any migration must meticulously address data protection, security, and operational continuity requirements, potentially limiting cloud provider choices or requiring extensive compliance work. A critical missing piece of information is 'Data Residency Requirements'; if strict data residency rules apply (common in the government sector), this could severely restrict cloud migration options, especially for global cloud providers. While the 'Total Vendors: 0' is an anomaly, the existence of 'Total Services: 15' and 'Vendor HQ Countries' implies external dependencies. The 'Vendor Lock-in Risk: Unknown' for these services is a significant concern, as high lock-in could complicate or delay migration efforts. On the positive side, the organization's strong financial growth provides a solid foundation to fund a complex migration project. The development of mobile applications (iOS/Android) and integration with MitID indicates some experience with modern digital platforms, which could be leveraged in a migration strategy.

Compliance

3 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

Emergency services organizations are likely classified as Essential Entities under NIS2 due to their critical role in public safety and emergency response. As a large public organization (800+ employees) providing critical infrastructure services in the EU, they would face significant compliance obligations. Non-compliance with NIS2 can result in fines up to €10 million or 2% of annual turnover, plus potential operational restrictions. The high risk reflects both the likelihood of applicability and severe consequences of non-compliance for critical infrastructure providers.

Evidence: https://hbr.dk/wp-content/uploads/2026/03/informationssikkerhedspolitik-2.4.pdf

GDPR (source) — Compliant

As a Danish public sector organization processing personal data of EU residents, GDPR compliance is mandatory. The organization has established comprehensive data protection policies, privacy policies, and information security frameworks. However, as a public emergency services provider handling sensitive personal data during emergency calls and operations, any non-compliance could result in significant fines (up to 4% of annual turnover) and reputational damage. The risk is medium rather than high due to their demonstrated compliance efforts and established policies.

Evidence: https://hbr.dk/databeskyttelse/, https://hbr.dk/privatlivspolitik/, https://hbr.dk/wp-content/uploads/2026/03/informationssikkerhedspolitik-2.4.pdf

ISO 27001 (source) — Partially Compliant

The organization has established information security policies explicitly based on ISO 27001 standards, indicating commitment to the framework. However, no formal ISO 27001 certification evidence was found. For a public sector organization handling sensitive emergency services data, formal certification would provide additional assurance. The medium risk reflects the gap between having ISO 27001-based policies and formal certification, which could impact stakeholder confidence and regulatory compliance demonstrations.

Evidence: https://hbr.dk/wp-content/uploads/2026/03/informationssikkerhedspolitik-2.4.pdf

Financials

Three-year financials

Financial Resilience Score: 8/10

Hovedstadens Beredskab (HBR) demonstrates strong financial resilience due to its status as a publicly-owned inter-municipal entity (§60-fællesskab) backed by eight municipalities, with the City of Copenhagen as the dominant owner. Owner contributions (ejerbidrag) are set in a multi-year model approved by the politically-appointed board, providing highly predictable revenue. As critical infrastructure serving approximately 1 million citizens including parliament, central government, and royal residences, HBR faces extremely low risk of defunding. The organization benefits from revenue diversification beyond municipal contributions, including ambulance services for Region Hovedstaden, ABA (automatic fire alarm) monitoring, courses, and statutory inspection fees. With ~800 employees and 13 stations, HBR is Denmark's largest beredskab, providing operational efficiency advantages versus smaller municipal services. However, resilience is tempered by significant cost pressures, including repeated demands for efficiency savings and tight ambulance-contract economics with Region Hovedstaden that have produced operating deficits in some years. The wage-heavy cost base creates exposure to collective-bargaining outcomes and pension liabilities. As an I/S, HBR carries only a thin egenkapital, though owner municipalities are jointly and severally liable, mitigating solvency risk. Major-incident exposure (e.g., the April 2024 Børsen fire) can generate unbudgeted costs, and governance complexity across 8 owner municipalities can slow strategic decisions. Overall, the combination of public-sector backing, strategic importance, and diversified revenue streams supports a strong resilience profile.

Key strengths: Public-sector backing from 8 owner municipalities with predictable ejerbidrag funding, Diversified revenue from ambulance contracts, ABA monitoring, courses, and inspection fees, Largest beredskab in Denmark with scale efficiencies (~800 employees, 13 stations), Strategic importance as critical infrastructure for 1M citizens including government institutions, Joint and several liability of owner municipalities under I/S structure

Risk factors: Ongoing cost pressure and demands for efficiency savings, Tight ambulance contract economics with Region Hovedstaden producing periodic deficits, Wage-heavy cost base exposed to collective bargaining and pension liabilities, Major-incident exposure generating unbudgeted costs (e.g., Børsen fire April 2024), Governance complexity requiring alignment across 8 owner municipalities, Thin equity buffer (egenkapital) as I/S structure

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report