I very much doubt that there's any real need to be making decisions at that level. The money and other resources going to this IT effort is
deeply unlikely to be anywhere close to the pots of money that would be considered for allocation against Russian aggression.
And given that this is in Denmark—which, while certainly within a zone of some concern, is hardly in any imminent danger from Russia—it seems to me that focusing on defending against Russian aggression, at the expense of effectively everything else, would be quite unproductive.
Or is it just that you don't think spending on maintaining privacy is worthwhile no matter what, and the Russia situation is a convenient distraction you can point to?