Cybersäkerhetslagen · Swedish NIS2

NIS2 readiness, starting with Sweden.

Work through Cybersäkerhetslagen’s 25 requirements, and run the risk, supplier, incident and policy work behind them in one place.

Book a demo Start free ISO 27001 check

Start with the free ISO 27001 check: the security measures the law builds on.

Requirements view for a demo company with “Cybersäkerhetslagen (NIS2) 2026.1.0” selected: compliance at 40 % (10 of 25 applicable) and Swedish-language requirements such as 2:2 Anmälningsskyldighet and 2:3 Lämpliga och proportionella säkerhetsåtgärder. — Cybersäkerhetslagen in Fidureon: every requirement with its status, in the law’s own Swedish. Product screens show a fictional demo company.

Risk matrix card: a 4 × 4 grid from unlikely to highly likely and negligible to catastrophic, with the number of risks in each cell coloured from green to red. — Cybersäkerhetslagen in Fidureon: every requirement with its status, in the law’s own Swedish. Product screens show a fictional demo company.

The law in brief

What Cybersäkerhetslagen asks of you.

A short orientation, not legal advice. The law and the supervisory authority’s regulations are the reference.

Who it applies to Essential and important entities in the sectors the law lists, such as energy, transport, health and digital infrastructure. Whether you are in scope depends on your sector and size.
Leadership is accountable Security is a management responsibility, and the law requires training for leadership (2:4).
Risk-based security measures Appropriate and proportionate measures, from an all-hazards perspective (2:3), covering at least the 10 areas listed here.
Significant incidents are reported To the authority in stages: early warning, incident notification, interim and final report (2:5–2:8).
Regulations add the detail MCF’s regulations (MCFFS 2026:11) ship as a separate catalogue you can switch on. They are kept apart from the law’s 25 requirements.

The 10 measure areas of 2:3

2:3.1 Risk analysis and security strategy Riskanalys och säkerhetsstrategi In Fidureon: RisksPolicies
2:3.2 Incident handling Incidenthantering In Fidureon: Incident log
2:3.3 Business continuity and crisis management Kontinuitetshantering och krishantering In Fidureon: Processes with RTO and RPO
2:3.4 Supply-chain security Säkerhet i leveranskedjan In Fidureon: SuppliersQuestionnaire portal
2:3.5 Security in acquisition, development and maintenance Säkerhet vid förvärv, utveckling och underhåll In Fidureon: GitHub evidence connector
2:3.6 Assessing the effectiveness of measures Bedömning av säkerhetsåtgärdernas effektivitet In Fidureon: Control reviewsGap analysis
2:3.7 Cyber hygiene and training Cyberhygien och utbildning In Fidureon: TrainingCompetence
2:3.8 Cryptography and encryption Kryptografi och kryptering In Fidureon: Your controls and evidence
2:3.9 Personnel security and access control Personalsäkerhet och åtkomstkontroll In Fidureon: Your controls and evidence
2:3.10 Authentication and secured communications Autentisering och säkrade kommunikationer In Fidureon: Your controls and evidence

25 Requirements in the law Cybersäkerhetslagen, the Swedish NIS2 law

10 Security-measure areas in 2:3 Each one a requirement you can link controls to

15 Jan Came into force in 2026 Applies now, not on a future deadline

In Swedish, as the law is written

Your team works in Swedish or English.

The catalogue keeps the law’s own wording, so nothing is lost in translation. Switch the interface language per user.

Svenska English

The same requirements view, one language setting apart.

The Cybersäkerhetslagen requirements in the Swedish interface for a demo company: “Krav”, efterlevnad 40 % (10 av 25 tillämpliga), with statuses Uppfyllt and Pågår. — The requirements keep the law’s Swedish wording in both languages; the interface around them switches between Swedish and English.

How Fidureon covers Cybersäkerhetslagen

The security measures, with the work behind them.

Each requirement links to the controls, actions and evidence that meet it. These are the screens where that work happens.

2:3.1Risk analysis

Risks, treatments and acceptances in one register.

Inherent and residual levels, treatment plans with controls and actions, risk acceptances with a review date, and a risk appetite with breach indicators. Link risks to the assets, processes and suppliers they concern.

Risk register filtered by severity, listing risks such as “AI Act high-risk obligations missed for grid AI” and “Critical ICT provider outage halts billing and metering”, each with a category, linked entity, owner role and likelihood. — The risk register: a severity filter, a category, an owning role and the likelihood of each risk.

2:3.4Supply chain

Know every supplier, and ask them the right questions.

Keep each supplier with its service, owner and assessment status, and send security questionnaires with AI-generated questions.

Suppliers answer in a hosted portal, no account needed. Suppliers upload evidence straight into the questionnaire.
Email replies are parsed into answers, and reminders go out on schedule.

Supplier register listing fictional suppliers such as Atlas LLM Inc., Fjärrnät Telecom AB and GridSense Systems Oy with an owner role, assessment status (Assessed, Not Assessed), contact and linked assets. — Suppliers with the service they provide, an owner and an assessment status.

2:3.2Incident handling

Every incident logged and tracked.

Record what happened, when it was detected and who owns it, and track it from draft to closed, so your incident history is in one place.

Your reporting process to the authority is tracked as requirements 2:5–2:8 in the catalogue; the reports themselves go through the authority’s own channels.

Incident register for a demo company: four incidents (one draft, one logged, two closed) such as suspicious login attempts and a phishing campaign, each with detection date, owner, status and summary. — The incident register: detection date, owner and a draft-to-closed lifecycle.

The rest of the measures

Suppliers, policies and people, in the same place.

The supplier-facing questionnaire: question 1, “Is your organisation certified to ISO/IEC 27001?”, answered Yes, with an optional evidence upload for the certificate and Statement of Applicability.

What your supplier sees · 2:3.4

A hosted questionnaire, no account needed. Progress is saved as they go, and evidence can be attached to each answer.

Questionnaire details: sent to the supplier’s contact, with sent, first-opened and submitted dates, 10 of 10 questions answered and the first answer, Yes to ISO/IEC 27001 certification.

Their answers, back with you · 2:3.4

Sent, opened and submitted dates on every questionnaire, with the answers ready to review and export as CSV.

Two policy rows: Information Security Policy and Access Control Policy, each with the category Security and the status Published (v1).

Policies, approved and versioned · 2:3.1

Policies and standards with a category, a version and an approval status, drafted with AI and exported to PDF.

An inbox action, high priority: “Run NIS2 incident-reporting tabletop exercise”, due 20 Oct 2026 and assigned to a named person.

Exercises and training as dated actions · 2:3.7

Plan the work the law expects, such as an incident-reporting tabletop exercise, as actions with a priority, an owner and a due date.

Accountability

Who changed what, and when.

Risks, controls, suppliers, policies and more keep a change history, including changes made through the AI assistant or MCP.

Platform security

MFA on every plan. SSO on Enterprise.

Every user can turn on TOTP multi-factor authentication with backup codes, on every plan. Single sign-on over SAML or OIDC is on Enterprise.

Works with your other frameworks

One requirements view for every framework you run.

Do supply-chain security once: link the control behind Cybersäkerhetslagen 2:3.4 to ISO 27001 A.5.19, and to GDPR Art. 28 if it covers your processors, and its status and evidence count toward each.

Your links, your call Link controls by hand, or accept the suggestions Fidureon makes when you import controls from documents or spreadsheets.
One compliance number Requirement and control status come from the actions your teams complete, in every framework at once.

Switch the same requirements view between frameworks: ISO 9001, ISO 27001, Cybersäkerhetslagen, the EU AI Act and GDPR, each with its own compliance bar.

FAQ

NIS2 questions.

Which NIS2 law does Fidureon cover?

Sweden’s Cybersäkerhetslagen, the Swedish law that transposes the NIS2 Directive and has applied since 15 January 2026. Fidureon includes it as a catalogue of 25 requirements, written in Swedish as in the law, and the app itself is available in Swedish and English.

Can we start with the free readiness check?

Yes. Its ISO 27001 track is a good start on the security measures the law asks for. For Cybersäkerhetslagen itself, book a demo and we will walk through the requirements with your own scope.

Does Fidureon include MCF’s regulations (MCFFS 2026:11)?

Yes. MCF’s regulations (MCFFS 2026:11) ship as a separate catalogue you can switch on. Their requirements are tracked on their own, never counted into the law’s 25.

We operate in other EU countries too. Can we use Fidureon for NIS2 there?

Fidureon’s NIS2 catalogue is Sweden’s Cybersäkerhetslagen. For requirements from another country, add them as a custom framework and link the controls you already run in Sweden to them, so the same work and evidence count in both. Talk to us about your scope.

How does Fidureon support incident reporting?

Fidureon keeps your incident log: what happened, when it was detected, who owns it and its status from draft to closed. The catalogue includes the law’s reporting requirements so you can track your reporting process. Notifications themselves go to the supervisory authority through its own channels.

Does Fidureon tell us whether the law applies to us?

No. Whether you are an essential or an important entity depends on your sector and size as set out in the law, and that assessment is yours to make, with legal advice where you need it. Once you know you are in scope, Fidureon gives you the requirements and the place to do the work.

We already work with ISO 27001. Do we start again?

No. A control in Fidureon can be linked to requirements in several frameworks at once, so an ISO 27001 control you already run can also count toward a Cybersäkerhetslagen requirement. You decide the links yourself, with AI suggestions when you import controls from documents or spreadsheets.

Get ready for Cybersäkerhetslagen.

Book a demo and we will walk through the requirements, your risks, suppliers and incidents on your own scope. Or start with the free ISO 27001 readiness check.