NIS2 is in force in Sweden as the Cybersecurity Act. This overview explains what changes, who it reaches and how to read the rest of this guide.
The Act turns cybersecurity from an IT concern into a management duty. It sets out risk management measures, a fixed incident reporting clock and supervision with real sanctions.
Key points
- Find out early whether you are in scope
- Give management a clear view of the duties they now own
- Start collecting evidence before a supervisor asks for it
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- Are you in scope? Sectors, size and the essential or important split
- Management accountability: what the board must approve and sign
- Risk management measures under Article 21
- Incident reporting: the 24-hour, 72-hour and one-month clock
- Supply chain security and supplier requirements
- Registration and working with your supervisory authority
- Policies and documentation that count as evidence
- Training, awareness and role-based skills
- Sanctions, fines and personal liability
- A 90-day NIS2 action plan
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. Most organisations do not need to start from zero. Existing ISO 27001 work, incident routines and supplier reviews usually cover a good part of the ground.