Is Your Board Actually Ready?
NIS2 is Swedish Law

The Cybersecurity Act (Cybersäkerhetslagen) is Sweden’s legal instrument that transposes the EU NIS2 Directive into domestic legislation, effective 15 January 2026. NIS2 sets the EU framework; the national act specifies supervision and enforcement in Sweden, with MCF (formerly MSB) as the primary supervisory body.

Possibly. Size thresholds apply: essential entities require 250+ employees or €50M+ revenue; important entities require 50+ employees or €10M+. However, the supervisory authority can designate smaller organisations in scope if they perform a critical function. Do not assume size exempts you without verifying the function your organisation performs. The gap score includes a scope determination.

Yes. If you provide ICT services to an in-scope entity, you can be designated as an important entity under Article 21(2)(d) supply-chain obligations. Your municipal customer must assess and document every vendor relationship, including yours. This is the most common route that IT suppliers enter NIS2 scope without initially realising it.

Essential and important entities must self-register with MCF (formerly MSB) under the Cybersecurity Act. Registration requires your entity classification, your sector, and the services you provide within scope. eBuilder’s CISO Advisory service guides you through the process, including annual reporting obligations.

ISO 27001 covers approximately 70–80% of NIS2 Article 21 requirements, the strongest foundation you can have. However, NIS2 adds obligations ISO 27001 does not explicitly require: 24-hour incident reporting, specific supply-chain documentation, and mandatory board training under Article 20. A targeted gap analysis identifies exactly what remains. The gap score for ISO 27001-certified organisations typically takes one week to review.

Late or absent incident reporting is itself a compliance failure subject to separate administrative sanctions, independent of the underlying incident. Article 21(2)(b) requires an early warning within 24 hours, a notification within 72 hours, and a final report within one month. eBuilder’s SOC generates the documentation needed to meet all three deadlines.

Three obligations: approve cybersecurity risk-management measures, not just be informed of them; oversee their implementation on an ongoing basis; and personally complete cybersecurity training. The training obligation is individual and cannot be delegated. Board members who cannot produce completion records cannot credibly claim they fulfilled their Article 20 obligations.

Article 21(2)(d) requires every third-party ICT vendor relationship to be risk-assessed, documented and kept current: cloud providers, software vendors, managed service providers, and any supplier with access to your network or data. Contracts must include security requirements, incident-notification obligations, and audit rights. eBuilder’s CISO Advisory builds and maintains this vendor register.

Yes, though the sanction differs by entity type. Under Article 20, management bodies at both essential and important entities are directly responsible for approving and overseeing cybersecurity risk-management measures. For essential entities specifically, national authorities can impose a temporary ban on individuals from holding management positions (Art. 32(5)); important entities instead face binding compliance orders and public disclosure of the infringement. Board members who have not received training cannot credibly demonstrate they fulfilled their Article 20 obligations, regardless of entity type.

Essential entities face proactive ex-ante supervision: MCF can audit before any incident occurs. Fine ceiling up to €10M or 2% of global annual turnover. Important entities face reactive ex-post supervision, triggered after a reported incident. Fine ceiling up to €7M or 1.4% of global annual turnover. Both entity types must implement all ten Article 21 obligations.

Yes. Supervisory powers were activated when the Cybersecurity Act came into force on 15 January 2026. MCF (formerly MSB) can conduct proactive audits of essential entities and reactive audits triggered by an incident or complaint for important entities. The audit programme is active now, not at a future date.

Yes. NIS2 penalties apply for non-compliance with the security obligations themselves, not only when a breach occurs. Failing to implement the required measures, failing to register with MCF, or failing to maintain required documentation are all independently sanctionable. The obligation is to have the programme in place, not merely to avoid incidents.

A cybersecurity breach involving personal data triggers both NIS2 (24-hour early warning to MCF) and GDPR (72-hour notification to IMY) simultaneously: two deadlines, two authorities, one incident. DORA applies to financial entities and takes precedence over NIS2 for ICT risk in that sector. eBuilder addresses all three through a single integrated programme to avoid duplicated effort.

Not automatically. The technical security measures in NIS2 Article 21 and GDPR Article 32 overlap significantly: both require encryption, access controls, breach detection and staff training. However, GDPR adds obligations NIS2 does not cover: consent management, data-subject rights, DPO appointment and data-protection impact assessments. The technical programme eBuilder provides satisfies both regulations’ security requirements.

DORA takes precedence over NIS2 for financial entities; it is sector-specific legislation. DORA adds requirements NIS2 does not include: a Register of Information for all ICT third-party arrangements, TLPT every three years for significant entities, and EBA-aligned incident-classification thresholds. Our CISO Advisory service addresses both through a combined programme.

Most organisations with a mature IT baseline reach demonstrable compliance within 3–6 months. Our process starts with a gap assessment (2–3 weeks), followed by a prioritised remediation roadmap. Services like 24/7 SOC monitoring can be activated within days and immediately satisfy Article 21(2)(b) and (f) obligations. The gap score tells you your specific starting point before you commit to anything.

Our gap assessment takes 2–3 weeks and produces a scored report against all ten Article 21 controls, a prioritised remediation roadmap, and a summary formatted for board distribution. It maps your current state honestly, including what you already have covered, so the remediation plan is proportionate and efficient, not a full rebuild.

Yes, this is the most common deployment model. eBuilder’s MDR/SOC extends your existing team’s capability rather than replacing it. We integrate with your current tooling, provide the 24/7 coverage your team cannot sustain alone, and hand back enriched alerts with documented context. Your team stays in control; we provide the always-on layer Article 21 requires.