Cybersecurity for the Swedish Public Sector

Yes. All Swedish municipalities and regions are covered by Cybersäkerhetslagen (SFS 2025:1506) in force since 15 January 2026. Unlike the EU NIS2 Directive, Sweden extended the scope to include all municipalities regardless of size. Kommunalförbund and agencies within the 18 sectors are also in scope with MCF (formerly MSB) as the supervisory authority for most public sector organisations.

MDR is a 24/7 service that detects, investigates and responds to active threats. IT support keeps systems running; MDR keeps attackers out. Most municipalities have strong IT teams managing infrastructure and user support but typically lack a dedicated SOC watching for threats at 2am on a Saturday. Our Sweden-based SOC monitors endpoints, identities and cloud with a named analyst who responds within minutes.

Essential entities face penalties of up to €10 million or 2% of global annual turnover. Important entities face up to €7 million or 1.4%. Beyond financial penalties, supervisory authorities can issue binding corrective instructions and apply to a court to prohibit a senior manager from exercising management functions which makes cybersecurity a board-level issue.

Once onboarding access and approvals are in place, most municipalities are live in our 24/7 SOC within 72 hours. Sensors deploy silently on day zero through your existing MDM with no user interruption. Days one and two involve behaviour baselining. By hour 72, your environment is active, a named analyst is assigned and escalation runbooks are written for your organisation.

Security logs and telemetry are processed in Sweden-based infrastructure, aligned with GDPR and Schrems II requirements. This is a contractual commitment, not a marketing claim. eBuilder Security does not route your data through US-based infrastructure and our ISO 27001 certified SOC provides independently audited evidence of our practices.

MDR is priced per endpoint per month with a fixed monthly fee. There are no hidden charges for incident response, analyst escalation or alert volume. The per-endpoint model makes costs predictable for public sector budget cycles. We provide a clear written proposal after the initial 30-minute briefing with no obligation.

When the contract ends, all security telemetry and log data is deleted within a defined retention period set out in the Data Processing Agreement. You receive written confirmation of deletion and no data is retained for any other purpose. The full offboarding process is documented in the service agreement and available for review before you sign.

Article 21 requires ten specific measures covering risk management, incident handling, business continuity, supply chain security, access control, encryption and staff training. Management bodies must approve these measures, oversee implementation and complete cybersecurity training. eBuilder Security maps all Article 21 requirements to its services so you have documented evidence for your supervisory authority.

It means a human analyst has detected, investigated and begun containing a real threat within 2m 50s of it occurring in your environment. This is not an automated alert. A trained analyst confirms the threat, isolates the affected host if necessary and notifies your team. The global industry average dwell time is around 11 days.

No. MDR onboarding is silent and has no impact on staff, systems or citizen-facing services. Sensors deploy through your existing MDM with no user notifications, no restarts and no changes to business applications. This matters where disruption to healthcare booking, social services or municipal e-services has real consequences for citizens.

Yes. We have experience supporting Swedish public sector procurement under LOU and can help before during and after your tender process. We help define skall-krav and bör-krav so your tender evaluates real security capability and provide service descriptions, NIS2 mapping, ISO 27001 certification and reference contacts. We recommend contacting us before you publish your tender.

Larger platforms are built for enterprise corporations, not Swedish municipalities. We are Sweden-based, Swedish-speaking and have worked with the public sector since 2003. Your data stays in Sweden, your analyst knows your environment by name and our service is sized for teams that cannot build a 24/7 operation internally. We also understand Swedish procurement and MCF reporting obligations.