Skip to content
All articles

Regulation · · 7 min read

The Swedish Cybersecurity Act and NIS2: what does it mean for small and medium-sized businesses?

Who is covered, what the law requires and why businesses outside its scope are affected through their customers.

Värn

Editorial team

Four colleagues talking in front of two laptops in a meeting room with a city view

On 15 January 2026, the Swedish Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) came into force. It implements the EU's NIS2 Directive in Swedish law and replaces the earlier NIS Act. For many businesses, the question since then has been the same: does this apply to us?

For the smallest businesses, the answer is more often no than yes – but that does not mean the law is irrelevant to them.

Who is covered?

The law applies to organisations in a large number of sectors, including energy, transport, banking and financial market infrastructure, health care, drinking water and waste water, digital infrastructure, ICT service management, public administration, postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

The main rule is that the law covers medium-sized and large companies in these sectors – in the EU's definition, at least 50 employees or an annual turnover and balance sheet total above 10 million euros. Some organisations are covered regardless of size, for example providers of DNS services and certain public bodies.

Always check your own situation

If you are unsure whether you are covered, read the text of the law and the guidance from the authority that supervises your sector. This article is an overview, not legal advice.

What does the law require?

For those who are covered, there are four main obligations:

  1. Risk management measures. Appropriate technical and organisational measures to manage risks to network and information systems. The NIS2 Directive lists, among other things, risk analysis, incident handling, business continuity and backups, supply chain security, vulnerability handling, basic cyber hygiene and training, encryption, access control and multi-factor authentication.
  2. Incident reporting. Significant incidents must be reported in several steps. The directive sets out an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
  3. Management responsibility. Management must approve and follow up the measures and have sufficient knowledge of cybersecurity themselves.
  4. Registration. Organisations that are covered must register with the supervisory authority.

The NIS2 Directive states that administrative fines must be able to reach at least 10 million euros or 2 per cent of global annual turnover for essential entities, and at least 7 million euros or 1.4 per cent for important entities.

Why are businesses that are not covered still affected?

This is where it gets interesting for smaller businesses. One of the risk management measures is supply chain security. Those covered by the law have to set requirements for their suppliers – and that is already showing in procurements and contracts.

If you are a subcontractor to a municipality, an energy company, a healthcare provider or a larger manufacturer, you can expect questions such as:

  • How do you handle vulnerabilities and security updates?
  • Do you use multi-factor authentication?
  • How do you protect your email against spoofing?
  • Can you show documentation of your security work?

Businesses that can answer clearly – with evidence – have an advantage.

Five things to do now

  1. Take stock. Which domains, websites and services do you have? Who is responsible for them? An up-to-date asset inventory is the foundation of all risk management.
  2. Introduce multi-factor authentication for email, administrator accounts and remote access.
  3. Secure your email with SPF, DKIM and DMARC – see our guide SPF, DKIM and DMARC explained.
  4. Watch what is visible from the outside. Certificates, security settings and exposed accounts change over time. Continuous monitoring catches changes before they become incidents.
  5. Document. Write down what you check, what you find and what you do about it. Documentation is often what decides an audit.

How Värn can help

Värn does not replace a risk analysis or a management system, but it gives you evidence for several of the points above: an inventory of verified domains, continuous checks of external configuration, prioritised findings with remediation steps and time-stamped reports that show what has been done. The reports include a mapping to NIS2, GDPR and ISO/IEC 27001 for guidance.

More articles