Handles health records, in Sweden

Cybersäkerhetsförordning (2025:1507), 4-8 §§ och 18 § · Read the law's page

• If you are an operator within a sector that the Cybersäkerhetslag (2025:1506) covers, send your registration notification under chapter 2, section 2 of the Act to the single point of contact (section 5 of the ordinance).
• Report incidents under chapter 2, sections 5 to 8 of the Act to the CSIRT unit (section 6 of the ordinance).

Cybersäkerhetslag (2025:1506), 2 kap. 3-4 §§ · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.
• Have the individuals in your management undergo training on these security measures.
• Register with the authority the government designates as soon as you can, per Cybersäkerhetsförordning (2025:1507) 5 §, and notify a change in what you registered within 14 days of the change.
• This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, essential where the operator is larger than a medium-sized enterprise in an NIS 2 Annex 1 sector and important otherwise (§9); the Act also reaches an operator in an NIS 2 Annex 1 or 2 sector (for example energy, transport, banking, health, drinking water or wastewater) that is established in Sweden and is at least a medium-sized enterprise (§4), an operator meeting a criticality test in §5, a provider of public electronic communications networks or services (§6), a TLD registry, DNS provider or domain-name registration service (§7), and certain state authorities, regions and municipalities (§§3, 8). Coverage follows from those criteria, not from a declaration, and the registration duty in Chapter 2 §2 falls on an operator already covered.
• Where you are a financial entity already covered by Regulation (EU) 2022/2554 (DORA), expect this duty to give way to that regime's own risk-management rules under Chapter 1 §11.

Cybersäkerhetslag (2025:1506), 2 kap. 5-10 §§ · Read the law's page

• This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, for the reason given on this jurisdiction's companion risk-management row.
• Inform the authority the government designates (in practice the CSIRT-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it.
• Follow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware.
• On the authority's request, submit an interim report with relevant status updates on the significant incident.
• No later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it.
• Where appropriate, inform your service recipients, as soon as you can, of a significant incident likely to adversely affect the service you provide to them.
• For a significant cyber threat, inform affected service recipients, as soon as you can, of the protective and remedial measures they can take, and, where appropriate, of the threat itself.