SwedenCybersäkerhetslag, Cybersecurity Risk-Management Measures
Cybersäkerhetslag (2025:1506), 2 kap. 3-4 §§
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, essential where the operator is larger than a medium-sized enterprise in an NIS 2 Annex 1 sector and important otherwise (§9); the wider sector classes the Act also reaches (energy, transport, banking, health, drinking water, wastewater, public administration, top-level domain (TLD) registries and DNS providers) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems you use for your operations or to provide your services, and their physical environment, against an incident, at minimum covering risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition/development/maintenance, effectiveness-assessment procedures, basic cyber hygiene and staff training, cryptography and encryption policies, personnel security, access control and asset management, and, where relevant, authentication, secure communications and secure emergency-communication systems.NIST CSF 2.0ID.RA-06NIST CSF 2.0GV.PO-01
- Have the individuals in your management undergo training on these security measures.NIST CSF 2.0PR.AT-02
- Register with the authority the government designates as soon as you can, per Cybersäkerhetsförordning (2025:1507) 5 §, and notify a change in what you registered within 14 days of the change.NIST CSF 2.0GV.OC-03
- Where you are a financial entity already covered by Regulation (EU) 2022/2554 (DORA), expect this duty to give way to that regime's own risk-management rules under Chapter 1 §11.
These lines are LexLint's reading of the law's text. Also read by: Nationellt cybersäkerhetscenter (NCSC), Försvarets radioanstalt (FRA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter 4 §9's sanktionsavgift (sanction fee) is an administrative fine a tillsynsmyndighet imposes directly, appealable to the allmän förvaltningsdomstol (general administrative court) under Chapter 5 §1; the Act creates no criminal offence for a failure to take the Chapter 2 §3 measures, or to train under §4.
Penalty structure
Chapter 4 §10(1) sets the essential-entity ceiling at the higher of 2 percent of the entity's total global turnover for the preceding financial year or an amount in kronor equivalent to EUR 10,000,000; §10(2) sets the important-entity ceiling at the higher of 1.4 percent or an amount in kronor equivalent to EUR 7,000,000, mirroring NIS2 Article 34(4)-(5). Both figures are for a private operator (enskild verksamhetsutövare); §10(3) instead fixes a flat SEK 10,000,000 cap, with no turnover component, for a public-sector operator (offentlig verksamhetsutövare), and the statutory floor for any sanktionsavgift is SEK 5,000.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Split by sector under Cybersäkerhetsförordning (2025:1507) 7-15 §§: for the 'Digital infrastruktur' / 'Digitala leverantörer' (Digital infrastructure / Digital providers) sector, which is where an online marketplace, search engine or social-networking-platform provider is supervised, Post- och telestyrelsen (PTS, the Swedish Post and Telecom Authority) is the competent tillsynsmyndighet (supervisory authority) under Cybersäkerhetslag (2025:1506) Chapter 3; other sectors (energy, transport, banking, health, food and water, public administration, chemicals and manufacturing, and space) are supervised by a different named authority in the same table.
Settledness
- As of
- Guidance link
- https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/tidsplan-for-inforandet-av-cybersakerhetslagen-i-sverige/
- Guidance body
- Nationellt cybersäkerhetscenter (NCSC), Försvarets radioanstalt (FRA)
- Open questions
- Given that Cybersäkerhetsförordning (2025:1507) 37 § 1 lets Post- och telestyrelsen issue further security-measures regulations for its own tillsynsområden, has PTS issued a regulation under that power that sets requirements specific to an online marketplace, search engine or social-networking-platform provider it supervises as a digital provider?
What this law does
Chapter 2 §3 requires a väsentlig (essential) or viktig (important) verksamhetsutövare (operator) to take appropriate and proportionate technical, operational and organisational measures, on an all-hazards basis, to protect the network and information systems it uses for its operations or to provide its services, and their physical environment, against an incident, covering at minimum risk-analysis strategy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development, effectiveness assessment, cyber hygiene and staff training, cryptography, personnel security and access control, and, where relevant, authentication and secure communications.
Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service expressly among the digital providers this duty reaches; under Chapter 1 §9 an operator larger than a medium-sized enterprise in an NIS 2 Annex 1 sector is essential, and an operator that is not essential is important.
Chapter 2 §4 additionally requires the operator's management to undergo training on these measures. Chapter 2 §2 requires the operator to register with the designated authority. Chapter 1 §11 exempts a financial entity already covered by Regulation (EU) 2022/2554 (DORA) from this duty.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .