SwedenCybersäkerhetslag, Incident Notification
Cybersäkerhetslag (2025:1506), 2 kap. 5-10 §§
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a väsentlig (essential) or viktig (important) verksamhetsutövare under a medium-or-large size gate; Chapter 1 §7(1) names a provider of cloud services, data-centre services, content-delivery networks, outsourced operational or security services, an online marketplace, a search engine or a social-networking-platform service among the digital providers the Act reaches, for the reason given on this jurisdiction's companion risk-management row.
- Inform the authority the government designates (in practice the computer security incident response team (CSIRT)-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it.NIST CSF 2.0RS.CO-02
- Follow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware.NIST CSF 2.0RS.CO-02
- On the authority's request, submit an interim report with relevant status updates on the significant incident.NIST CSF 2.0RS.CO-03
- No later than one month after your incident notification, submit a final report; if the significant incident is still ongoing at that point, submit a progress report instead and a final report within one month after you have resolved it.NIST CSF 2.0RS.CO-03
- Where appropriate, inform your service recipients, as soon as you can, of a significant incident likely to adversely affect the service you provide to them.NIST CSF 2.0RS.CO-02
- For a significant cyber threat, inform affected service recipients, as soon as you can, of the protective and remedial measures they can take, and, where appropriate, of the threat itself.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Nationellt cybersäkerhetscenter (NCSC), Försvarets radioanstalt (FRA) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter 4 §9's sanktionsavgift (sanction fee) for a failure to notify, drawn from Chapter 4 §1 read with Chapter 2 §§5-8, is an administrative fine a tillsynsmyndighet imposes directly, appealable to the allmän förvaltningsdomstol under Chapter 5 §1; the Act creates no criminal offence for a missed or false notification.
Penalty structure
Chapter 4 §10(1) sets the essential-entity ceiling at the higher of 2 percent of the entity's total global turnover for the preceding financial year or an amount in kronor equivalent to EUR 10,000,000; §10(2) sets the important-entity ceiling at the higher of 1.4 percent or an amount in kronor equivalent to EUR 7,000,000, mirroring NIS2 Article 34(4)-(5). Both figures are for a private operator (enskild verksamhetsutövare); §10(3) instead fixes a flat SEK 10,000,000 cap, with no turnover component, for a public-sector operator (offentlig verksamhetsutövare), and the statutory floor for any sanktionsavgift is SEK 5,000.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Notification itself is submitted to Försvarets radioanstalt (FRA), acting as the CSIRT-enhet under Cybersäkerhetsförordning (2025:1507) 6 § and 31 §; a sanction for a failure to notify is imposed by the sector's own tillsynsmyndighet under Cybersäkerhetslag (2025:1506) Chapter 3-4, which for the 'Digital infrastruktur' / 'Digitala leverantörer' (Digital infrastructure / Digital providers) sector, an online marketplace, search engine or social-networking-platform provider, is Post- och telestyrelsen (PTS) per Cybersäkerhetsförordning 7 §.
Settledness
- As of
- Guidance link
- https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/tidsplan-for-inforandet-av-cybersakerhetslagen-i-sverige/
- Guidance body
- Nationellt cybersäkerhetscenter (NCSC), Försvarets radioanstalt (FRA)
- Open questions
- Given that Cybersäkerhetsförordning (2025:1507) 37 § 2 lets Post- och telestyrelsen further define what counts as a betydande incident (significant incident) for its own tillsynsområden, has PTS issued a regulation under that power that sets a threshold specific to a digital provider's own incidents?
What this law does
Chapter 2 §5 requires a väsentlig or viktig verksamhetsutövare to inform the designated authority of a significant incident (betydande incident) as soon as it can and no later than 24 hours after becoming aware of it; an incident is significant if it has caused or could cause serious operational disruption or financial loss, or has affected or could affect other persons by causing significant harm.
Chapter 2 §6 requires the operator to follow with a formal incident notification, within 24 hours of awareness for a trust service provider and within 72 hours for others; §7 requires an interim status report on the authority's request, and §8 requires a final report within one month of the notification, or a progress report followed by a final report within a month of resolution if the incident is still ongoing.
Chapter 2 §9-10 add duties to inform affected service recipients, where appropriate, of a significant incident and of protective measures against a significant cyber threat. This is NIS2 Article 23's own clock. Cybersäkerhetsförordning (2025:1507) 6 § directs incident reporting under Chapter 2 §§5-8 to the computer security incident response team (CSIRT)-enhet. Section 31 of that Förordning makes Försvarets radioanstalt the CSIRT-enhet.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .