SwedenCybersäkerhetsförordning (2025:1507), Notification Channels and Supervisory Authorities
Cybersäkerhetsförordning (2025:1507), 4-8 §§ och 18 §
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Reporting, Governance
As of .
What it requires
- If you are an operator within a sector that the Cybersäkerhetslag (2025:1506) covers, send your registration notification under chapter 2, section 2 of the Act to the single point of contact (section 5 of the ordinance).NIST CSF 2.0GV.OC-03
- Report incidents under chapter 2, sections 5 to 8 of the Act to the CSIRT unit (section 6 of the ordinance).NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The ordinance creates no offence and sets no penalty of its own; sanctions are those of the Cybersäkerhetslag (2025:1506).
Who enforces it
Enforcement body
The supervisory authority for the operator's sector under section 7 of the ordinance, among them the Post- och telestyrelsen, the Finansinspektionen, the Statens energimyndighet and the Transportstyrelsen.
Settledness
- As of
What this law does
The Cybersäkerhetsförordning (2025:1507) (Cybersecurity Ordinance) was issued by the Government on as supplementary provisions to the Cybersäkerhetslag (2025:1506) and entered into force on , repealing the earlier ordinance (2018:1175) on information security for essential and digital services.
Section 4 brings the state authorities listed in Annex 1 to the ordinance (2022:524) on state authorities' preparedness within the Act, unless they are exempted under chapter 1, section 12 of the Act. Under sections 5 and 6, a notification under chapter 2, section 2 of the Act is made to the single point of contact, and incident reporting under chapter 2, sections 5 to 8 is made to the CSIRT unit.
Section 7 names the supervisory authority for each sector, among them the Post- och telestyrelsen for digital infrastructure, digital providers and ICT service management between businesses, the Finansinspektionen for banking and financial market infrastructure, the Statens energimyndighet for energy and the Transportstyrelsen for transport.
Section 8 also makes the Post- och telestyrelsen the supervisory authority for the county administrative boards and for operators offering domain name registration services. Section 18 requires the supervisory authority to cooperate with the Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection) when handling incidents that are also personal data incidents.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank, is a securities firm or provides telecom services.