SwedenLag (2024:1278), DORA Supplementary Provisions
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a financial entity within Regulation (EU) 2022/2554 (DORA) supervised in Sweden, comply with DORA as the Act supplements it; the Finansinspektionen is your competent authority and supervises compliance (chapter 1, section 2, and chapter 3, section 1).NIST CSF 2.0GV.OC-03
- If the Finansinspektionen designates you to carry out threat-led penetration tests under DORA Article 26, carry them out as often as it decides, and give the Riksbank the information it requests for its oversight and coordination of the tests (chapter 2, sections 1 and 4).NIST CSF 2.0ID.IM-02NIST CSF 2.0GV.OC-03
- Provide the Finansinspektionen with the information and documents it orders, attend a hearing it summons you to, and allow it to inspect your premises when necessary for supervision (chapter 3, sections 2 and 3).NIST CSF 2.0GV.OC-03
- Pay the annual fee that funds the Finansinspektionen's work under DORA and the Act (chapter 1, section 3).no control in the NIST CSF 2.0
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.IM-02Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's sanctions are interventions and administrative sanction fees imposed by the Finansinspektionen; it creates no criminal offence.
Penalty structure
Chapter 4, section 14 sets the maximum fee for a legal person at the highest of the krona equivalent of EUR 1,000,000 on , 10 percent of turnover in the preceding financial year, and three times the profit made from the breach where it can be determined; the fee is not set below SEK 5,000. The ceiling is the highest of the three, so the turnover figure is one of three limbs and not the only cap.
- Rule
- Turnover pct only
- As of
- Minimum
- 5,000
- Currency
- SEK
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Finansinspektionen (the Swedish Financial Supervisory Authority), the competent authority under chapter 1, section 2, with the Riksbank coordinating threat-led penetration tests under chapter 2, section 2.
Settledness
- As of
What this law does
The Lag (2024:1278) med kompletterande bestämmelser till EU:s förordning om digital operativ motståndskraft för finanssektorn (Act with supplementary provisions to the EU regulation on digital operational resilience for the financial sector) supplements Regulation (EU) 2022/2554 (DORA), and entered into force on .
Chapter 1, section 2 makes the Finansinspektionen the competent authority under DORA Article 46, and section 4 has it inform the Riksbank of major ICT-related incidents under DORA Article 19.6. Chapter 2 has the Finansinspektionen decide which financial entities carry out threat-led penetration tests under DORA Article 26 and how often, and has the Riksbank oversee and coordinate the tests and issue the attestations.
At the Riksbank's request, financial entities must provide the information it needs for its work with the tests, and the Riksbank may order them to comply. The Finansinspektionen supervises financial entities' compliance with DORA and the Act, may order any person to provide information and documents or to attend a hearing, and may inspect an entity's premises when necessary for supervision.
The maximum administrative sanction fee for a legal person that is a financial entity listed in chapter 4, section 1 is the highest of the krona equivalent of EUR 1,000,000 on , 10 percent of the previous financial year's turnover, and three times the profit made from the breach where it can be determined.
When LexLint raises it
When your app profile says your app provides financial services.