NIS2 and the Swedish Cybersecurity Act

The EU cybersecurity directive, implemented in Swedish law with MSB as supervisory authority

NIS2 is the EU's cybersecurity directive, implemented in Sweden through the Cybersecurity Act with MSB as the supervisory authority. It's the framework most OptiTech customers start with, and the one OptiTech covers deepest: requirements and controls are built from the Swedish legal text and MSB regulations (MSBFS), not from a translated mapping.

Who it applies to

More than 10,000 Swedish companies across 18 sectors, plus their suppliers. Many companies are covered without knowing it, because they supply energy companies, healthcare, municipalities, transport, or other regulated customers rather than operating in a regulated sector themselves.

The law divides covered organizations into essential and important entities, with different levels of supervision. OptiTech's gap analysis tells you which category you fall into and why.

What OptiTech provides

  • Automatic scoping: 20 questions determine whether the law applies and which entity category you are
  • Requirements and controls from the source: built from the Swedish legal text and MSBFS, updated automatically when the rules change
  • The full incident reporting flow: early warning to MSB within 24 hours, incident report within 72 hours, and final report within one month, with pre-filled forms, deadline countdowns, and communication templates
  • Board reports: NIS2 requires your board to show active governance. One click produces the proof.
  • Supply chain controls: vendor requirements and questionnaires for the suppliers the law makes you responsible for

Deadlines and sanctions

Sanctions reach 10 million euros or 2 percent of global revenue, whichever is higher. Boards and management carry personal liability for the governance duty, which is why the NIS2 board training add-on exists.

Cross-mapping

The controls you build for NIS2 carry over: most of ISO 27001 is typically satisfied by a working NIS2 program, and the continuity requirements overlap with ISO 22301. When CRA reaches product companies, it starts from the same foundation.

Get started

NIS2 is available on every plan, including Start. Book a free gap analysis to see your entity category and your gaps, or compare plans.

Need help?

Join our Discord Server to ask questions or see what others are doing with OptiTech. For paid plan support options, see Support.

Was this page helpful?