NIS2 – Support for compliance with the new Cybersecurity Act

We help Swedish organisations meet the NIS2 requirements. Gap analysis, risk management, policies and training in accordance with the new Cybersecurity Act.

NIS2 – the EU’s new cybersecurity law that raises the requirements for the entire organisation.

In Sweden, the NIS2 Directive will become a new Cybersecurity Act from 2026, representing a significant increase in expectations for how organisations must work with information and cybersecurity. More sectors will be covered, leadership accountability will be strengthened, and the requirements for risk management, governance and incident reporting will become considerably clearer.

At Cyber Defencely, we help organisations translate the NIS2 requirements into practical, long-term security work — not only through technology, but through structures, processes and behaviours that endure over time.

Cyber Defencely söker passionerade experter med minst 10 års erfarenhet inom informations- och cybersäkerhet.

Are you ready for NIS2?

Take our free AI-powered self-assessment and receive a quick report on how prepared your organisation is for the Cybersecurity Act.

To the Assessment

Contact us for advice

Want to know how NIS2 affects your organisation?

Contact us for advice or for more information about how we can help strengthen your organisation ahead of the Cybersecurity Act.

Contact us

Developed with support from NCC-SE and MSB.

“That the tool provides immediate feedback with clear priorities while also presenting the overall maturity level in a simple way is a major advantage. It means that a report which would otherwise take two to four weeks to produce can now be completed in a single day.”

Information Security Coordinator at a Swedish municipality

“Really impressive observations and recommendations! With this structure, the report provides real added value for the client. I also appreciate the conclusions with both short- and long-term recommendations.”

IT security consultant with many years of industry experience

How we can help you!

Why choose Cyber Defencely?

Experienced specialists in NIS2 and cybersecurity – we have already helped organisations in several sectors meet the requirements of NIS1, manage supervisory reviews, interpret NIS2 obligations, set contractual requirements, and interpret and respond to tender requirements.
Holistic perspective – we take the entire organisation into account and develop solutions that work as a whole, at every level from strategic to operational, and are sustainable over time.
Our own methodology for effective capability improvement – resulting in solutions that meet legal requirements and follow industry standards such as ISO/IEC 27001.
From analysis to implementation and supervision – we support you all the way and whenever needed, including during audits, regulatory oversight, and reviews by clients or partners.

Tangible value from day one.

Our NIS2 specialists help you move from uncertainty to clear decisions, documented processes, and practical, implemented measures.

You gain:

A short ramp-up time
Expertise that complements your own teams
Rapid risk reduction
Structure and a holistic view of information security
Support that immediately strengthens your digital resilience

How we help you meet the NIS2 requirements

NIS2 advisory and information security specialist services

Strengthen your cybersecurity and meet the NIS2 requirements with support from experienced specialists.
We provide advisory services, analysis and implementation support for NIS2 and the new Cybersecurity Act (CSL) — tailored for organisations that need fast, concrete expertise integrated directly into their operations.

A fast path to NIS2 compliance

With increased requirements on leadership, risk management, incident reporting and supply chain security, a systematic and risk-based approach is essential to meet the NIS2 Directive. Our consultants help you:

Train management and employees in cybersecurity and NIS2
Map your current state and deviations from NIS2
Identify which parts of the organisation are in scope
Create an action plan to meet legal requirements
Establish processes for risk analysis, incident handling and continuity
Strengthen governance, follow-up and leadership accountability

Specialised information security consultants

You gain access to experts with extensive experience in:

Information Security Management Systems (ISMS/ISO 27001)
Cybersecurity strategy and governance
Security architecture and risk assessment
Supplier and third-party risks
Incident handling and reporting processes
Secure development and technical security controls

We work close to your operations to ensure your security measures are proportional, effective and relevant — in line with NIS2 and the upcoming Swedish regulations.

Ready to start your NIS2 journey?

Whether you need NIS2 implementation, executive advisory support or temporary reinforcement in a project, our experts are ready to help you achieve compliance and build long-term, sustainable cybersecurity capabilities.

Frequently Asked Questions about NIS2 / the Cybersecurity Act

What does the NIS2 Directive mean?

NIS2 stands for the Network and Information Security Directive (the second version of NIS) and is the EU’s new cybersecurity directive, which in Sweden will be implemented through a new Cybersecurity Act.

It replaces the previous NIS Directive and covers more sectors and entire organisations to a much greater extent than before.

The main changes include:

Significantly more organisations are included – more sectors and organisations, both private and public, are affected by the regulations (including subcontractors).
Stricter security requirements – clear requirements for systematic work with risk management, incident management, business continuity, supply chain security and technical security measures.
Clearer obligations and stronger sanctions – executive management receives explicit responsibility for cybersecurity, with mandatory incident reporting within defined timeframes and the possibility of high administrative fines for non-compliance.

Who is covered by NIS2 in Sweden?

Organisations within 18 designated sectors – for example energy, transport, healthcare, drinking water, wastewater, food, banking/finance, digital infrastructure, public administration, ICT services and more.
Both public and private entities that provide services in Sweden and meet certain size criteria (normally at least 50 employees or ≥10 million euros in turnover/balance sheet total, with higher thresholds for “essential” entities).
Essential and important entities – the category depends on the sector’s criticality and the organisation’s size/importance; the requirements are largely the same, but supervision and sanctions differ.
Suppliers and subcontractors that must comply with NIS2 requirements because their customers are required to do so.

What happens if an organisation does not comply with NIS2?

Failure to comply may lead to sanctions of up to 10 million euros or 2% of global turnover, as well as individual liability for executive management.

There is also a risk of business disruption, financial losses, and loss of trust.

When does NIS2 take effect?

NIS2 will be implemented in Sweden through a new Cybersecurity Act proposed to enter into force on 15 January 2026. Many of the requirements demand long-term preparation — start now to avoid stress and misaligned priorities.