NIS2 is here – is your organisation ready?

In Sweden, NIS2 has been implemented through the Cybersecurity Act, which came into force on 15 January 2026. The Act is specified in the Cybersecurity Regulation, which regulates how supervision should be carried out and how reporting should take place.

At the time of writing this article, in February 2026, the supervisory authorities, the Swedish Civil Contingencies Agency (formerly MSB) and the Swedish Post and Telecom Authority, are establishing detailed regulations that further specify how the legal requirements are to be met. In short, it is a three-step process that converts NIS2 into Swedish requirements.

What is most important for doing the right thing – and where should one begin?

"That's an excellent question! You need to analyse your business and really get down to the nitty-gritty. What is the most essential thing you do that creates societal value? That's what you need to protect", says Johanna Parikka Altenstedt.

A risk analysis and a gap analysis (a strategic method for identifying the difference between the current situation and the desired target situation) help to identify threats and security gaps. RISE can help companies and organisations to carry out this type of analysis.

"Employees shouldn't have to worry about national security; it's more about protecting their own work. If you've been working on a project for two years and have built up a collection of large Excel spreadsheets, it's not fun if malware gets in. That's why it's a good idea to have a backup. By going down to the team and individual level, it becomes easier to motivate employees to work more cyber securely", says Johanna Parikka Altenstedt.

A management responsibility: cyber security cannot be delegated

Management responsibility is a central part of NIS2 and thus also of the Cybersecurity Act. It is not possible to delegate responsibility for cybersecurity or view compliance as just another IT project among many others.

If management has not decided on appropriate measures or followed up on known deficiencies, this may result in penalty fees. Persons in management positions may also be held personally liable for regulatory violations, through temporary bans on CEO or board assignments in NIS2-covered operations.

RISE trains management teams in NIS2 to help companies and their management teams tackle the new regulations with a solid knowledge base. The next step could be to put their products and services under the microscope in RISE's Cyber Range test and demonstration environment, or to certify their information security management system.

NIS2 and cybersecurity – primarily a question of people

Johanna Parikka Altenstedt points out that people generally think that cyber security issues are primarily about technology. That misses the point, she says.

"People start with technical firewalls, when what they really need are human firewalls. I usually talk about the four cornerstones of cyber security. The first is that people working in the organisation are knowledgeable about cyber security issues at their level. Some are super experts, while others have basic cyber hygiene – but everyone has the knowledge. It's also important to consider cybersecurity when departments are eager to create or order new digital products and solutions", says Johanna Parikka Altenstedt.

The second cornerstone is safety culture. There needs to be an open atmosphere so that people dare to speak up when something goes wrong. An employee who is afraid of making mistakes and risking sanctions will not speak up when something goes wrong. And that poses a major risk to the entire organisation.

The third cornerstone is compliance. This is where NIS2 and the Swedish Cybersecurity Act come into play. Only then, as the fourth cornerstone, does technology come into play.

“A clear regulatory framework is fairer”

Johanna Parikka Altenstedt believes that everyone covered by the rules discussed in this article should view the regulations as a tool for protecting what is worth protecting.

"Some people think that there are so many rules from the EU that it slows down business development. That is not the view we hear at Cybernoden. A clear set of rules to follow is better and fairer than an unregulated market", says Johanna Parikka Altenstedt.

She also points out that the EU's cybersecurity regulations are largely based on the same fundamental principles:

• A risk-based approach.
• A thorough analysis of your own operations, including both IT and OT (Operational Technology).
• Clear responsibility for cyber security, including requirements for suppliers and others who depend on socially important activities.
• An established cyber security management system with procedures for handling incidents and ensuring continued operation.

"If you have already done this work, for example within the framework of ISO 27000 or IEC 62443 certifications, it goes a long way regardless of which regulatory framework we are talking about," she says.