Despite increased awareness of cyber threats, many organisations still lack a systematic approach to cybersecurity. Furthermore, according to Cybersäkerhetskollen, the Swedish Civil Contingencies Agency’s tool for measuring cybersecurity maturity in Swedish organisations, the pace of improvement has stalled in several areas.

There is an increasing demand for systematic risk management.

At the same time, the Cybersecurity Act – Sweden’s implementation of the EU’s NIS2 Directive – means that the requirements for public and private sector organisations are increasing. Those covered by the Act must work systematically on risk management, report serious incidents, and manage cyber security risks in the supply chain.

However, legislation does not build capacity.

”Many people feel that the field is so vast and overwhelming that they don’t know where to start,” says Johanna Parikka Altenstedt, acting head of the Digital Security unit at RISE.

She compares the current situation with sustainability efforts to where they stood 15–20 years ago. Since then, sustainability has progressed from its infancy to the point where everyone now has management systems in place and is fully on top of things. Cybersecurity is now set to follow the same path, but Johanna Parikka Altenstedt says we don’t have much time to protect our most valuable assets against cyberattacks.

Lessons can also be learnt from the sustainability transition.

”There, you eventually learnt that you have to start somewhere. You have to prioritise and make up your mind,” says Johanna Parikka Altenstedt.

'Cybersecurity must be integrated into the organisational structure.'

One reason why the pace of improvement has stalled may be that Sweden was relatively late in implementing the NIS2 Directive. Many organisations chose not to start work until the legislation was in place.

'We’ve also been slow to consider how other countries have dealt with the situation. There's no need to reinvent the wheel. Denmark, for example, has produced a checklist for local authorities detailing what they need to do and bear in mind. Here, each local authority has to learn the law independently. That takes time,' says Johanna Parikka Altenstedt.

In many cases, cybersecurity work has been treated as an additional task carried out alongside day-to-day operations, rather than as the business-critical issue it is.

”It’s simply not part of the structure. Cybersecurity must be integrated into organisational structures, becoming part of management teams and boards,” says Johanna Parikka Altenstedt.

”You need to consider issues other than just IT. These may include physical security, personnel matters, access rights, key management, and protection against insider threats. Cybersecurity concerns the entire organisation.”

Essentially, it's about taking a proactive rather than a reactive approach.

”Of course, targeted measures are needed if a serious shortcoming is identified that requires addressing. However, you can’t just patch things up; a systematic approach and continuity are required. This pays off in the long run,” says Johanna Parikka Altenstedt.

The challenge lies in translating legal requirements into practical, long-term cybersecurity work.

For many organisations, the challenge lies not in understanding the requirements, but in translating them into practical, long-term cybersecurity work.

As an independent organisation, RISE can provide cybersecurity assistance tailored to the specific needs of both public and private sector organisations.

”Cybersecurity remains an undefined area of operation for many organisations. That is why we sit down with the client to analyse the situation and carry out a vulnerability assessment. We can then help address any issues that have come to light, with RISE involved every step of the way”, says Johanna Parikka Altenstedt.

As a research institute, RISE has expertise in technology, AI, law, management, and strategic analysis. AI presents both risks and opportunities: while the technology creates new vulnerabilities, it can also be used to detect threats, analyse large volumes of data, and strengthen digital defences.

”We also have certification expertise and can provide training. We have the technical infrastructure of the Cyber Range, where we can carry out advanced exercises. We can collaborate with our clients' IT departments, create a replica of their systems and demonstrate the consequences of an attack. This enables them to determine their response strategy”, explains Johanna Parikka Altenstedt.

She believes that it is easy to become overwhelmed by technology, legal requirements and security measures. Ultimately, however, cybersecurity is about creating organisations that are both resilient and capable of evolving.

”If you take it to its logical conclusion, the safest option would be to stop running any operations. But that is obviously not the aim. Our goal is to be able to carry out operations, produce goods, and maintain a functioning society, all while ensuring that we are adequately protected.”

"The background to NIS2 is a major need for coordination across national borders, particularly for companies operating in several countries. It became clear that different countries were handling cybersecurity in different ways," says Johanna Parikka Altenstedt, lawyer and coordinator of Cybernode (the EU's national competence community for cybersecurity, which in Sweden is hosted by RISE). She continues:

"To create an understanding that extends beyond our national borders – because malicious code doesn't stop at one country, it spreads to the neighbours too – the EU passed the NIS Directive in 2016."

How NIS2 is being implemented through the Swedish Cybersecurity Act

NIS2 is an expansion of its predecessor NIS, strengthening the protection of essential services and extending the scope to 18 sectors (see fact box) affected by the new requirements. As a rule, NIS2 applies to companies with at least 50 employees or an annual turnover of at least 10 million euros. Certain operations, such as providers of critical internet infrastructure, are covered regardless of size. In a fact box further down in the article, you will find more information on whether NIS2 applies to you.

"This is a broad directive spanning so many industries that essentially every company with more than 50 employees should investigate whether they are affected. The risks of failing to act, when you are actually required to, are considerable," says Johanna Parikka Altenstedt, who is also acting head of the Centre for Cybersecurity at RISE.

She explains why NIS2 became a directive rather than a regulation, and why that matters.

"NIS2 is the result of a compromise between the member states. Some wanted NIS2 to be a regulation, which would have meant the law being directly binding in all EU countries at the same time. Instead, it became a directive, so each country has some flexibility to adapt the requirements to its own legal system," explains Johanna Parikka Altenstedt.

In Sweden, NIS2 has been implemented through the Cybersecurity Act, which came into force on 15 January 2026. The Act is specified in the Cybersecurity Regulation, which regulates how supervision should be carried out and how reporting should take place.

At the time of writing this article, in February 2026, the supervisory authorities, the Swedish Civil Contingencies Agency (formerly MSB) and the Swedish Post and Telecom Authority, are establishing detailed regulations that further specify how the legal requirements are to be met. In short, it is a three-step process that converts NIS2 into Swedish requirements.

What is most important for doing the right thing – and where should one begin?

"That's an excellent question! You need to analyse your business and really get down to the nitty-gritty. What is the most essential thing you do that creates societal value? That's what you need to protect", says Johanna Parikka Altenstedt.

A risk analysis and a gap analysis (a strategic method for identifying the difference between the current situation and the desired target situation) help to identify threats and security gaps. RISE can help companies and organisations to carry out this type of analysis.

"Employees shouldn't have to worry about national security; it's more about protecting their own work. If you've been working on a project for two years and have built up a collection of large Excel spreadsheets, it's not fun if malware gets in. That's why it's a good idea to have a backup. By going down to the team and individual level, it becomes easier to motivate employees to work more cyber securely", says Johanna Parikka Altenstedt.

A management responsibility: cyber security cannot be delegated

Management responsibility is a central part of NIS2 and thus also of the Cybersecurity Act. It is not possible to delegate responsibility for cybersecurity or view compliance as just another IT project among many others.

If management has not decided on appropriate measures or followed up on known deficiencies, this may result in penalty fees. Persons in management positions may also be held personally liable for regulatory violations, through temporary bans on CEO or board assignments in NIS2-covered operations.

RISE trains management teams in NIS2 to help companies and their management teams tackle the new regulations with a solid knowledge base. The next step could be to put their products and services under the microscope in RISE's Cyber Range test and demonstration environment, or to certify their information security management system.

NIS2 and cybersecurity – primarily a question of people

Johanna Parikka Altenstedt points out that people generally think that cyber security issues are primarily about technology. That misses the point, she says.

"People start with technical firewalls, when what they really need are human firewalls. I usually talk about the four cornerstones of cyber security. The first is that people working in the organisation are knowledgeable about cyber security issues at their level. Some are super experts, while others have basic cyber hygiene – but everyone has the knowledge. It's also important to consider cybersecurity when departments are eager to create or order new digital products and solutions", says Johanna Parikka Altenstedt.

The second cornerstone is safety culture. There needs to be an open atmosphere so that people dare to speak up when something goes wrong. An employee who is afraid of making mistakes and risking sanctions will not speak up when something goes wrong. And that poses a major risk to the entire organisation.

The third cornerstone is compliance. This is where NIS2 and the Swedish Cybersecurity Act come into play. Only then, as the fourth cornerstone, does technology come into play.

“A clear regulatory framework is fairer”

Johanna Parikka Altenstedt believes that everyone covered by the rules discussed in this article should view the regulations as a tool for protecting what is worth protecting.

"Some people think that there are so many rules from the EU that it slows down business development. That is not the view we hear at Cybernoden. A clear set of rules to follow is better and fairer than an unregulated market", says Johanna Parikka Altenstedt.

She also points out that the EU's cybersecurity regulations are largely based on the same fundamental principles:

• A risk-based approach.
• A thorough analysis of your own operations, including both IT and OT (Operational Technology).
• Clear responsibility for cyber security, including requirements for suppliers and others who depend on socially important activities.
• An established cyber security management system with procedures for handling incidents and ensuring continued operation.

"If you have already done this work, for example within the framework of ISO 27000 or IEC 62443 certifications, it goes a long way regardless of which regulatory framework we are talking about," she says.