Frequently asked questions and answers about NIS2
How can we help you with NIS2?
NIS2
- What is the NIS2 Directive/Cybersecurity Act?
NIS2 (Network and Information Security Directive 2) is an EU directive that aims to raise the common level of cybersecurity within the EU. It replaces the previous NIS Directive and places stricter requirements on both private and public organizations.
The directive focuses on:
- systematic and risk-based cybersecurity work
- clearly management responsibility
- requirements for incident reporting
- strengthened requirements for supply chains
- supervision and sanctions
Since it is a directive, it is implemented nationally, in Sweden through Cybersecurity Act.
- What is the Cybersecurity Act?
The Cybersecurity Act is the Swedish implementation of the NIS2 Directive and means that the requirements defined at the EU level become legally binding for organizations in Sweden.
- Which organizations are covered by NIS2?
NIS2 includes organizations that are considered socially important or important for the economy.
This includes, for example:
- energy, transport, healthcare
- financial sector
- digital infrastructure and IT services
- public sector
- certain manufacturing and industrial companies
Organizations are divided into:
- essential entities (stricter supervision)
- important entities
The classification is mainly based on:
- sector
- size
- criticality of the business
- What is the difference between NIS and NIS2?
NIS2 is a further development of the first NIS Directive and involves a clear tightening:
NIS (formerly):
- limited sector coverage
- less demands on management
- less harmonised supervision
NIS2:
- covers more sectors and more organizations
- clear requirement for management responsibility and accountability
- more detailed risk management requirements
- stricter requirements for incident reporting
- imposes sanctions in case of deficiencies
In short: NIS2 makes cybersecurity a business and management issue, not just an IT issue.
- How do I know if my company is covered by NIS2?
To determine if you are covered, you need to analyze three things:
- Sector
Do you belong to a sector that is covered (e.g. energy, finance, IT, public sector)? - Size
Many requirements apply to organizations above a certain size (e.g. medium/large companies). - Criticality
Is your business essential to society or dependent on digital infrastructure?
In practice, this is often done through:
- an initial NIS2 screening/analysis
- dialogue with supervisory authority (in certain cases)
- Sector
- What requirements does NIS2 place on cybersecurity?
NIS2 requires organizations to work systematic, documented and risk-based with cybersecurity.
The core requirements are:
- establish a risk management framework
- implement technical and organizational security measures
- ensure incident management
- work with continuity and resilience
- manage supplier risks
- clarify management's responsibilities
This is close to how an LIS according to ISO 27001 is structured – which is why the standard is often used as a basis.
- What security measures are required under NIS2?
NIS2 does not specify exact technical solutions, but requires organizations to implement ”appropriate and proportionate measures”, including:
- risk management processes
- incident management
- continuity and recovery plans (backup, redundancy)
- access control and authentication
- supply chain security
- education and awareness
The important thing is that measures:
- are risk-based
- documented
- followed up
- What does incident reporting mean according to NIS2?
Organizations must report serious cybersecurity incidents to regulators within defined timeframes.
This means:
- that the organization must have a defined incident process
- that incidents are classified (what is reportable?)
- that reporting takes place within established time windows
- that follow-up and final report are required
This places demands on both:
- technology (detection and logging)
- process (who reports and how)
- What sanctions are there for non-compliance with NIS2?
NIS2 introduces clearer sanction options than before:
- administrative penalty fees
- orders from regulatory authorities
- requirements for action
- in some cases personal responsibility for management
This means that cybersecurity is no longer “voluntary improvement” but regulatory requirement with consequences.
How to prepare for NIS2?
A structured working method is crucial. Common approach:
- Screening – are we covered?
- GAP analysis – what is missing?
- Establish framework (often ISO 27001)
- Implement controls and processes
- Ensure reporting and follow-up
The key is not to implement point solutions but to build a coherent system (LIS).
- How to conduct an NIS2 maturity assessment?
A maturity assessment analyzes how well the organization meets the NIS2 requirements.
It typically includes:
- governance and management
- risk management
- technical controls
- incident management
- supplier management
The result is:
- current situation
- identified gaps
- prioritized action plan
This is often the first step in an NIS2 program.
- How can management work with NIS2?
Management has a central role according to NIS2 and is responsible for:
- to approve risk management measures
- to follow up on cybersecurity work
- to secure resources
- to integrate security into operational management
In practice, this means that:
- Cybersecurity is being lifted from IT to management level
- risks are managed as business risks
- decisions are documented
This is one of the biggest changes compared to previous regulations.
- How does NIS2 affect the supply chain?
NIS2 sets clear requirements for organizations to manage risks in the supply chain.
This means that you must:
- identify critical suppliers
- set security requirements in contracts
- follow up with suppliers
- ensure that third-party risks are managed
This is often one of the most demanding areas of practice, as it involves:
- several parties
- dependencies between systems and services
- need for continuous follow-up