On this page
- Find out if you're in scope
- Register your organisation
- Get management on board
- Run a gap analysis
- Implement the ten baseline security measures
- Set up incident reporting routines
- Review your supply chain
- Train staff on an ongoing basis
- Document everything
- Keep it alive
- Risk analysis checklist
- Frequently asked questions
- 01
Find out if you're in scope
Check your sector against the 18 sectors covered by the Cybersecurity Act, and your size (medium/large). Not sure? Take our 1-minute self-test for a quick indication.
Done when: you have a documented decision on whether you are covered, and if so as essential or important. Group companies and partner enterprises count towards your size.
- 02
Register your organisation
Essential and important entities must register with the National Cybersecurity Center (NCSC), no later than 14 days after the obligation arises. Registration is sent encrypted to nis2anmalan@ncsc.se, and NCSC confirms receipt within two business days.
Done when: the notification has been sent and NCSC's confirmation is saved.
- 03
Get management on board
The board must approve the risk-management measures and undergo cybersecurity training - and can be held personally liable for gross negligence. Start there, not in the IT department.
Done when: the board's approval of the risk management measures is minuted and management has completed training.
- 04
Run a gap analysis
Map your current state against Article 21's ten requirements (next step) to see where the biggest gaps are before spending time on the wrong things.
Done when: you have a list of gaps per requirement, prioritised by risk.
- 05
Implement the ten baseline security measures
Risk analysis and policies, incident handling, business continuity planning, supply chain security, security in system acquisition and maintenance, effectiveness evaluation, cyber hygiene and training, cryptography, personnel security and access control, and multi-factor authentication.
Done when: every measure has an owner, a documented level and a follow-up date.
- 06
Set up incident reporting routines
Three deadlines to be able to meet: early warning within 24 hours, formal notification within 72 hours, a final report within one month. Build the routine before you need it, not during an active incident.
Done when: there is a written procedure with contact routes and templates, and it has been rehearsed at least once.
- 07
Review your supply chain
Your suppliers and subcontractors need to maintain a reasonable security level - you're responsible for keeping track of that, not just your own environment.
Done when: you have a list of critical suppliers and the security requirements in their contracts.
- 08
Train staff on an ongoing basis
Cybersecurity training is a recurring requirement, not a one-off - for both management and staff generally.
Done when: there is a training plan and saved evidence of completed training.
- 09
Document everything
You need to be able to show your risk analysis, policies, training records, and incident logs during supervision - not just have done the work, but be able to prove it.
Done when: the documents are kept in one place and can be produced during supervision.
- 10
Keep it alive
The Cybersecurity Act is new, and the regulatory structure has already changed once since it came into force. Book a recurring check-in, not a one-off review.
Done when: there is an annual plan with a date for the next review.
Risk analysis checklist
The risk analysis underpins most other requirements. It does not need to be complicated, but it must be documented and recurring.
- Map the systems, services and information your organisation depends on.
- Identify threats to them, such as intrusions, outages, mistakes and supplier problems.
- Assess likelihood and impact for each threat.
- Note which safeguards already exist and how well they work.
- Decide on measures, with an owner and a date for each.
- Repeat the analysis regularly and whenever the organisation or threat landscape changes.
Frequently asked questions
Does the checklist apply if we are not covered by the law ourselves?
Not directly. But if your customers are covered, they may place similar requirements on you as a supplier, so the steps on risk analysis, incident procedures and documentation are often relevant anyway. Read more in the guide on NIS2 requirements for suppliers.
How do we know which sector we belong to?
Compare your operations with the 18 sectors in the Swedish Cybersecurity Act. Size decides together with sector, and regions, municipalities and municipal associations are covered regardless of size. See the guide on which sectors are covered.
What is the difference between NIS2 and the Cybersecurity Act?
NIS2 is the EU directive. The Cybersecurity Act (cybersäkerhetslagen) is the Swedish law that implements it, in force since 15 January 2026. The law is what you must comply with.
Want to do it digitally instead?
This checklist can be run in Excel and email - or in a platform that keeps track of deadlines, documentation, and status for you automatically.