NIS2 is written at a level of abstraction that makes it difficult to translate into concrete measures. The directive speaks of risk management measures and business continuity, not about how often a backup should be tested. The leap from legal text to knowing what you actually need to do is what takes time.
First: does it apply to you?
The NIS2 Directive covers significantly more organizations than its predecessor, and in Sweden it is implemented through the Cybersecurity Act. Beyond the obvious sectors—energy, transport, healthcare, and digital infrastructure—it now also encompasses waste management, food production, manufacturing, and postal services, among others.
Many organizations discover that they are indirectly covered. If you supply a company that falls under the regulation, the requirements will reach you through the contract — regardless of what the law says about your own operations.
The requirements that actually take work
Risk management and continuity. You need to be able to show that operations will keep running in the event of a disruption — not just that you have backups, but that you know how long a restart takes and that someone has actually tested it.
Incident reporting. Significant incidents must be reported within tight deadlines. That requires you to detect them in the first place, which in turn requires incident management and someone actually reviewing the logs.
The supply chain. You are responsible for security at your suppliers as well. This means your agreements need to include requirements that can actually be followed up on.
Management’s responsibility. The responsibility lies with management and cannot be delegated to IT.
Where most organizations actually fall short
It’s rarely the technology. Most have a firewall, antivirus protection, and some form of backup. What’s missing is the documentation and proof: who does what during an incident, how long a restore takes, and when it was last tested.
A recovery plan that has never been tested is, in practice, just a hypothesis. In an audit, that’s the difference between being able to show a test log and simply describing an ambition.
What the regulators actually look at
Experience from other regulatory frameworks shows that the review rarely focuses on which technology you’ve chosen. It’s about whether you can demonstrate that you’ve made an assessment, documented it, and followed up on it.
Concretely, that means: a current risk analysis, a list of which systems are critical, documented recovery times, and a log from the most recent test. If you have all four in place, the rest of the conversation goes a lot more smoothly, regardless of what the technology is called.
How we conduct the review
We start with what can be measured. Which systems are business-critical, how long does it take to get them up and running again, and how much data would you lose in a worst-case scenario? That gives you RTO and RPO in figures instead of guesswork.
We then build the continuity that corresponds to those figures. Our DRaaS solution provides agreed-upon recovery times and tested procedures, with all data stored in Swedish data centers. If you need help moving from legal text to an action list, our consultants will perform that review together with you.
What you can do this week
Find out if you are covered, either directly or via contract. List your business-critical systems. Ask when your last recovery was tested—and if the answer is unclear, schedule a test.
These three steps cost nothing and determine the scope of the remaining work.
Frequently asked questions about NIS2 and the Cybersecurity Act
When do the requirements take effect?
The Cybersecurity Act is Sweden’s implementation of NIS2. Check the current dates and your sector’s supervisory authority — requirements are being phased in and differ between types of operations.
We are a subcontractor; are we covered?
Perhaps not by the law itself, but likely by your customers’ contractual requirements. In practice, the effect is the same.
Is it enough that we have a backup?
No. The requirement is about continuity, meaning that the business remains functional. This assumes you know how long a restart takes and that you have tested it.
From legal text to action list.
We review your critical systems and put figures on how quickly you can actually be up and running again.