Where does your organisation stand against Sweden's Cybersecurity Act?

Do you have a documented risk analysis and adopted security policies for your networks and information systems?

A recurring risk assessment, owned by leadership, that governs which measures you prioritise.

Can you detect, handle and report a serious incident, and do you know what must be reported and within what time?

Procedures for early warning and notification to the supervisory authority, plus internal handling.

Do you have backups, disaster recovery plans and crisis management that you have actually rehearsed?

The ability to keep operating and to recover when something serious happens.

Do you set security requirements for your suppliers and service providers, and follow them up?

The security of those you depend on, not just your own organisation.

Do you consider security when acquiring, developing and maintaining systems, including vulnerability handling?

Security built in throughout the life cycle, not bolted on afterwards.

Do you have procedures to measure and assess whether your security measures actually work?

Reviews, tests and follow-up showing that the protection holds over time.

Do staff and leadership receive recurring cybersecurity training, and do you apply basic cyber hygiene?

Everyday routines and knowledge that make the whole organisation a stronger link.

Do you have adopted procedures for the use of encryption, for data both at rest and in transit?

Protecting sensitive information with encryption where it is needed.

Do you control access based on need, keep track of your assets and handle personnel security at hiring and departure?

The right person has the right access, and only the access that is needed.

Do you use multi-factor authentication and secure solutions for voice, video and text communication where needed?

Stronger sign-in and protected communication channels.