NIS2 expanded cybersecurity requirements to thousands of companies. Are you one of them?
From critical infrastructure to manufacturing, food, and digital services. NIS2 covers more sectors, demands more, and holds management personally accountable. In Sweden, the requirements are enacted through the Cybersecurity Act (cybersäkerhetslagen).
Are you in scope for NIS2?
Answer four questions to get an initial indication, and concrete next steps regardless of the result.
Are you in scope for NIS2?
Answer four questions to get an indication.
Even if you're not directly in scope, your customers are
NIS2 requires organizations to assess cybersecurity risks across their entire supply chain. That means the requirements reach you, regardless of whether you fall under the directive yourself.
The supply chain doesn't stop at your door
NIS2 Article 21 requires in-scope organizations to manage cybersecurity risks in their supplier relationships. That means risk assessments, contractual requirements, and ongoing follow-up of you.
In practice: your enterprise customers will require you to show how you manage information security. Not to be difficult, but because the law demands it of them.
Cybersäkerhetslagen - NIS2 is now Swedish law
Since 15 January 2026, the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) is in force. NIS2 requirements are no longer something that is "coming" - they are Swedish legislation with Swedish supervisory authorities and Swedish penalties.
Same requirements, Swedish enforcement
The Cybersecurity Act transposes NIS2 into Swedish law. Risk management, incident reporting, and management accountability requirements remain the same, but supervision is handled by Swedish authorities coordinated by the Agency for Civil Defence (MCF).
Penalties
Essential entities: up to 2% of global annual turnover or EUR 10 million. Important entities: 1.4% or EUR 7 million. Public entities: up to SEK 10 million.
Incident reporting
Early warning within 24 hours. Incident notification within 72 hours. Final report within one month. Reports go to the supervisory authority and CERT-SE.
Management must be trained
The Cybersecurity Act requires management to undergo training on security measures. Approving measures is not enough - management must understand them.
NIS2 and ISO 27001 overlap, and AmpliFlow supports both
If you already have an ISO 27001 framework, you're well positioned. Here's how NIS2 requirements map to ISO 27001 and where AmpliFlow helps.
| NIS2 requirement | ISO 27001 control | AmpliFlow support |
|---|---|---|
| Risk management measures | A.8 – Information security risk management | Risk matrices with likelihood × consequence, action plans, follow-up |
| Incident handling | A.5.24–A.5.28 – Incident management | Deviation management with categorization, root cause analysis, and timelines |
| Supply chain security | A.5.19–A.5.23 – Supplier relationships | Supplier register for tracking suppliers and contact information |
| Business continuity | A.5.29–A.5.30 – Continuity planning | Pages (wiki) for continuity plans, checklists for exercises |
| Security awareness | A.6.3 – Awareness and training | Competence matrices and training planning |
| Encryption and access control | A.8.24 – Encryption, A.5.15 – Access control | Pages (wiki) for documented policies and procedures |
Four areas NIS2 demands, and AmpliFlow supports
Organizational governance, not technical tools. AmpliFlow handles processes and documentation, not firewalls or intrusion detection.
Risk management
NIS2 requires you to identify, assess, and manage cybersecurity risks. Not as a one-off project, but continuously, with documented decisions.
Risk matrices in AmpliFlowIncident handling
Early warning to supervisory authority within 24 hours. Incident notification within 72 hours. Final report within one month. Without a workflow, you will miss the deadlines.
Deviation management in AmpliFlowSupply chain security
You are responsible for ensuring your suppliers are not a weak link. This requires risk assessment, contractual requirements, and ongoing follow-up.
Supplier register in AmpliFlowBusiness continuity
Plans to maintain critical services during cyber incidents. Tested, documented, and updated.
Pages and checklists in AmpliFlowNIS2 and the Cybersecurity Act make cybersecurity a board issue
Article 20 of NIS2 is clear: management bodies must approve risk management measures, oversee implementation, and can be held personally liable for non-compliance.
What this means in practice
Management can no longer delegate cybersecurity responsibility to the IT department and hope for the best. NIS2 requires management to actively participate in risk management decisions and to have these decisions documented.
In case of non-compliance, individual board members can be held personally liable, with potential fines and temporary bans from exercising management functions.
AmpliFlow gives management oversight and documentation
- Risk assessments that management can review, with traceability on decisions and responsible persons
- Audit plans showing cybersecurity measures are followed up systematically
- Incident history documenting how the organization handled security events
- Complete compliance overview: policies, measures, and responsible persons in one place
Questions about NIS2 and AmpliFlow
What is the NIS2 Directive?
Who does NIS2 apply to?
What is the difference between essential and important entities?
How does NIS2 relate to ISO 27001?
What are the penalties for non-compliance?
How does AmpliFlow support NIS2 compliance?
We're not directly in scope. Should we care?
What is the Cybersecurity Act (cybersäkerhetslagen)?
Want to see how AmpliFlow supports NIS2 and Cybersecurity Act compliance?
Book a demo and we'll show you how risk management, incident reporting, and document control work in practice. We tailor the demonstration to your situation.