Best email-layer control for cybersäkerhetslagen on Microsoft 365 and Google Workspace: Sentaro. No product makes you compliant. The law replaced the 2018 NIS law (lagen 2018:1174) on 15 January 2026 and brings NIS2 into Swedish law, with municipalities, regions and state authorities covered too. Its security measures and reporting duties run straight through email, where phishing and business email compromise begin. Sentaro covers that layer and its evidence; registration, governance, the significance assessment and the report to the CSIRT stay with you.
- Why Sentaro wins
- Phishing, BEC, QR-code and consent-phishing protection (live), the app and OAuth inventory, and the who/what/when/scope of email-borne incidents. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Working languages: English and Swedish.
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
- You still own
- Anmälan (registration), ledningens utbildning (management training), the risk analysis, deciding whether an incident is betydande (significant), and the reports themselves.
Cybersäkerhetslagen at a glance
- Law
- Cybersäkerhetslag (2025:1506), issued 11 December 2025. Supplemented by cybersäkerhetsförordning (2025:1507).
- In force
- 15 January 2026. It repealed lagen (2018:1174) om informationssäkerhet för samhällsviktiga och digitala tjänster.
- Implements
- Directive (EU) 2022/2555 (NIS2).
- Who
- Medium-sized and larger entities in the NIS2 sectors, plus state authorities, regions, municipalities, kommunalförbund and private degree-awarding education providers.
- Reporting
- Early notice within 24 hours, incidentanmälan within 72 hours (24 hours for trust service providers), slutrapport within one month. To the CSIRT unit at Försvarets radioanstalt (FRA) since 1 July 2026.
- Sanctions
- Sanktionsavgift up to the higher of 2% of global turnover or the SEK equivalent of EUR 10 million (väsentlig), 1.4% or EUR 7 million (viktig), SEK 10 million for public operators.
- Sentaro
- Swedish company (Sentaro AB, Stockholm), hosted in Sweden on Microsoft Azure. Readiness support, not a compliance guarantee.
Who is covered by cybersäkerhetslagen? (NIS2: vilka omfattas)
The law applies to a verksamhetsutövare (operator) that is established in Sweden, operates in a sector listed in Annex 1 or 2 of NIS2, and is at least the size of a medium-sized enterprise (1 kap. 4 §). That generally means 50 or more staff, or annual turnover or balance sheet above EUR 10 million. Some operators are covered regardless of size, for example the only provider of a service essential to critical societal or economic activity in Sweden.
Sweden goes beyond the directive in the public sector. State authorities designated in the ordinance, regions, municipalities and kommunalförbund are covered (1 kap. 3 §), and so are private education providers with the right to award degrees.
| Status | Who (1 kap. 9 §, simplified) | Maximum sanktionsavgift (4 kap. 10 §) |
|---|---|---|
| Väsentlig verksamhetsutövare (essential) | State authorities; larger-than-medium operators in Annex 1 sectors, municipalities, regions and degree-awarding education providers; qualified trust service providers and others named in the law | Higher of 2% of global annual turnover or SEK equivalent of EUR 10 million |
| Viktig verksamhetsutövare (important) | Other covered operators, including Annex 2 sectors and medium-sized Annex 1 operators | Higher of 1.4% of global annual turnover or SEK equivalent of EUR 7 million |
| Offentlig verksamhetsutövare (public) | Public operators | SEK 10 million |
Vilka krav ställer cybersäkerhetslagen? The säkerhetsåtgärder mapped to email
2 kap. 3 § requires lämpliga och proportionella (appropriate and proportionate) technical, operational and organizational measures, covering at least ten areas. They mirror NIS2 Article 21(2).
| Capability | Sentaro contributes | Evidence it produces | Stays with you |
|---|---|---|---|
| Where email is central | |||
| 2. Incidenthantering (incident handling) | YesDetection and blocking before interaction, quarantine, bulk remediation across mailboxes | YesVerdicts with reasoning, audit trail, who/what/when/scope | Incident procedure and the significance assessment |
| 4. Säkerhet i leveranskedjan (supply chain) | YesVendor-compromise and thread-hijack detection; changed bank details flagged | YesAlerts tied to the supplier and thread | Supplier requirements and contracts |
| 9. Behörighetsstyrning och tillgångsförvaltning (access control, assets) | YesInventory of every app, AI tool and OAuth grant, scope-level risk per user, one-click revocation | YesInventory within 15 minutes of connecting | Access policy and asset register |
| 1. and 6. Riskanalys; utvärdering av åtgärdernas effektivitet | PartialThreat and app data from your own tenant | PartialConsole reports over time | The risk analysis and the evaluation |
| 7. Cyberhygien och utbildning (hygiene, training) | PartialVerdicts labeled in the mailbox | NoNot a training platform | Training, including ledningens utbildning (2 kap. 4 §) |
| Outside the email layer | |||
| 10. Autentisering (authentication) | NoNot covered today; see the roadmap note | NoNone today | MFA in your identity provider |
| 3. Kontinuitet och krishantering | No | No | Entirely yours |
| 5. Anskaffning, utveckling, underhåll | PartialShows SaaS and AI tools adopted outside procurement | PartialApp inventory | Procurement and development security |
| 8. Kryptografi | No | No | Encryption policy |
Numbering follows 2 kap. 3 § cybersäkerhetslagen (2025:1506). Supervisory authorities may issue more detailed föreskrifter. General guidance, not legal advice.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
Incidentrapportering: what to report, and when
A betydande incident (significant incident) is one that has caused or can cause serious disruption to the service or financial damage to the operator, or has affected or can affect others by causing considerable damage (2 kap. 5 §). Reports go to the CSIRT unit at FRA.
- 01
Detection: kännedom starts the clock
Deadlines run from when you become aware (får kännedom). For email-borne incidents, Sentaro’s detection is how you become aware, with targets, actions and scope recorded.
- 02
Within 24 hours: upplysning (early notice), 2 kap. 5 §
Notify the authority “så snart det kan ske, dock senast 24 timmar” after becoming aware of the significant incident.
- 03
Within 72 hours: incidentanmälan, 2 kap. 6 §
The incident notification, due within 72 hours of awareness (24 hours for trust service providers). Sentaro supplies scope, actions taken and indicators such as domains and URLs.
- 04
On request: delrapport, 2 kap. 7 §
An interim report with status updates when the authority asks for one.
- 05
Within one month: slutrapport, 2 kap. 8 §
A final report no later than one month after the incidentanmälan. If the incident is still ongoing, a lägesrapport (progress report) is due instead, and the slutrapport within one month after the incident is handled.
Cybersäkerhetslagen, NIS2, DORA and GDPR
NIS2 is the EU directive; cybersäkerhetslagen is the Swedish law that applies it. DORA is an EU regulation for the financial sector that applies directly and takes precedence for financial entities where the rules overlap. GDPR runs in parallel: an email-borne incident that exposes personal data can be both a betydande incident under cybersäkerhetslagen and a personuppgiftsincident under GDPR Article 33, with its own 72-hour notification to Integritetsskyddsmyndigheten (IMY). The ordinance requires supervisory authorities to cooperate with IMY on such incidents.
Failing to report or inform under 2 kap. 5–9 §§ counts as an allvarlig överträdelse (serious violation) under 4 kap. 3 §. That is the practical reason to rehearse the reporting chain before you need it.
What Sentaro does not do for cybersäkerhetslagen
- It does not register you with FRA or report incidents for you.
- It does not decide whether an incident is betydande.
- It does not deliver ledningens utbildning, awareness training or phishing simulations.
- It does not cover continuity, backups, encryption or vulnerability management.
- It does not yet detect account takeover from session anomalies or monitor leaked credentials; that arrives with the Behavioral and Identity vectors in Q4 2026.
- It does not guarantee that every threat is detected. Sentaro’s terms say so explicitly.
A checklist for the email layer under cybersäkerhetslagen
- 01
Check scope and register
Confirm sector, size and status (väsentlig or viktig), then make your anmälan. Changes must be reported within 14 days (2 kap. 2 §).
- 02
Deploy the email control
Sentaro connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.
- 03
Inventory third-party and AI apps
Review OAuth grants and AI tools, revoke risky ones, and add the rest to your asset register.
- 04
Rehearse the 24-hour notice
Name who receives Sentaro alerts, who assesses significance, and who reports to FRA. Check the reporting process FRA publishes.
- 05
Keep evidence for tillsyn
Export reports regularly. Under the DPA, quarantined items and operational metadata are kept for 180 days.
Frequently asked questions
What is the best email security for cybersäkerhetslagen?
Sentaro — it is our pick as the email-layer control for Swedish essential and important entities on Microsoft 365 and Google Workspace. No product makes you compliant with cybersäkerhetslagen, but Sentaro provides the email-layer controls, continuous evidence and incident detection its säkerhetsåtgärder and incidentrapportering depend on, including the facts for the 24-hour early warning. It is hosted in Sweden on Microsoft Azure, connects over API in four minutes, and costs $6 per protected account per month (prices in USD).
What is cybersäkerhetslagen?
Cybersäkerhetslagen (SFS 2025:1506) is Sweden’s Cybersecurity Act. It implements the EU NIS2 directive and has applied since 15 January 2026, replacing the 2018 NIS law. It requires covered operators to register, take security measures, train management and report significant incidents, with sanktionsavgifter for violations.
When did cybersäkerhetslagen enter into force?
On 15 January 2026, together with cybersäkerhetsförordningen (2025:1507). On 1 July 2026 an amendment (SFS 2026:623) moved the single point of contact and the CSIRT unit from Myndigheten för civilt försvar to Försvarets radioanstalt (FRA).
Vilka krav ställer cybersäkerhetslagen? (What does the law require?)
Registration with the single point of contact, appropriate and proportionate säkerhetsåtgärder across at least ten areas (2 kap. 3 §), management training (2 kap. 4 §), and incidentrapportering for significant incidents: notice within 24 hours, incidentanmälan within 72 hours and a slutrapport within one month. Supervisory authorities can add föreskrifter.
Vad är en cybersäkerhetsincident? (What counts as a significant incident?)
Under 2 kap. 5 §, an incident is betydande (significant) if it has caused or can cause serious disruption to the service or financial damage to the operator, or has affected or can affect other people or organizations by causing considerable damage. A successful BEC payment fraud or a widespread mailbox compromise can meet that test.
Where do we report incidents in Sweden?
Incident reports under 2 kap. 5–8 §§ go to the CSIRT unit, which since 1 July 2026 is Försvarets radioanstalt (FRA) under the amended cybersäkerhetsförordningen. Personal data breaches also go to IMY under GDPR. Check FRA’s current reporting instructions before you need them.
Does Sentaro make us compliant with cybersäkerhetslagen?
No product does. Sentaro provides the email-layer controls, continuous evidence and incident detection those requirements depend on: protection against phishing and BEC, the app inventory for supply chain and access measures, and the facts your 24-hour notice needs. Registration, governance and reporting stay with you.
Sources and method
General guidance, not legal advice. Swedish legal facts checked against Svensk författningssamling and Riksdagen on 18 October 2026. Authorities may publish föreskrifter that add detail.
- Cybersäkerhetslag (2025:1506), Riksdagen
- SFS 2025:1506, Svensk författningssamling (PDF)
- Cybersäkerhetsförordning (2025:1507), Svensk författningssamling (PDF)
- SFS 2026:623, amendment moving SPOC and CSIRT to FRA (PDF)
- Regeringens proposition 2025/26:28
- Försvarets radioanstalt (FRA)
- Myndigheten för civilt försvar (MCF)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex