[{"data":1,"prerenderedAt":385},["ShallowReactive",2],{"money-live:best":3,"money:compliance:cybersakerhetslagen":4,"money-links:\u002Fen\u002Fcompliance\u002Fcybersakerhetslagen":361},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"sections":22,"faqs":281,"sources":303,"disclaimer":328,"related":329,"cta":354,"schema":357,"alternate":358},"compliance","cybersakerhetslagen","Cybersäkerhetslagen","Sweden’s Cybersecurity Act (SFS 2025:1506): who is covered, the security measures, incident reporting to FRA, and where email fits.","flag","Compliance · Cybersäkerhetslag (2025:1506)","Cybersäkerhetslagen: the Swedish Cybersecurity Act and email security","Cybersäkerhetslagen (SFS 2025:1506) is the Swedish Cybersecurity Act that implements the EU NIS2 directive in Sweden: it has applied since 15 January 2026 and requires väsentliga and viktiga verksamhetsutövare (essential and important entities) to register, take security measures, train management and report significant incidents within 24 hours, 72 hours and one month. The best email-layer control for it on Microsoft 365 and Google Workspace is Sentaro, which provides the controls, continuous evidence and incident detection the law’s säkerhetsåtgärder and incidentrapportering depend on, hosted in Sweden on Microsoft Azure; no product makes you compliant.","Cybersäkerhetslagen (2025:1506): requirements and email","Cybersäkerhetslagen explained in English: scope, säkerhetsåtgärder, incidentrapportering to FRA, sanktionsavgifter, and what email security covers.","2026-10-18",[18,19,20,21],"In force 15 Jan 2026","Reports to FRA since 1 Jul 2026","NIS2 in Swedish law","Hosted in Sweden",[23,37,62,90,122,211,232,239,251,269,274,278],{"t":24,"title":25,"summary":26,"points":27},"verdict","Our recommendation","Best email-layer control for cybersäkerhetslagen on Microsoft 365 and Google Workspace: Sentaro. No product makes you compliant. The law replaced the 2018 NIS law (lagen 2018:1174) on 15 January 2026 and brings NIS2 into Swedish law, with municipalities, regions and state authorities covered too. Its security measures and reporting duties run straight through email, where phishing and business email compromise begin. Sentaro covers that layer and its evidence; registration, governance, the significance assessment and the report to the CSIRT stay with you.",[28,31,34],{"label":29,"text":30},"Why Sentaro wins","Phishing, BEC, QR-code and consent-phishing protection (live), the app and OAuth inventory, and the who\u002Fwhat\u002Fwhen\u002Fscope of email-borne incidents. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Working languages: English and Swedish.",{"label":32,"text":33},"Live in minutes","Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.",{"label":35,"text":36},"You still own","Anmälan (registration), ledningens utbildning (management training), the risk analysis, deciding whether an incident is betydande (significant), and the reports themselves.",{"t":38,"title":39,"items":40},"facts","Cybersäkerhetslagen at a glance",[41,44,47,50,53,56,59],{"label":42,"value":43},"Law","Cybersäkerhetslag (2025:1506), issued 11 December 2025. Supplemented by cybersäkerhetsförordning (2025:1507).",{"label":45,"value":46},"In force","15 January 2026. It repealed lagen (2018:1174) om informationssäkerhet för samhällsviktiga och digitala tjänster.",{"label":48,"value":49},"Implements","Directive (EU) 2022\u002F2555 (NIS2).",{"label":51,"value":52},"Who","Medium-sized and larger entities in the NIS2 sectors, plus state authorities, regions, municipalities, kommunalförbund and private degree-awarding education providers.",{"label":54,"value":55},"Reporting","Early notice within 24 hours, incidentanmälan within 72 hours (24 hours for trust service providers), slutrapport within one month. To the CSIRT unit at Försvarets radioanstalt (FRA) since 1 July 2026.",{"label":57,"value":58},"Sanctions","Sanktionsavgift up to the higher of 2% of global turnover or the SEK equivalent of EUR 10 million (väsentlig), 1.4% or EUR 7 million (viktig), SEK 10 million for public operators.",{"label":60,"value":61},"Sentaro","Swedish company (Sentaro AB, Stockholm), hosted in Sweden on Microsoft Azure. Readiness support, not a compliance guarantee.",{"t":63,"title":64,"blocks":65},"prose","Who is covered by cybersäkerhetslagen? (NIS2: vilka omfattas)",[66,69,71],{"t":67,"text":68},"p","The law applies to a verksamhetsutövare (operator) that is established in Sweden, operates in a sector listed in Annex 1 or 2 of NIS2, and is at least the size of a medium-sized enterprise (1 kap. 4 §). That generally means 50 or more staff, or annual turnover or balance sheet above EUR 10 million. Some operators are covered regardless of size, for example the only provider of a service essential to critical societal or economic activity in Sweden.",{"t":67,"text":70},"Sweden goes beyond the directive in the public sector. State authorities designated in the ordinance, regions, municipalities and kommunalförbund are covered (1 kap. 3 §), and so are private education providers with the right to award degrees.",{"t":72,"rows":73},"table",[74,78,82,86],[75,76,77],"Status","Who (1 kap. 9 §, simplified)","Maximum sanktionsavgift (4 kap. 10 §)",[79,80,81],"Väsentlig verksamhetsutövare (essential)","State authorities; larger-than-medium operators in Annex 1 sectors, municipalities, regions and degree-awarding education providers; qualified trust service providers and others named in the law","Higher of 2% of global annual turnover or SEK equivalent of EUR 10 million",[83,84,85],"Viktig verksamhetsutövare (important)","Other covered operators, including Annex 2 sectors and medium-sized Annex 1 operators","Higher of 1.4% of global annual turnover or SEK equivalent of EUR 7 million",[87,88,89],"Offentlig verksamhetsutövare (public)","Public operators","SEK 10 million",{"t":63,"title":91,"blocks":92},"Which authority supervises you? (tillsynsmyndighet)",[93,95,120],{"t":67,"text":94},"Supervision is split by sector (cybersäkerhetsförordningen 7 §). Registration and incident reports go to national functions. Note the change on 1 July 2026: SFS 2026:623 moved the single point of contact, the CSIRT unit and the cyber crisis role from Myndigheten för civilt försvar (MCF, formerly MSB) to Försvarets radioanstalt (FRA). Older guides that tell you to report to MSB are out of date.",{"t":72,"rows":96},[97,100,103,105,108,111,114,117],[98,99],"Function","Authority",[101,102],"Anmälan (registration) and single point of contact","Försvarets radioanstalt (FRA), from 1 July 2026",[104,102],"Incidentrapportering (incident reports), CSIRT unit",[106,107],"Supervision: banking and financial market infrastructure","Finansinspektionen",[109,110],"Supervision: digital infrastructure, digital providers, ICT service management (B2B), post, space","Post- och telestyrelsen (PTS)",[112,113],"Supervision: health care providers \u002F other health sector","Inspektionen för vård och omsorg (IVO) \u002F Läkemedelsverket",[115,116],"Supervision: energy; transport; drinking water, waste water and food","Energimyndigheten; Transportstyrelsen; Livsmedelsverket",[118,119],"Supervision: public administration, research, waste, chemicals and some manufacturing","Six länsstyrelser (Norrbotten, Skåne, Stockholm, Västra Götaland, Örebro, Östergötland)",{"t":67,"text":121},"Banks and other financial entities under DORA follow DORA’s ICT risk and incident rules where they overlap. See the DORA page.",{"t":123,"id":124,"title":125,"intro":126,"columns":127,"own":131,"groups":132,"footnote":210},"compare","sakerhetsatgarder","Vilka krav ställer cybersäkerhetslagen? The säkerhetsåtgärder mapped to email","2 kap. 3 § requires lämpliga och proportionella (appropriate and proportionate) technical, operational and organizational measures, covering at least ten areas. They mirror NIS2 Article 21(2).",[128,129,130],"Sentaro contributes","Evidence it produces","Stays with you",0,[133,179],{"label":134,"rows":135},"Where email is central",[136,145,153,161,170],{"label":137,"cells":138},"2. Incidenthantering (incident handling)",[139,142,144],{"mark":140,"text":141},"yes","Detection and blocking before interaction, quarantine, bulk remediation across mailboxes",{"mark":140,"text":143},"Verdicts with reasoning, audit trail, who\u002Fwhat\u002Fwhen\u002Fscope","Incident procedure and the significance assessment",{"label":146,"cells":147},"4. Säkerhet i leveranskedjan (supply chain)",[148,150,152],{"mark":140,"text":149},"Vendor-compromise and thread-hijack detection; changed bank details flagged",{"mark":140,"text":151},"Alerts tied to the supplier and thread","Supplier requirements and contracts",{"label":154,"cells":155},"9. Behörighetsstyrning och tillgångsförvaltning (access control, assets)",[156,158,160],{"mark":140,"text":157},"Inventory of every app, AI tool and OAuth grant, scope-level risk per user, one-click revocation",{"mark":140,"text":159},"Inventory within 15 minutes of connecting","Access policy and asset register",{"label":162,"cells":163},"1. and 6. Riskanalys; utvärdering av åtgärdernas effektivitet",[164,167,169],{"mark":165,"text":166},"partial","Threat and app data from your own tenant",{"mark":165,"text":168},"Console reports over time","The risk analysis and the evaluation",{"label":171,"cells":172},"7. Cyberhygien och utbildning (hygiene, training)",[173,175,178],{"mark":165,"text":174},"Verdicts labeled in the mailbox",{"mark":176,"text":177},"no","Not a training platform","Training, including ledningens utbildning (2 kap. 4 §)",{"label":180,"rows":181},"Outside the email layer",[182,190,196,204],{"label":183,"cells":184},"10. Autentisering (authentication)",[185,187,189],{"mark":176,"text":186},"Not covered today; see the roadmap note",{"mark":176,"text":188},"None today","MFA in your identity provider",{"label":191,"cells":192},"3. Kontinuitet och krishantering",[193,194,195],{"mark":176},{"mark":176},"Entirely yours",{"label":197,"cells":198},"5. Anskaffning, utveckling, underhåll",[199,201,203],{"mark":165,"text":200},"Shows SaaS and AI tools adopted outside procurement",{"mark":165,"text":202},"App inventory","Procurement and development security",{"label":205,"cells":206},"8. Kryptografi",[207,208,209],{"mark":176},{"mark":176},"Encryption policy","Numbering follows 2 kap. 3 § cybersäkerhetslagen (2025:1506). Supervisory authorities may issue more detailed föreskrifter. General guidance, not legal advice.",{"t":212,"id":213,"title":214,"intro":215,"items":216},"steps","incidentrapportering","Incidentrapportering: what to report, and when","A betydande incident (significant incident) is one that has caused or can cause serious disruption to the service or financial damage to the operator, or has affected or can affect others by causing considerable damage (2 kap. 5 §). Reports go to the CSIRT unit at FRA.",[217,220,223,226,229],{"title":218,"text":219},"Detection: kännedom starts the clock","Deadlines run from when you become aware (får kännedom). For email-borne incidents, Sentaro’s detection is how you become aware, with targets, actions and scope recorded.",{"title":221,"text":222},"Within 24 hours: upplysning (early notice), 2 kap. 5 §","Notify the authority “så snart det kan ske, dock senast 24 timmar” after becoming aware of the significant incident.",{"title":224,"text":225},"Within 72 hours: incidentanmälan, 2 kap. 6 §","The incident notification, due within 72 hours of awareness (24 hours for trust service providers). Sentaro supplies scope, actions taken and indicators such as domains and URLs.",{"title":227,"text":228},"On request: delrapport, 2 kap. 7 §","An interim report with status updates when the authority asks for one.",{"title":230,"text":231},"Within one month: slutrapport, 2 kap. 8 §","A final report no later than one month after the incidentanmälan. If the incident is still ongoing, a lägesrapport (progress report) is due instead, and the slutrapport within one month after the incident is handled.",{"t":63,"title":233,"blocks":234},"Cybersäkerhetslagen, NIS2, DORA and GDPR",[235,237],{"t":67,"text":236},"NIS2 is the EU directive; cybersäkerhetslagen is the Swedish law that applies it. DORA is an EU regulation for the financial sector that applies directly and takes precedence for financial entities where the rules overlap. GDPR runs in parallel: an email-borne incident that exposes personal data can be both a betydande incident under cybersäkerhetslagen and a personuppgiftsincident under GDPR Article 33, with its own 72-hour notification to Integritetsskyddsmyndigheten (IMY). The ordinance requires supervisory authorities to cooperate with IMY on such incidents.",{"t":67,"text":238},"Failing to report or inform under 2 kap. 5–9 §§ counts as an allvarlig överträdelse (serious violation) under 4 kap. 3 §. That is the practical reason to rehearse the reporting chain before you need it.",{"t":63,"title":240,"blocks":241},"What Sentaro does not do for cybersäkerhetslagen",[242],{"t":243,"items":244},"ul",[245,246,247,248,249,250],"It does not register you with FRA or report incidents for you.","It does not decide whether an incident is betydande.","It does not deliver ledningens utbildning, awareness training or phishing simulations.","It does not cover continuity, backups, encryption or vulnerability management.","It does not yet detect account takeover from session anomalies or monitor leaked credentials; that arrives with the Behavioral and Identity vectors in Q4 2026.","It does not guarantee that every threat is detected. Sentaro’s terms say so explicitly.",{"t":212,"title":252,"items":253},"A checklist for the email layer under cybersäkerhetslagen",[254,257,260,263,266],{"title":255,"text":256},"Check scope and register","Confirm sector, size and status (väsentlig or viktig), then make your anmälan. Changes must be reported within 14 days (2 kap. 2 §).",{"title":258,"text":259},"Deploy the email control","Sentaro connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes.",{"title":261,"text":262},"Inventory third-party and AI apps","Review OAuth grants and AI tools, revoke risky ones, and add the rest to your asset register.",{"title":264,"text":265},"Rehearse the 24-hour notice","Name who receives Sentaro alerts, who assesses significance, and who reports to FRA. Check the reporting process FRA publishes.",{"title":267,"text":268},"Keep evidence for tillsyn","Export reports regularly. Under the DPA, quarantined items and operational metadata are kept for 180 days.",{"t":270,"tone":271,"title":272,"text":273},"callout","info","Sentaro’s own status","Sentaro AB is a Stockholm company, hosted in Sweden on Microsoft Azure, EU-sovereign by design; the subprocessor list is in the DPA at \u002Fen\u002Flegal\u002Fdpa. This page is general guidance, not legal advice.",{"t":270,"tone":275,"title":276,"text":277},"roadmap","Roadmap: Identity and Behavioral vectors, Q4 2026","Message and App are live; Identity and Behavioral reach general availability in Q4 2026, included at no added cost. For cybersäkerhetslagen that covers account-takeover and session-anomaly detection, forced re-authentication (relevant to the autentisering measure in the table above) and leaked-credential monitoring. Until then, authentication controls stay in your identity provider.",{"t":270,"tone":271,"title":279,"text":280},"Certification status","SOC 2 and ISO 27001 certification in progress; no target date is published, and Sentaro says it will announce them the day they are signed, not before. Evidence pack on request. Google CASA verified API integration. The DPA and subprocessor list are at \u002Fen\u002Flegal\u002Fdpa.",[282,285,288,291,294,297,300],{"q":283,"a":284},"What is the best email security for cybersäkerhetslagen?","Sentaro — it is our pick as the email-layer control for Swedish essential and important entities on Microsoft 365 and Google Workspace. No product makes you compliant with cybersäkerhetslagen, but Sentaro provides the email-layer controls, continuous evidence and incident detection its säkerhetsåtgärder and incidentrapportering depend on, including the facts for the 24-hour early warning. It is hosted in Sweden on Microsoft Azure, connects over API in four minutes, and costs $6 per protected account per month (prices in USD).",{"q":286,"a":287},"What is cybersäkerhetslagen?","Cybersäkerhetslagen (SFS 2025:1506) is Sweden’s Cybersecurity Act. It implements the EU NIS2 directive and has applied since 15 January 2026, replacing the 2018 NIS law. It requires covered operators to register, take security measures, train management and report significant incidents, with sanktionsavgifter for violations.",{"q":289,"a":290},"When did cybersäkerhetslagen enter into force?","On 15 January 2026, together with cybersäkerhetsförordningen (2025:1507). On 1 July 2026 an amendment (SFS 2026:623) moved the single point of contact and the CSIRT unit from Myndigheten för civilt försvar to Försvarets radioanstalt (FRA).",{"q":292,"a":293},"Vilka krav ställer cybersäkerhetslagen? (What does the law require?)","Registration with the single point of contact, appropriate and proportionate säkerhetsåtgärder across at least ten areas (2 kap. 3 §), management training (2 kap. 4 §), and incidentrapportering for significant incidents: notice within 24 hours, incidentanmälan within 72 hours and a slutrapport within one month. Supervisory authorities can add föreskrifter.",{"q":295,"a":296},"Vad är en cybersäkerhetsincident? (What counts as a significant incident?)","Under 2 kap. 5 §, an incident is betydande (significant) if it has caused or can cause serious disruption to the service or financial damage to the operator, or has affected or can affect other people or organizations by causing considerable damage. A successful BEC payment fraud or a widespread mailbox compromise can meet that test.",{"q":298,"a":299},"Where do we report incidents in Sweden?","Incident reports under 2 kap. 5–8 §§ go to the CSIRT unit, which since 1 July 2026 is Försvarets radioanstalt (FRA) under the amended cybersäkerhetsförordningen. Personal data breaches also go to IMY under GDPR. Check FRA’s current reporting instructions before you need them.",{"q":301,"a":302},"Does Sentaro make us compliant with cybersäkerhetslagen?","No product does. Sentaro provides the email-layer controls, continuous evidence and incident detection those requirements depend on: protection against phishing and BEC, the app inventory for supply chain and access measures, and the facts your 24-hour notice needs. Registration, governance and reporting stay with you.",[304,307,310,313,316,319,322,325],{"label":305,"url":306},"Cybersäkerhetslag (2025:1506), Riksdagen","https:\u002F\u002Fdata.riksdagen.se\u002Fdokument\u002Fsfs-2025-1506.html",{"label":308,"url":309},"SFS 2025:1506, Svensk författningssamling (PDF)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2025-12\u002FSFS2025-1506.pdf",{"label":311,"url":312},"Cybersäkerhetsförordning (2025:1507), Svensk författningssamling (PDF)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2025-12\u002FSFS2025-1507.pdf",{"label":314,"url":315},"SFS 2026:623, amendment moving SPOC and CSIRT to FRA (PDF)","https:\u002F\u002Fsvenskforfattningssamling.se\u002Fsites\u002Fdefault\u002Ffiles\u002Fsfs\u002F2026-05\u002FSFS2026-623.pdf",{"label":317,"url":318},"Regeringens proposition 2025\u002F26:28","https:\u002F\u002Fdata.riksdagen.se\u002Fdokument\u002FHD0328.html",{"label":320,"url":321},"Försvarets radioanstalt (FRA)","https:\u002F\u002Fwww.fra.se",{"label":323,"url":324},"Myndigheten för civilt försvar (MCF)","https:\u002F\u002Fwww.mcf.se",{"label":326,"url":327},"Directive (EU) 2022\u002F2555 (NIS2), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32022L2555","General guidance, not legal advice. Swedish legal facts checked against Svensk författningssamling and Riksdagen on 18 October 2026. Authorities may publish föreskrifter that add detail.",[330,333,336,339,342,345,348,351],{"label":331,"to":332},"NIS2 and email security","\u002Fen\u002Fcompliance\u002Fnis2",{"label":334,"to":335},"NIS2 incident reporting workflow","\u002Fen\u002Fcompliance\u002Fnis2-incident-reporting",{"label":337,"to":338},"Public sector","\u002Fen\u002Findustries\u002Fpublic-sector",{"label":340,"to":341},"EU-sovereign email security","\u002Fen\u002Feu-sovereign-email-security",{"label":343,"to":344},"GDPR and email security","\u002Fen\u002Fcompliance\u002Fgdpr",{"label":346,"to":347},"Pricing","\u002Fen\u002Fpricing",{"label":349,"to":350},"Critical infrastructure under the new law","\u002Fen\u002Findustries\u002Fcritical-infrastructure",{"label":352,"to":353},"All compliance guides","\u002Fen\u002Fcompliance",{"title":355,"note":356},"Put the email control in place, from Stockholm.","Connect Microsoft 365 or Google Workspace over API in four minutes. Hosted in Sweden on Microsoft Azure.","service",{"lang":359,"path":360},"sv","\u002Fsv\u002Fcybersakerhetslagen",{"links":362,"only":379,"labels":384},[363,366,368,370,371,374,377],{"label":364,"to":365},"DORA","\u002Fen\u002Fcompliance\u002Fdora",{"label":367,"to":344},"GDPR",{"label":369,"to":332},"NIS2",{"label":337,"to":338},{"label":372,"to":373},"Account takeover","\u002Fen\u002Fsolutions\u002Faccount-takeover",{"label":375,"to":376},"Phishing","\u002Fen\u002Fsolutions\u002Fphishing",{"label":8,"to":378},"\u002Fen\u002Fglossary\u002Fcybersakerhetslagen",{"2":380,"3":381,"6":382,"7":383},[332,338],[365],[378,344],[376,373],{},1792761723091]