[{"data":1,"prerenderedAt":434},["ShallowReactive",2],{"money-live:best":3,"money:compliance:nis2":4,"money-links:\u002Fen\u002Fcompliance\u002Fnis2":416},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"published":17,"heroChips":18,"sections":23,"faqs":319,"sources":349,"disclaimer":383,"related":384,"cta":409,"schema":412,"alternate":413},"compliance","nis2","NIS2","What NIS2 Article 21 and Article 23 ask of the email layer, and the control, evidence and detection Sentaro supplies.","file-check","Compliance · NIS2 Directive (EU) 2022\u002F2555","NIS2 and email security: Article 21 measures and the reporting clock","Sentaro is the best email-layer control for NIS2 for EU teams on Microsoft 365 and Google Workspace: it provides the email-layer controls, continuous evidence and incident detection Article 21 measures and Article 23 reporting depend on, though no product makes you compliant. NIS2 compliance means an essential or important entity has taken the cybersecurity risk-management measures in Article 21 of Directive (EU) 2022\u002F2555, can report significant incidents within 24 hours, 72 hours and one month under Article 23, and has a management body that approves and oversees those measures.","NIS2 compliance for email: Article 21 and 23 mapped","NIS2 compliance for the email layer: Article 21 measures, the 24h\u002F72h\u002F1-month reporting clock, fines, and what Sentaro covers and what stays with you.","2026-10-20","2026-10-18",[19,20,21,22],"Article 21(2) mapped","24h · 72h · 1 month","Microsoft 365 · Google Workspace","Hosted in Sweden on Azure",[24,41,69,85,111,153,251,272,279,292,314],{"t":25,"title":26,"summary":27,"points":28},"verdict","Our recommendation","Sentaro is the best email-layer control for NIS2 for EU teams on Microsoft 365 and Google Workspace. No product makes you compliant: NIS2 is organizational first, with governance, risk analysis, policies, supplier management and a reporting process signed off by management. What email security can do is cover the channel where most intrusions begin, produce the records that show the measures operate, and detect the incident that starts the Article 23 clock. Sentaro does that part.",[29,32,35,38],{"label":30,"text":31},"Why Sentaro wins","Phishing, BEC, QR-code and consent-phishing protection (Message and App vectors, live), OAuth and AI-app inventory, vendor-compromise detection, and the who\u002Fwhat\u002Fwhen\u002Fscope of email-borne incidents. Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.",{"label":33,"text":34},"Built for EU diligence","Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA. Evidence pack for NIS2 diligence on request. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.",{"label":36,"text":37},"You still own","Business continuity and backups, encryption of your own systems, MFA rollout, secure development, training programs, and your national registration and reporting submissions.",{"label":39,"text":40},"Roadmap, Q4 2026","Account-takeover and session-anomaly detection, forced re-authentication and leaked-credential monitoring arrive with the Identity and Behavioral vectors in Q4 2026.",{"t":42,"title":43,"items":44},"facts","NIS2 at a glance",[45,48,51,54,57,60,63,66],{"label":46,"value":47},"Legal act","Directive (EU) 2022\u002F2555 (NIS2). A directive: it applies through each member state’s national law.",{"label":49,"value":50},"Applies from","18 October 2024 (member states had to adopt national measures by 17 October 2024). NIS1 was repealed the same day.",{"label":52,"value":53},"Who","Medium-sized and larger entities in 18 sectors (11 in Annex I, 7 in Annex II), plus some entities regardless of size, such as DNS providers, TLD registries and qualified trust service providers.",{"label":55,"value":56},"Core duties","Risk-management measures (Art. 21), management approval, oversight and training (Art. 20), incident reporting (Art. 23).",{"label":58,"value":59},"Reporting clock","Early warning within 24 hours, incident notification within 72 hours, final report within one month of the notification.",{"label":61,"value":62},"Maximum fines","At least EUR 10 million or 2% of worldwide turnover (essential); at least EUR 7 million or 1.4% (important), whichever is higher.",{"label":64,"value":65},"Swedish implementation","Cybersäkerhetslagen (SFS 2025:1506), in force since 15 January 2026. Incident reports go to the CSIRT at Försvarets radioanstalt (FRA) since 1 July 2026.",{"label":67,"value":68},"Sentaro’s role","Email-layer control, continuous evidence and incident detection. Readiness support, not a compliance guarantee.",{"t":70,"title":71,"items":72},"stats","Why the email layer sits inside NIS2",[73,77,81],{"n":74,"l":75,"source":76},"60%","of observed intrusions in the EU started with phishing","ENISA Threat Landscape, 2025",{"n":78,"l":79,"source":80},"62%","of breaches involve a human element","Verizon DBIR, 2026",{"n":82,"l":83,"source":84},"$3.05bn","reported lost to business email compromise in 2025","FBI IC3 Internet Crime Report, 2025",{"t":86,"title":87,"blocks":88},"prose","Who must comply with NIS2?",[89,92,107,109],{"t":90,"text":91},"p","NIS2 applies to public and private entities of a type listed in Annex I (sectors of high criticality) or Annex II (other critical sectors) that are at least medium-sized under the EU definition in Recommendation 2003\u002F361\u002FEC. In practice that means 50 or more staff, or annual turnover or balance sheet above EUR 10 million. Some entities are covered regardless of size, including DNS service providers, top-level domain registries, qualified trust service providers and entities identified as critical under the CER Directive.",{"t":93,"rows":94},"table",[95,99,103],[96,97,98],"Annex","Sectors","Typical status",[100,101,102],"Annex I (11 sectors)","Energy; transport; banking; financial market infrastructures; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; space","Essential if above the medium-sized ceilings, otherwise important",[104,105,106],"Annex II (7 sectors)","Postal and courier services; waste management; chemicals; food; manufacturing; digital providers; research","Important",{"t":90,"text":108},"Banks and other financial entities are a special case. Where DORA applies, its ICT risk and incident rules take precedence as sector-specific law. See the DORA page for those obligations.",{"t":90,"text":110},"Suppliers are reached indirectly. Article 21(2)(d) requires covered entities to manage supply chain security, including the security practices of their direct suppliers. That is why NIS2 questionnaires arrive at companies the directive never names.",{"t":86,"id":112,"title":113,"blocks":114},"uk","Does NIS2 apply to UK companies?",[115,117,123,144,147,149,151],{"t":90,"text":116},"Not as UK law. The UK left the EU before NIS2 was adopted and has not transposed it. NIS2 still reaches UK companies in three ways, because Article 2(1) applies it to in-scope entities that “provide their services or carry out their activities within the Union”.",{"t":118,"items":119},"ul",[120,121,122],"EU subsidiaries and establishments. A UK group’s subsidiary established in a member state falls under that member state’s jurisdiction (Article 26(1)) and its national NIS2 law, if it meets the sector and size tests.","Digital providers with no EU establishment. DNS service providers, TLD registries, domain registration services, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines and social networking platforms that offer services in the EU without being established there “shall designate a representative in the Union” (Article 26(3)). Without one, any member state where they provide services may take legal action against them.","Supply chains. EU customers covered by NIS2 must manage the security of their direct suppliers (Article 21(2)(d)), so UK suppliers receive NIS2 questionnaires and contract clauses even when the directive does not apply to them.",{"t":93,"rows":124},[125,128,132,136,140],[126,8,127],"Your situation","UK regime",[129,130,131],"UK company serving only UK customers","Does not apply","NIS Regulations 2018, if you are an operator of essential services or a relevant digital service provider",[133,134,135],"UK group with an EU subsidiary in an Annex I or II sector, medium-sized or larger","Applies to the EU subsidiary, under that member state’s law","Applies separately to the UK entity, if in scope",[137,138,139],"UK cloud, managed service or managed security provider serving EU customers, no EU establishment","Applies; designate an EU representative (Article 26(3))","May also be in scope in the UK",[141,142,143],"UK supplier to an EU entity covered by NIS2","Not directly; reached through contracts (Article 21(2)(d))","Depends on your own sector",{"t":145,"text":146},"h3","The UK’s own rules: NIS Regulations 2018 and the Cyber Security and Resilience Bill",{"t":90,"text":148},"In the UK, the Network and Information Systems Regulations 2018 (SI 2018\u002F506) apply. They cover operators of essential services and relevant digital service providers: online marketplaces, online search engines and cloud computing services. A relevant digital service provider must have its head office in the UK or nominate a UK representative, and micro and small enterprises are excluded.",{"t":90,"text":150},"The Cyber Security and Resilience (Network and Information Systems) Bill amends the 2018 Regulations. It was introduced in the House of Commons on 12 November 2025, passed its Commons third reading on 16 June 2026, had its Lords second reading on 14 July 2026 and completed Lords committee stage in September 2026. As of 20 October 2026, UK Parliament lists Lords report stage for 26 October 2026; the Bill is not yet law. Published analysis of the Bill describes bringing data centres and managed service providers into scope, with much of the detail left to secondary legislation.",{"t":90,"text":152},"For the email layer the controls are the same under both regimes: protection against phishing and BEC, an inventory of connected apps, and incident detection fast enough for a 24-hour clock. This section is general guidance, not legal advice; confirm scope with counsel in each jurisdiction.",{"t":154,"id":155,"title":156,"intro":157,"columns":158,"own":162,"groups":163,"footnote":250},"compare","article-21","NIS2 Article 21(2) measures mapped to the email layer","Article 21(2) lists ten minimum measures, (a) to (j). This table shows where an email and SaaS security layer contributes a control and evidence, and where the work stays entirely with you.",[159,160,161],"Sentaro contributes","Evidence it produces","Stays with you",0,[164,218],{"label":165,"rows":166},"Measures where email is central",[167,176,184,192,201,209],{"label":168,"cells":169},"(b) Incident handling",[170,173,175],{"mark":171,"text":172},"yes","Detection and blocking of phishing, BEC and QR lures before interaction; quarantine; bulk remediation across mailboxes",{"mark":171,"text":174},"Verdicts with reasoning in the admin console, audit trail, who\u002Fwhat\u002Fwhen\u002Fscope per incident","Incident procedure, roles, classification of significance, the report itself",{"label":177,"cells":178},"(d) Supply chain security",[179,181,183],{"mark":171,"text":180},"Vendor-compromise and thread-hijack detection; suppliers that suddenly change bank details are flagged",{"mark":171,"text":182},"Alerts tied to the supplier domain and thread","Supplier assessments, contracts, the supplier register",{"label":185,"cells":186},"(i) Access control and asset management",[187,189,191],{"mark":171,"text":188},"Inventory of every app, AI tool and OAuth grant in the tenant, scope-level risk per user, one-click revocation",{"mark":171,"text":190},"Live app and grant inventory within 15 minutes of connecting","Access policy, joiner-mover-leaver process, asset register",{"label":193,"cells":194},"(a) Risk analysis and security policies",[195,198,200],{"mark":196,"text":197},"partial","Real threat and app data from your own tenant to inform the risk analysis",{"mark":196,"text":199},"Reporting on threats seen and apps connected","The risk analysis, the policies, management approval",{"label":202,"cells":203},"(f) Assessing effectiveness",[204,206,208],{"mark":196,"text":205},"Continuous records of what the control did",{"mark":196,"text":207},"Reports over time from the console","The assessment method and its review",{"label":210,"cells":211},"(g) Cyber hygiene and training",[212,214,217],{"mark":196,"text":213},"Verdicts labeled in the mailbox, so people see the warning where they read the mail",{"mark":215,"text":216},"no","Sentaro is not a training platform","Training program, records of who completed it, management training (Art. 20(2))",{"label":219,"rows":220},"Measures outside the email layer",[221,230,236,244],{"label":222,"cells":223},"(j) Multi-factor or continuous authentication",[224,227,229],{"mark":225,"text":226},"roadmap","Q4 2026: Behavioral vector adds anomalous-session scoring and forced re-authentication",{"mark":215,"text":228},"None today","MFA rollout and enforcement in your identity provider",{"label":231,"cells":232},"(c) Business continuity, backup, crisis management",[233,234,235],{"mark":215},{"mark":215},"Entirely yours",{"label":237,"cells":238},"(e) Secure acquisition, development and maintenance",[239,241,243],{"mark":196,"text":240},"Shows SaaS and AI tools adopted outside procurement",{"mark":196,"text":242},"App inventory","Procurement security, vulnerability handling, secure development",{"label":245,"cells":246},"(h) Cryptography and encryption",[247,248,249],{"mark":215},{"mark":215},"Encryption policy for your systems and mail","Article references: Directive (EU) 2022\u002F2555, Art. 21(2)(a)–(j). For ICT, cloud and digital providers, Implementing Regulation (EU) 2024\u002F2690 adds technical detail. This mapping is general guidance, not legal advice.",{"t":252,"id":253,"title":254,"intro":255,"items":256},"steps","reporting","What are the NIS2 incident reporting requirements?","Article 23 requires essential and important entities to notify their CSIRT or competent authority of any significant incident: one that has caused or can cause severe operational disruption or financial loss, or has affected or can affect others by causing considerable damage. The clock starts at awareness, so detection speed matters as much as the template.",[257,260,263,266,269],{"title":258,"text":259},"Detection: the clock starts at awareness","For email-borne incidents, Sentaro’s detection is what makes you aware: a blocked or delivered phishing, BEC or consent-phishing attempt, with who was targeted, what happened, when, and how far it spread.",{"title":261,"text":262},"Early warning: within 24 hours (Art. 23(4)(a))","Without undue delay and in any event within 24 hours of becoming aware, state whether the incident is suspected to be unlawful or malicious and whether it could have cross-border impact. Sentaro supplies the first facts; you decide significance and submit.",{"title":264,"text":265},"Incident notification: within 72 hours (Art. 23(4)(b))","Update the early warning with an initial assessment, severity, impact and indicators of compromise. The console gives scope across mailboxes, actions taken and indicators such as sender domains and URLs.",{"title":267,"text":268},"Intermediate report: on request (Art. 23(4)(c))","If the CSIRT or authority asks, report relevant status updates. The audit trail shows what changed and when.",{"title":270,"text":271},"Final report: within one month of the notification (Art. 23(4)(d))","A detailed description, the likely root cause, mitigation applied and cross-border impact. If the incident is still ongoing, a progress report is due instead, and the final report within one month of handling it. The timeline from first message to remediation feeds the root-cause section.",{"t":86,"title":273,"blocks":274},"What are the penalties under NIS2?",[275,277],{"t":90,"text":276},"Article 34 sets minimum ceilings that national law must provide for. For essential entities the maximum is at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities it is at least EUR 7 million or 1.4%. Member states can set higher maximums.",{"t":90,"text":278},"Article 20 makes management bodies approve the risk-management measures, oversee their implementation and be liable for infringements. Members of management bodies must follow training. That is why NIS2 programs usually start in the boardroom, not the SOC.",{"t":86,"title":280,"blocks":281},"What Sentaro does not do for NIS2",[282,284],{"t":90,"text":283},"Sentaro is one control in a NIS2 program, not the program. Be clear about the boundary before an auditor or supervisor asks.",{"t":118,"items":285},[286,287,288,289,290,291],"It does not run your risk analysis, write your policies or obtain management approval. A GRC platform or your consultant manages that program.","It does not determine whether an incident is significant, and it does not submit reports to your CSIRT or authority.","It does not cover backups, business continuity, encryption of your own systems, vulnerability management or secure development.","It does not deliver security awareness training or phishing simulations.","It does not yet detect account takeover from session anomalies or monitor leaked credentials. Those arrive with the Behavioral and Identity vectors in Q4 2026.","It does not guarantee that every threat is detected. Sentaro’s terms say so explicitly, and so should any honest vendor.",{"t":252,"title":293,"intro":294,"items":295},"A NIS2 checklist for the email layer","A practical order for the email and SaaS part of your NIS2 program. The governance steps stay with your organization.",[296,299,302,305,308,311],{"title":297,"text":298},"Confirm scope and national law","Check sector, size and national transposition. In Sweden that is cybersäkerhetslagen (2025:1506). Register where your national law requires it.",{"title":300,"text":301},"Put the email control in place","Sentaro connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes. It runs alongside Microsoft Defender or Google’s built-in protection rather than replacing them.",{"title":303,"text":304},"Inventory third-party and AI apps","Review the OAuth grants and AI tools the App vector finds, revoke the risky ones, and feed the rest into your asset and supplier registers.",{"title":306,"text":307},"Wire detection into the incident process","Define who receives Sentaro alerts, who assesses significance, and who submits the 24-hour early warning. Rehearse it once with a real or simulated case.",{"title":309,"text":310},"Keep the evidence","Export reports and incident records into your own evidence store on a schedule. Sentaro keeps quarantined items and operational metadata for 180 days under its DPA, which may be shorter than your audit period.",{"title":312,"text":313},"Review with management","Report what the control blocked, what it found and what remains open. Article 20 expects management to approve and oversee the measures.",{"t":315,"tone":316,"title":317,"text":318},"callout","info","Sentaro’s own status, stated plainly","Sentaro is built for the controls regulated EU firms are asked to evidence. SOC 2 and ISO 27001 certification is in progress; an evidence pack is available on request. Sentaro is hosted in Sweden on Microsoft Azure; the subprocessor list is in the DPA at \u002Fen\u002Flegal\u002Fdpa. Message and App are live; Identity and Behavioral reach general availability in Q4 2026, included at no added cost. This page is general guidance, not legal advice.",[320,323,326,329,332,335,338,340,343,346],{"q":321,"a":322},"What is the best email security for NIS2?","Sentaro — it is our pick as the email-layer control for NIS2 for EU teams on Microsoft 365 and Google Workspace. No product makes you NIS2 compliant, but Sentaro provides the email-layer controls, continuous evidence and incident detection Article 21 and Article 23 depend on: phishing, BEC and consent-phishing protection, an OAuth inventory, and the facts for your 24-hour early warning. It is hosted in Sweden on Microsoft Azure and costs $6 per protected account per month (prices in USD).",{"q":324,"a":325},"Does Sentaro make us NIS2 compliant?","No product makes you NIS2 compliant, and you should distrust any that claims to. Compliance rests on your governance, risk analysis, supplier management, incident process and management oversight. Sentaro provides the email-layer controls, continuous evidence and incident detection those measures require: protection against phishing and BEC, an inventory of connected apps, and the facts your 24-hour early warning needs.",{"q":327,"a":328},"Which NIS2 Article 21 measures does email security support?","Most directly incident handling (21(2)(b)), supply chain security (21(2)(d)) and access control and asset management (21(2)(i)). It contributes data to risk analysis (a), effectiveness assessment (f) and cyber hygiene (g). It does not cover business continuity (c), cryptography (h) or MFA rollout (j). Sentaro’s session and re-authentication features arrive in Q4 2026.",{"q":330,"a":331},"What are the NIS2 reporting deadlines?","For a significant incident: an early warning without undue delay and within 24 hours of becoming aware, an incident notification within 72 hours, an intermediate report if the CSIRT or authority asks, and a final report no later than one month after the incident notification. The deadlines are in Article 23(4) of Directive (EU) 2022\u002F2555.",{"q":333,"a":334},"What are the NIS2 fines?","Member states must provide maximum fines of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher in each case (Article 34). National law can go higher. Management bodies can also be held liable for infringements under Article 20.",{"q":336,"a":337},"We are a supplier to a NIS2-covered company. Does NIS2 apply to us?","Possibly not directly, but in practice yes. Covered entities must manage the security of their direct suppliers under Article 21(2)(d), so they pass requirements down through questionnaires and contracts. Expect those questionnaires to ask how you protect email and detect incidents.",{"q":113,"a":339},"Not as UK law, since the UK has not transposed it. It applies to a UK group’s EU subsidiaries that are in scope, and to UK cloud, managed service, managed security and other listed digital providers that serve EU customers without an EU establishment; those must designate an EU representative under Article 26(3). UK suppliers are also reached through EU customers’ supply-chain duties under Article 21(2)(d).",{"q":341,"a":342},"What is the UK equivalent of NIS2?","The Network and Information Systems Regulations 2018 (SI 2018\u002F506), which cover operators of essential services and relevant digital service providers. The Cyber Security and Resilience (Network and Information Systems) Bill will amend them; as of 20 October 2026 it had completed Lords committee stage, with Lords report stage listed for 26 October 2026, and was not yet law.",{"q":344,"a":345},"Does NIS2 apply if we already follow DORA?","For financial entities covered by DORA, DORA’s ICT risk-management and incident-reporting rules take precedence over the equivalent NIS2 provisions, because DORA is sector-specific law. Check your national transposition and supervisor guidance for how the two interact in your country.",{"q":347,"a":348},"Where is Sentaro’s data hosted?","Sentaro is hosted in Sweden on Microsoft Azure and is EU-sovereign by design. The DPA at \u002Fen\u002Flegal\u002Fdpa lists every subprocessor and processing location, which is what your supplier assessment should rely on. Nobody at Sentaro reads your mail in the course of providing the service.",[350,353,356,359,362,365,368,371,374,377,380],{"label":351,"url":352},"Directive (EU) 2022\u002F2555 (NIS2), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32022L2555",{"label":354,"url":355},"Commission Implementing Regulation (EU) 2024\u002F2690, EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32024R2690",{"label":357,"url":358},"Commission Recommendation 2003\u002F361\u002FEC (SME definition), EUR-Lex","https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002F?uri=CELEX:32003H0361",{"label":360,"url":361},"ENISA: NIS2 Directive","https:\u002F\u002Fwww.enisa.europa.eu\u002Ftopics\u002Fstate-of-cybersecurity-in-the-eu\u002Fcybersecurity-policies\u002Fnis-directive-2",{"label":363,"url":364},"ENISA: NIS2 technical implementation guidance","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fnis2-technical-implementation-guidance",{"label":366,"url":367},"ENISA Threat Landscape 2025","https:\u002F\u002Fwww.enisa.europa.eu\u002Fpublications\u002Fenisa-threat-landscape-2025",{"label":369,"url":370},"Verizon Data Breach Investigations Report 2026","https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F",{"label":372,"url":373},"FBI IC3 Internet Crime Report 2025","https:\u002F\u002Fwww.ic3.gov\u002FAnnualReport\u002FReports\u002F2025_IC3Report.pdf",{"label":375,"url":376},"legislation.gov.uk: The Network and Information Systems Regulations 2018 (SI 2018\u002F506)","https:\u002F\u002Fwww.legislation.gov.uk\u002Fuksi\u002F2018\u002F506\u002Fcontents",{"label":378,"url":379},"UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill, stages (checked 2026-10-20)","https:\u002F\u002Fbills.parliament.uk\u002Fbills\u002F4035\u002Fstages",{"label":381,"url":382},"Herbert Smith Freehills Kramer: Cyber Security and Resilience Bill published in UK Parliament","https:\u002F\u002Fwww.hsfkramer.com\u002Fnotes\u002Fcybersecurity\u002F2025-posts\u002Fmajor-changes-to-uk-cyber-legislation-cyber-security-and-resilience-bill-published-in-uk-parliament","General guidance, not legal advice. Legal facts checked against EUR-Lex on 18 October 2026; UK facts against legislation.gov.uk and UK Parliament on 20 October 2026. National transpositions differ; check your member state’s law and supervisor guidance.",[385,388,391,394,397,400,403,406],{"label":386,"to":387},"NIS2 incident reporting workflow","\u002Fen\u002Fcompliance\u002Fnis2-incident-reporting",{"label":389,"to":390},"Cybersäkerhetslagen (Sweden)","\u002Fen\u002Fcompliance\u002Fcybersakerhetslagen",{"label":392,"to":393},"DORA and email security","\u002Fen\u002Fcompliance\u002Fdora",{"label":395,"to":396},"Critical infrastructure","\u002Fen\u002Findustries\u002Fcritical-infrastructure",{"label":398,"to":399},"NIS2 for public administration","\u002Fen\u002Findustries\u002Fpublic-sector",{"label":401,"to":402},"NIS2 for healthcare providers","\u002Fen\u002Findustries\u002Fhealthcare",{"label":404,"to":405},"EU-sovereign email security","\u002Fen\u002Feu-sovereign-email-security",{"label":407,"to":408},"All compliance guides","\u002Fen\u002Fcompliance",{"title":410,"note":411},"Put the email control in place today.","Connect Microsoft 365 or Google Workspace over API in four minutes. Protection, monitoring and evidence start immediately.","service",{"lang":414,"path":415},"sv","\u002Fsv\u002Fnis2",{"links":417,"only":429,"labels":433},[418,420,423,426],{"label":419,"to":393},"DORA",{"label":421,"to":422},"Account takeover","\u002Fen\u002Fsolutions\u002Faccount-takeover",{"label":424,"to":425},"BEC","\u002Fen\u002Fsolutions\u002Fbec",{"label":427,"to":428},"Phishing","\u002Fen\u002Fsolutions\u002Fphishing",{"3":430,"4":431,"8":432},[393],[428,425],[422],{},1792761722756]