NIS2 – how it affects you and your business

Digital services and critical infrastructure are now as essential as electricity and water – and just as vulnerable. Cyberattacks have become more sophisticated, supply chains more complex, and our dependence on digital systems greater than ever.

With NIS2, the EU is setting a new standard for digital security and resilience. In Sweden, it becomes reality through the Cybersecurity Act.

This guide gives you a clear picture of what NIS2 means and how to meet the requirements in a way that builds customer trust and strengthens your market position.

1. What is NIS2?

NIS2 is an EU directive that raises cybersecurity requirements for essential and critical operations. It means stricter requirements for how organizations manage risks, incidents, and accountability.

The goal is simple: the EU wants to make digital infrastructure more robust and resilient against today's and tomorrow's threats.

2. Are NIS2 and the Cybersecurity Act the same thing?

Almost, but not quite. NIS2 is the EU directive that sets the framework for how member states should raise the level of cybersecurity. The Cybersecurity Act is the Swedish law that implements NIS2 here. It determines:

• which operations are covered

• which requirements apply

• which supervisory authorities provide oversight

3. Who is affected?

Many assume the law only applies to large companies or traditional "critical infrastructure." That's not the case. You can be affected both directly and indirectly.

You're often affected directly if you:

• operate within energy, transport, healthcare, water, digital infrastructure, IT services, or cloud services

• provide essential or critical digital services

• are a medium-sized or large company in sectors classified as important or essential

You may be affected indirectly if you're a supplier or consultant to an organization that's covered.

So if you're an IT company providing operations, support, or development to an energy company, you may become part of their security requirements. If you're a painting contractor working for a municipal housing company, you may need to show how you handle customer data, access to booking systems, or digital keys.

In practice, this means that even if you're not directly supervised, you may need to demonstrate that you're a reliable and secure supplier.

4. What do I need to do?

The law is less about technology and more about actual capability. You're expected to have:

• an understanding of your risks and vulnerabilities

• procedures for detecting and managing incidents

• clear accountability for security at management level

• control over suppliers and dependencies

• the ability to report serious incidents

Put simply, you need to show that you understand your risk, have thought it through, and are working systematically to reduce it.

5. How do I get started?

Start by creating an overview. Ask these three questions:

• what in our operations must function?

• which systems, suppliers, and people are we most dependent on?

• what happens if we lose access, control, or visibility into them?

More about NIS2 and the Cybersecurity Act? See our 5-step guides:

• 5 steps for control and accountability

• 5 pitfalls: identity and authorization

• 5 steps: Getting started with the Cybersecurity Act

Telia and Telia Cygate – a unique combination of experience and expertise

We combine secure networks with deep technical expertise in cybersecurity. As part of Sweden's total defense, we hold a unique position where we both protect critical infrastructure and strengthen companies' digital resilience in daily operations. By combining understanding of technology, people, and organizations, we contribute to a safer and more robust digital Sweden. Learn more at: telia.se/foretag/cybersakerhet