NIS2 for small suppliers: what your customers will demand

Updated 11 October 2026 · 5 min read · By Anders Karlsson

The Swedish Cybersecurity Act (cybersäkerhetslagen), the Swedish version of the EU NIS2 Directive, has applied since 15 January 2026. Most small businesses are not covered directly. But the Act requires the companies that are covered to manage the risks at their suppliers, and that is when the questions come to you. This guide explains what the Act says and how to prepare.

Who is covered by the Act?

The Act mainly applies to companies and organisations that are at least medium-sized, meaning they have at least 50 employees or an annual turnover and balance sheet total that both exceed 10 million euros, and that operate in one of 18 sectors. The government estimated that just over 1,500 companies are covered, plus public-sector bodies.

The sectors are divided into two groups:

  • Sectors of high criticality: energy, transport, banking, financial market infrastructure, health care, drinking water, waste water, digital infrastructure, ICT service management between businesses, public administration and space.
  • Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research.

Note ICT service management. This covers managed IT service providers and managed security service providers (MSPs and MSSPs) that are at least medium-sized. If you are a customer of one, or you are one, you are affected.

Some activities are covered regardless of size, for example providers of DNS services, top-level domain registries and trust services. For most small businesses, however, it is the supplier relationship that matters.

What the Act requires of those covered

Organisations must take appropriate security measures based on a risk analysis. The Directive lists what must be included as a minimum:

  1. Risk analysis and information security policies
  2. Incident handling
  3. Business continuity: backups, disaster recovery and crisis management
  4. Supply chain security, including the relationship with direct suppliers and service providers
  5. Security in the acquisition, development and maintenance of systems, including vulnerability handling
  6. Assessing whether the measures are effective
  7. Basic cyber hygiene and training
  8. Encryption
  9. Personnel security, access control and an inventory of assets
  10. Multi-factor authentication and secure communication channels

Significant incidents must be reported to Myndigheten för civilt försvar (MCF), the Swedish civil defence agency: an early warning within 24 hours, an incident report within 72 hours and a final report within one month. Management is personally responsible for ensuring the measures are implemented and must receive training itself. The Directive sets administrative fines of up to 10 million euros or 2 per cent of global annual turnover for the most critical organisations.

What it means for you as a supplier

Point 4 above is the reason small businesses are affected. A customer covered by the Act must be able to show that it has assessed the risks at its suppliers. In practice, this shows up in three ways:

  • Security questionnaires during procurement and contract renewal: do you have multi-factor authentication, backups, an incident procedure, training?
  • New contract terms, for example that you must notify the customer within a certain number of hours if you suffer an incident that could affect them, and that the customer may audit your security.
  • Certification requirements, such as ISO 27001, from larger customers. For small suppliers it is more often enough to be able to describe and demonstrate basic measures.

The 24-hour deadline is important to understand: the customer can only report in time if you detect and tell them about an incident quickly. A supplier who notices an intrusion after two weeks becomes a risk for the customer.

Checklist for a small supplier

  • Multi-factor authentication (MFA) on all accounts, above all email, administrator accounts and remote access.
  • Automatic updates on computers, phones and network equipment.
  • Backups where at least one copy cannot be deleted by an attacker, and a tested restore.
  • A list of systems, accounts and who has access to what, and a procedure for closing accounts when someone leaves.
  • A one-page incident procedure: who does what, who you call, and which customers must be informed within what time.
  • A way to detect intrusions, not just prevent them, for example alerts from your email service and a honeypot on the network.
  • Phishing training at least once a year.
  • A short, written security policy that you can send to customers who ask.

How to answer a security questionnaire

Answer honestly and specifically. "Yes, multi-factor authentication has been enabled for all accounts in Microsoft 365 since March 2026" is better than a general "we take security extremely seriously". If you are missing something, write what you are doing about it and when it will be done. The customer is looking for suppliers who are on top of things, not for perfect answers, and an exaggerated answer can become a breach of contract if something happens.

Frequently Asked Questions

Is my company covered by the Swedish Cybersecurity Act?

Probably not, if you have fewer than 50 employees and a turnover below 10 million euros. The exceptions concern certain digital services that are covered regardless of size. Your supervisory authority or a lawyer can give a definitive answer in borderline cases.

What happens if we do not meet the customer's requirements?

The Act places no requirements directly on you, but the customer may need to change supplier if it cannot show that the risks are managed. Often it is enough to show a plan for how you will fix what is missing.

Do we have to be ISO 27001 certified?

Not under the Act. Some customers require it, but most small suppliers can demonstrate basic measures with a short policy and concrete answers.

Who reports incidents, us or the customer?

The customer reports to the authority if it is covered by the Act. Your job is to detect the incident and notify the customer quickly, in line with what you have agreed.

Sources

This guide is an overview and does not replace legal advice.