Checklist: the Cybersecurity Act

Why: NCSC lists 18 sectors, including energy, transport, health care, digital infrastructure, food, manufacturing and digital providers. The Act applies to an operator covered by annex 1 or 2 of the NIS2 directive (chapter 1, section 4).

Why: The Act applies when the operator meets the size test in chapter 1, section 4. The definition is in chapter 1, section 2. NCSC says linked and partner companies are included, for example in a group, and that the test looks at headcount or turnover.

Why: Some operators are covered even when they do not meet the size test, including DNS services, top-level domain registries and trust services (chapter 1, sections 5 to 7). NCSC says the main rule has exceptions. Read the guidance before you conclude that you are outside it.

Why: NCSC says that neither NCSC nor the supervisory authorities assess whether one operator is covered. A short written note shows how you reached the answer and makes it easy to repeat when the operation changes.

Why: The Act says an operator who is covered must notify as soon as possible (chapter 2, section 2). NCSC says that since 2 February 2026 the notification should be sent as soon as possible, and that the supervisory authority may act if it has not arrived within 14 days. A change to what was already notified must be reported within 14 days of the change (chapter 2, section 2). The form is sent by email to NCSC.

Why: The Swedish Civil Defence Agency says the Act asks management to take a clearer part. The measures are listed in chapter 2, section 3.

Why: People in management must take training on the security measures (chapter 2, section 4). The measures also include basic cyber hygiene and cybersecurity training (chapter 2, section 3, point 7). The Swedish Civil Defence Agency names training of both management and staff.

Why: Practical, not a statutory job title: someone needs to own the question, keep the notes current and be the contact for authorities and suppliers. A deputy keeps it working during absence.

Why: The Act requires strategies for risk analysis and a level of security proportionate to the risk (chapter 2, section 3). Start with what stops the operation if it fails or leaks: email, the finance system, the customer register and the website.

Why: A practical step toward personnel security, access control and asset management (chapter 2, section 3, point 9). Include cloud services, domains and accounts that should be closed.

Why: The Act requires authentication where needed (chapter 2, section 3, point 10). Two-step verification for email, administration and remote access is a concrete way to do that.

Why: Security in acquisition, development and maintenance of the systems is one of the measures (chapter 2, section 3, point 5). Decide how often you update and who checks that it was done.

Why: Continuity management is one of the measures (chapter 2, section 3, point 3). A copy that the same attack can encrypt does not protect against ransomware. Try a restore so you know how long it takes.

Why: Basic cyber hygiene is part of the measures (chapter 2, section 3, point 7). SPF, DKIM and DMARC are a practical protection against email that looks as if it came from you. The Act does not name those three records.

Why: Practical protection for the website. The Act does not require these particular headers. HTTPS and security headers are simple checks.

Why: Incident handling is one of the measures (chapter 2, section 3, point 2). The plan should be usable when email is down, so keep a printed copy as well.

Why: An early warning must be given as soon as possible, and no later than 24 hours after you become aware (chapter 2, section 5). The incident notification is due within 72 hours for most operators, and within 24 hours for trust service providers (chapter 2, section 6). A final report is due within one month of the incident notification (chapter 2, section 8). Check what applies in your sector.

Why: A practical way to see whether incident handling works. The Act requires incident handling and that you assess whether the measures work (chapter 2, section 3, points 2 and 6). A short walk-through shows what is missing: a contact path, a login or who may take a decision.

Why: Supply-chain security is one of the measures (chapter 2, section 3, point 4). Start with who can log in to your systems and who holds your data.

Why: A practical way to handle the supply chain. The Act requires supply-chain security, not one particular contract sentence (chapter 2, section 3, point 4).

Why: Practical: customers who are covered must handle their supply chain (chapter 2, section 3, point 4), so the questions can reach an operator who is not covered. The list is a basis for the answers, not legal advice.