Guide for the public sector: What is the minimum level according to the Cybersecurity Act and how do you get there?
The Cybersecurity Act makes NIS2 Swedish law and sets a clear minimum level of cybersecurity within the public sector. In this guide, we go through what the minimum level actually means. From management responsibility and basic technical protection to supplier requirements and OT security, and how municipalities and regions reach this step by step.
1. Management Responsibility According to NIS2: This Is Where Cybersecurity Work Begins
Security work does not start with purchasing technology. It begins with management decisions. According to NIS2, the management team is personally responsible for compliance. You should be able to answer the question: what are our biggest cyber risks and what are we doing about them?
Unfortunately, there is no such thing as 100% secure cyber protection. You will experience incidents. The difference lies in how well you handle them. The Cybersecurity Act provides you with a minimum standard to start from:
-
Incident Management: A living plan that is tested regularly, not a forgotten document.
-
Reporting. A clear routine for reporting to authorities according to the requirements of NIS2.
-
Roles. Define who does what when an incident occurs.
2. Technical Basic Protection: MFA, EDR and the Human Firewall
Structured processes are important, but of course there are technical measures that are non-negotiable in comprehensive basic protection:
-
MFA is the single most important measure and ensures that the person logging in is the right person.
- Protection on Endpoints (EDR/XDR) detects and stops suspicious activity on, for example, computers and servers before it spreads.
- Central Logging (SIEM) collects and analyses logs from your systems to detect and investigate attacks.
- Vulnerability Management is a continuous process that locates and addresses vulnerabilities. This regular patching is fundamental to preventing vulnerabilities from being exploited.
The Human Firewall
But technical protections are still meaningless without conscious users. Attacks often start with an employee clicking on the wrong link. Supplement with continuous training and simulated attacks. And perhaps most importantly, strive for a culture where it is okay to ask questions. Employees who dare to question are your best protection.
But technical protection is still meaningless without conscious users
3. Supplier Requirements and OT Security in Public Sector
The next step is to review the supply chain. Many attacks occur via the supply chain. Set clear security requirements in procurements and actively follow up to ensure that critical suppliers meet them.
The public sector also has a unique risk where IT is connected with operational technology (OT) that controls water, ventilation, and energy. These are essential systems where intrusions have physical consequences. Ensure:
-
Network Segmentation. A digital firewall between IT and OT so that intrusions do not spread further.
-
Well-planned maintenance windows. Update systems without disrupting vital operations.
-
Redundancy. So critical functions continue even if a system is taken down.
4. Scenario Exercises: Test Your Cyber Defence Before You Need It
Cybersecurity is a cyclical process. In addition to ongoing monitoring, you need to practice scenarios that challenge the entire operation: a major cyberattack that disables several systems, loss of internet connection, or elevated national preparedness. Preferably practise together with other public actors and test if your plans hold before you really need them.
5 common questions and answers about what the Cybersecurity Act and NIS2 mean for the public sector
- What does the Cybersecurity Act mean for municipalities and regions?
The Cybersecurity Act is the Swedish implementation of the EU's NIS2 directive. It requires public organisations to have structured risk management, incident management, and reporting routines. The management team carries personal responsibility for compliance. - What is the minimum level of cybersecurity according to NIS2?
The minimum level includes documented incident management that is regularly tested, clear reporting routines to authorities, defined roles during incidents, as well as technical basic protection in the form of MFA, endpoint protection, central logging, and continuous vulnerability management. - What technical measures are required for basic protection in the public sector?
The most important measures are multi-factor authentication (MFA), endpoint protection (EDR/XDR) on computers and servers, central logging and analysis (SIEM), as well as continuous vulnerability management and patching. These are complemented by security training for employees. - How does the public sector protect operational technology controlling water and energy?
Through strict network segmentation between IT and OT, well-planned service windows for updates that do not disrupt critical societal operations, and redundancy that ensures critical functions continue even if individual systems are taken down. - How often should the public sector practise cyber incidents?
Cybersecurity is a cyclical process that requires regular practice. In addition to ongoing follow-up, the organisation should conduct scenario exercises for major attacks, internet outages, and heightened preparedness, preferably together with other public actors.
Guide for the public sector: What is the minimum level according to the Cybersecurity Act and how do you get there?
Download blog text
