Today, October 1st, 2026, two Swedish cybersecurity regulations took force this morning. Most of the coverage says the same thing: NIS2 has arrived in Sweden, more companies are covered, the fines are large.

All of that is true and none of it gives the direction on what to do today, on Thursday, October 1st 2026.

So we have been following the regulation, we then analyzed the documents that took effect. Here is what is actually in them, what it means if you are in scope, and where we as ANIMARUM, can take the work off your hands.

The chain: NIS2 Directive (EU) 2022/2555, then cybersäkerhetslagen (2025:1506) in force since 15 January 2026, then cybersäkerhetsförordningen (2025:1507), then the two regulations that start today: MCFFS 2026:11 on security measures and training, and MCFFS 2026:12 on security audit and security scanning. The decision has been made on 15 June 2026, published 18 June 2026, which are in in force today, Thursday, October 1st 2026. The series is MCFFS, not the MSBFS some may be used to, because the issuing agency is now Myndigheten för civilt försvar.

The management has to be trained

Chapter 2, section 1 of 2026:11:

The training shall give management the knowledge and competence required to set objectives and direction for the operator's cybersecurity, to assess which security measures the operator needs to implement in order to maintain an appropriate level of cybersecurity based on identified risks, and to supervise the implementation of the security measures.

That is not the typical awareness training. It is the ability to set direction, to judge which measures this business needs against its own risks, and to check that they were actually put in place. The obligation lands on the people who approve the budget.

However, Chapter 1, section 1 says that if you operate exclusively in digital infrastructure, digital providers, managed ICT between companies, postal and courier services, or space, then the training requirement applies to you.

This is what we do. We deliver cybersecurity training built against various aspects such as Incident Response, Cyber Response Crisis and last but not least, Cybersecurity Awareness Trainings, for technical and non-technical teams, boards and leadership. The material is ready now, and we can certainly help.

Security testing is a duty, and it is actually two duties

Chapter 4, section 27 is the one with real operational consequences. Organizations must, through security tests and reviews, ensure that their technical and operational security measures are appropriate and proportionate. Then it splits into two things:

Security tests check three things:

  1. the systems are updated to the latest approved version,
  2. published vulnerabilities have been dealt with, and
  3. the chosen configurations have been implemented.

Reviews check something different: whether the measures you implemented address that system's need for cybersecurity at all.

The first is verification against a known state. A good vulnerability management program and a configuration baseline produce most of that evidence. The second is a judgment about whether you picked the right measures, and no tool makes that judgment for you, so you need that Human Touch to make the proper decision.

Then the regulator added the following:

Established test methodology should be used for both automated and manual security tests.

So it would need to be a mix of both automated and manual security tests, which is the umbrella term and consists of multiple test including penetration tests, vulnerability scanning, finding misconfigurations to name a few.

Section 27 makes the testing mandatory for IT segments. If you run plant or process systems, the OT segments carrying your operational technology get a softer duty: you only have to identify and handle the need for the same work. That is not an exemption. It means the reasoning behind your decision to put something on a risk register becomes the evidence, and that reasoning is harder to produce than the test itself would have been.

We at ANIMARUM can help with both of those The security testing (as an umbrella which consists of different tests such as penetration test, vulnerability scanning), both automated and manual, against the three items the regulation requires, as well as the review, which needs a qualified person to make the call and sign it.

The state has just become a buyer as well

2026:12 governs what a supervisory authority may do to you, and it creates two different instruments.

A security audit is carried out by an independent body that the authority engages. A security scan is carried out by the authority itself, which may engage an external actor to do it.

Both routes put a private firm inside the supervision process. One gets hired to audit you. The other gets hired to scan you.

So what does an authority have to check before it hires that firm? That is in chapter 2, section 2, and it is worth reading closely.

The guidance says the authority should weigh three things:

  • the firm's own level of cybersecurity
  • whether it has the time and the resources for the job
  • whether it holds a relevant certification

It then assesses the firm's knowledge in three areas: cybersecurity, audit methodology, and security audit. That second one is not the same as the first. Being good at finding vulnerabilities is a different skill from running a structured audit, and the text keeps them apart.

This is where we are good at with our cybersecurity experience at ANIMARUM. Our team have conducted countless of security tests, penetration tests, vulnerability scans, and we have in-house tools to conduct this automatically and manually, went through cybersecurity auditing on automotive industry, mobile fintech industry, AI penetration testing and even helped organization get certified for FedRAMP, TPN (Trusted Partner Network) Blue Shield and SOC2 in the United States of America.

Three things worth doing this week and we at ANIMARUM can help

Check the five-sectors in 2026:11, chapter 1, section 1 before you scope anything else, see if you fall into one of those categories based on the services you offer, then you can contact us as we do all of this as our day job, in Stockholm, and we can start as soon as this month.

  • Management training built against chapter 2, for the people the obligation is applied.
  • Security testing, automated and manual, against the three checks (and more) in section 27.
  • The section 27 review, which is the judgment a scanner cannot produce, signed by our qualified cybersecurity experts.
  • Gap assessment and the evidence pack a board and an auditor will ask for.
  • Incident response readiness, playbooks and rehearsals, for the duties that come with being in scope.

If you are covered by this and you do not yet know where you stand, that first conversation is short and it costs you nothing. Here is what we do. You can get in touch by sending us an email at hi@animarum.se or giving us a call directly at +46 73 440 73 42.