Guides

The guides come from what we meet in our engagements: a management team deciding whether the organisation is covered by the Swedish Cybersecurity Act, an organisation choosing a data protection officer or a consultancy, and the question of what actually needs to be in place when the supervisory authority gets in touch. Each guide can be used as it is, without reading the regulation first, and links on to the regulation pages and to the offers that belong to the decision. Our senior consultants write them themselves and update them when the rules change.

The guides are written for someone standing in front of a concrete choice who needs to move forward without first reading an entire regulation. They take one question at a time — whether the Swedish Cybersecurity Act applies to you, what management needs to be able to answer, how to compare quotations for an external data protection officer — and work through it in the order the question actually arises.

They are deliberately independent of us as a supplier. A guide whose only conclusion is that you need to hire us is a brochure, and it helps nobody decide anything. Where a question has several reasonable answers, all of them are there; where the answer depends on your situation, it says what it depends on. If you want help afterwards we are here, but the guide should be usable without it.

All guides

• 
  NIS2 or ISO 27001 – what covers what?2026-10-23
  In our experience, a working ISO 27001 management system provides around 80 per cent of the structure the Swedish Cybersecurity Act requires. Here is what overlaps and what the Act adds.
• 
  DORA or NIS2 – which applies to you?2026-10-21
  Financial entities within the scope of DORA follow DORA for ICT risk management and incident reporting. For other organisations the Swedish Cybersecurity Act (NIS2) may be the central regime. How to decide which applies to you.
• 
  Which regulations apply to you? A self-test2026-10-10
  20 questions give a first indication of whether the GDPR, the Cybersecurity Act, DORA, the CRA and the AI Act affect you, and in what role. Instant result.
• 
  How close to ISO 27001 are you? A quick check with or without Annex A2026-10-04
  A quick check against ISO 27001: 12 questions on the ISMS, or 20 with Annex A. The result appears straight away, red to green, with suggested next steps.
• 
  Are your products ready for the CRA? A self-test in 20 questions2026-10-04
  20 questions for manufacturers show how far you have come with the Cyber Resilience Act: secure development, vulnerabilities, reporting and documentation.
• 
  How far have you come with DORA? A self-test in 20 questions2026-10-04
  20 questions in five areas show how far you have come with DORA: governance, ICT risk, incidents, testing and third-party risk. See the result straight away.
• 
  Are you ready for the Swedish Cybersecurity Act? A self-test in 20 questions2026-10-04
  20 questions in five areas show how far you have come with the Swedish Cybersecurity Act and its regulations. The result appears straight away, red to green.
• 
  Are your GDPR basics in place? A self-test in 20 questions2026-10-03
  20 questions in five areas show whether the basics of your GDPR work are in place. Takes 15 minutes and shows the result straight away, red to green.
• 
  What does a gap analysis against ISO 27001 and the Cybersecurity Act (NIS2) cost?2026-10-01
  A defined gap analysis against ISO 27001 or the Swedish Cybersecurity Act (NIS2) normally costs from around SEK 25,000 excluding VAT. Scope, depth and purpose decide. How to compare quotes.
• 
  Are we affected by the Swedish Cybersecurity Act? A simple self-assessment2026-09-07
  Five steps to assess whether your organisation is affected by the Swedish Cybersecurity Act: sector, size, public administration, DORA and the essential or important category.
• 
  The Swedish Cybersecurity Act: ten questions for management2026-09-07
  Ten questions a management team or board should be able to get answers to under the Swedish Cybersecurity Act and the regulations in force since 1 October 2026, with what a good answer contains.
• 
  External data protection officer: how to compare providers2026-09-07
  Do you have to appoint a DPO, what may the role do, internal or external, and eight criteria for comparing providers of an external data protection officer.

Looking for analysis and news instead? Those are collected under Insights and news.