Published
Summary: ISO 27001 and the Swedish Cybersecurity Act (NIS2) rest on the same idea: systematic, risk-based security work that management owns. In our experience, a working ISO 27001 management system provides around 80 per cent of the governance and security structure the Act requires. But the Act also contains obligations of its own that need to be handled separately: registration, incident reporting to the authority within fixed deadlines, management training and responsibility, and specified security areas the work must at least cover.
Two different kinds of requirement
ISO 27001 is a voluntary standard. You choose the scope of the management system and determine, through risk treatment, which security controls are necessary. The result is compared with the 93 reference controls in Annex A, and you document your control choices and relevant exclusions in a Statement of Applicability. Under accredited certification, a certification body audits that the management system works, normally in a three-year certification cycle with recurring surveillance audits and recertification.
The Swedish Cybersecurity Act (2025:1506) is law and has applied since 15 January 2026 to essential and important entities in the sectors the Act lists. It requires no certification. It requires that certain things are in place and that you can demonstrate them to a supervisory authority. Since 1 October 2026, MCFFS 2026:11 also applies, specifying the requirements on security measures and management training.
That difference decides how the overlap should be read. ISO 27001 asks whether your work is systematic. The Act asks whether you do what it lists.
Where they overlap
The requirements overlap to a large extent. A working ISO 27001 management system normally already has:
- risk assessment and risk treatment that decide which measures are needed,
- an information security policy and governing documents that management has adopted,
- incident management with roles, procedures and lessons learned,
- continuity and backup,
- supplier and cloud security,
- access control, asset management and personnel security,
- internal audit and management review that show the work is followed up.
That is also what the Act builds on. Security measures must be risk-based and “appropriate and proportionate”, and a management system is the natural place for them.
What the Act adds
What the Act adds is no less important than what overlaps. It is where the Act is concrete, and therefore where a supervisory authority starts looking.
| Area | ISO 27001 | Swedish Cybersecurity Act (NIS2) |
|---|---|---|
| Scope | You choose the scope of the management system. | Applies to the operations and the network and information systems they use for their services. |
| Security measures | Necessary controls from risk treatment, compared with Annex A and documented in the Statement of Applicability. | The security work must at least cover certain specified areas, including risk management, incidents, continuity, supply chain, cryptography and access control. Concrete measures must be risk-based, appropriate and proportionate. |
| Management | Management must show commitment and take responsibility for the management system. | Management must approve and follow up the measures, undergo training (chapter 2, section 4) and be informed at least once a year (MCFFS 2026:11). |
| Incidents | Incident management within the organisation. | Significant incidents are reported to NCSC: notice within 24 hours, incident report normally within 72 hours, final report within one month. |
| Registration | None. | Entities must register. |
| Follow-up | Internal audit and management review are required in the management system. External certification is voluntary. | Supervisory authority, orders and administrative fines. |
In practice, four things tend to be missing from a management system that otherwise works well.
Controls that were excluded
A control choice that is reasonable within ISO 27001 needs to be tested against the specific requirements of the Cybersecurity Act and its regulations. There may be security areas or concrete measures that need to be added even if they were not previously judged necessary within the management system.
A scope that is too narrow
A management system often covers one service, one office or one product. The Act asks about the operations. Compare the scope with what the Act applies to before assuming that the certificate is enough.
Reporting as a process
Incident management under ISO 27001 is about handling the incident. The Act additionally requires you to assess whether it is significant and to notify the authority within 24 hours. That requires roles, timings and templates decided in advance.
Management training you can demonstrate
ISO 27001 requires competence for the roles that affect security. The Act requires that management itself is trained on security measures, and MCFFS 2026:11 specifies what the training must deliver. Document who was trained, when and in what. We have written more about what the Act and DORA require of management training.
If you do not have ISO 27001
Then the Act is a good reason to build a management system, but it does not need to be certified. The Act requires that the work is systematic and can be demonstrated, not a certificate. Many still build to ISO 27001, because the structure is recognised by auditors, customers and supervisors and serves more than one regime. Start by deciding whether the Act applies to you: Are we affected by the Swedish Cybersecurity Act? A simple self-assessment.
How to close the gap without building two systems
Extend the management system you have instead of starting a separate NIS2 track:
- Decide whether you are affected and as what, essential or important entity.
- Compare your Statement of Applicability and your scope with the requirements of the Act and its regulations.
- Add what is missing: registration, the reporting process, management training and the reporting to management.
- Let the internal audit test the Act’s requirements too, so that follow-up is one process, not two.
A gap analysis against ISO 27001 and the Cybersecurity Act shows what is already in place and what remains. How such an analysis becomes usable is described in Gap analysis against NIS2, CRA, GDPR and ISO 27001.
Frequently asked questions
Is an ISO 27001 certificate enough to comply with the Cybersecurity Act?
No, not automatically. A working management system covers a large part, but the Act adds obligations of its own such as registration, incident reporting within fixed deadlines and management training. A certificate does not show that those are met.
Does the Cybersecurity Act require us to be certified?
No. The Act requires that the security measures exist and work, not that they are certified. A certificate can, however, make it easier to show that the work is systematic.
How much of the Act does an ISO 27001 management system cover?
In our engagements we often see that a mature ISO 27001 environment already has around 80 per cent of the basic structure in place: governance, risk work and most controls. That is our experience, not a measure in the Act, and the share varies with the scope of the management system and its actual implementation. What tends to be missing is the Act’s own obligations and controls that were excluded.
Where do we report a significant incident?
Via the Cyber Portal to the National Cyber Security Centre (NCSC) through CERT-SE, which forwards the report to the relevant supervisory authority.
Want to know how far your management system goes? Read more about our work on regulatory requirements and compliance or contact us.
Sources: Cybersäkerhetslag (2025:1506) · MCFFS 2026:11 · Directive (EU) 2022/2555 (NIS2) · ISO/IEC 27001. Verified 2 October 2026.
This text is general information, not legal advice. Whether and how the Act applies to you depends on your operations.