NIS2 2026 – supplier cyber certificate, non-compliance & retesting | Word/PDF/Excel

Your critical system supplier says security is good – but cannot show a current test of administrator accounts, security updates, or recovery. How do you document the non-compliance, set reasonable requirements, obtain a real retest, and report the risk to senior management? This NIS2 specialist package contains templates for risk-based supplier cyber control – from fact-based self-declaration to remediation letter, retest, and decision.

Legally current: The Swedish Cybersecurity Act (2025:1506) came into force on January 15, 2026. In Chapter 2, Section 4, security in the supply chain is specified as one of the areas for appropriate and proportionate security measures for operators covered by the act. According to Article 21.2 d and 21.3 of the NIS2 Directive, the risks in relation to direct suppliers and service providers must be assessed, including their specific vulnerabilities and cybersecurity practices. MCFFS 2026:11 applies from October 1, 2026 and specifies security measures for affected operators. See the Cybersecurity Act and NCSC's current regulations.

Important distinction: Not all Swedish businesses or their suppliers are automatically covered by the Cybersecurity Act. The affected operator must first assess their own legal scope and the concrete supplier risks. There is no general mandatory, authority-issued "NIS2 supplier certificate" and no universal 14- or 30-day deadlines for standard private remediation letters. A completed form does not certify cybersecurity and does not replace a technical test.

Complete digital ZIP for 79 SEK: five Swedish working templates and one Swedish and one English user guide – all in editable Word (DOCX) and searchable printable A4 PDF. Also an Excel workbook (XLSX) with nine tabs, 612 administrative formulas and 36 approved scenario tests. Total 7 DOCX + 7 PDF + 1 XLSX = 15 customer files. Five Swedish working documents, two guides, seven independent documents; the PDF copies are not interactively fillable.

Who is NIS2 supplier control suitable for?

Businesses that have assessed that they are covered by the Cybersecurity Act – for example, certain actors in energy, transport, food, digital infrastructure, and relevant critical sectors – and that hire IT operations, SaaS, cloud, system developers, security services, or other suppliers that can affect network and information systems. Target groups are especially CISO, IT security officers, procurement, compliance, risk and business owners, internal audit, and procurement managers.

It can also be used by a supplier that needs to prepare concrete documentation for a NIS2-regulated customer, but the supplier must not claim that the customer or supplier has automatically been certified. The contract itself and any specific sector regulations must be checked.

Exact file list – 15 customer files

Excel – nine tabs and 36 verified functional tests

The workbook contains Read me, Overview, Suppliers, Certificate, Controls, Non-compliance, Retest, Decision, and Sources. Each case is linked with a unique internal ID and actual evidence references. The register is reset upon delivery and contains no customer data or demonstration cases.

The 612 formulas can provide administrative signals such as ”TEST SUPPLIER CHAIN”, “TEST APPLICABILITY”, “VERIFY SOURCE EVIDENCE”, “TESTING MISSING”, “SECURITY DEFICIENCY”, “CLARIFY CONTRACT”, “SET DEADLINE MANUALLY”, “DOCUMENT DISPATCH”, “REMAINING ERROR” and “ESCALATE HIGH RISK”. For complete entries, a basis for manual review is displayed instead, never “NIS2-approved”.

36 out of 36 technical scenario tests passed after errors in the overview's count handling were corrected. A test specifically verifies that high risk cannot be marked as automatically closed even when all decision and attestation fields are filled and the user wants to close the case. The customer's 12 overview values are 0 before the first real supplier is registered.

Practical workflow for a supplier with a security deficiency

1. Assess the scope. Is your business essential or important according to the Cybersecurity Act? Document the decision, industry, and source in form 01.
2. Define the relevant service. Identify the direct contracting party, which systems the supplier accesses, affected data, and the consequences of a cyber outage.
3. Request proportionate security evidence. Ask for the actual version and proof of MFA, privileged access, vulnerability routines, backup, or incident path depending on the identified risk.
4. Evaluate a potential certificate. A signed yes-answer, ISO claim, or supplier policy is not the same as a verified test of the actual system.
5. Send a concrete remediation requirement. Specify which contract and which factual control result the requirement is based on. Set a realistic deadline according to the contract; do not invent a universal statutory response time.
6. Perform a retest and preserve the chain of evidence. Check actual configurations, performed remediation, date, and remaining risks. Do not share secret keys or passwords in open spreadsheets.
7. Decide separately. The authorized risk owner makes a decision on continued operation, compensatory protections, escalation, contract change, or exit – without an automatic positive decision from Excel.

Legal basis – what the rules actually mean

Cybersecurity Act (2025:1506), Chapter 2, Section 3: technical, organizational, and operation-related security measures must be appropriate, proportionate, and risk-based. Point 4 concerns security in the supply chain and point 6 concerns assessing the effectiveness of security measures. Read the full text at the Swedish Parliament.

NIS2 Directive Article 21.2 d and 21.3: supplier-specific vulnerabilities and the quality of direct suppliers' security work, including secure development, need to be considered. It is a basis for risk-based control – not a statutory universal form for all suppliers. EU's official directive.

MCFFS 2026:11: regulations and general advice on security measures and management training for essential and important operators apply from October 1, 2026. Also verify relevant sector-specific regulations for your own sector. Official NCSC source.

Scope of responsibility: a supplier certifying certain controls does not exempt the customer from assessing whether their own security is sufficient. In addition to NIS2, GDPR, industry regulations, contracts, or sector-specific EU rules may entail other obligations. This package is not an incident report, an authority form, a penetration testing service, or a sanction decision.

Difference from Mallbutiken's other products

NIS2 Template Package – Cybersecurity Act 2026 is broader material for the organization's own cybersecurity governance. Supplier Audit & Supplier Audit is a general supplier/quality control. DORA ICT Supplier Agreement has financial DORA application. This new product focuses specifically on NIS2-relevant cybersecurity evidence, written remediation requirements, and verified retesting at a specific supplier.

Frequently asked questions about NIS2 supplier cyber certificate

Must all suppliers sign a NIS2 certificate?

No. There is no universal official supplier certificate that all suppliers must fill out. The company selects appropriate and proportionate control measures based on actual risk and applicable contracts.

Is a small SaaS supplier automatically NIS2-obligated if the customer is covered?

No. The supplier's own obligations must be assessed separately. A NIS2-regulated customer may still need to set contract-based and risk-managed security requirements.

Can the template be used as an ISO 27001 certificate?

No. A supplier's self-declaration, or a completed questionnaire, is not an ISO 27001 certification, an independent audit, or a formal authority assessment.

What happens when the supplier says a non-compliance has been corrected?

Document the supplier's statement and check actual evidence and retest against the correct system/version. Remaining errors are marked and require a separate decision.

Must the supplier respond to the remediation requirement within 30 days?

No. The Cybersecurity Act's general supplier requirements do not specify such a universal deadline for private remediation letters. Base it on the contract, actual security situation, and a reasonable timeline.

Can Excel automatically approve the supplier's security?

No. The formulas identify administrative control needs and can never show "legally approved" or "certified". An actual technical and legal review is required.

Does incident reporting to the authority apply?

No. If a significant cyber incident has occurred, the act's incident rules and regulations must be assessed separately. This package concerns supplier control, not official incident reporting.

Are all templates in English?

No. Five working templates, a Swedish guide, and Excel are in Swedish. An English User Guide is included for use but is not a full translation of the five main templates.

Are the PDF files digitally fillable?

No. The PDF files are searchable and printable A4 versions. Edit the Word files when filling in your own data.

Official legal sources and transparency

Sources: Cybersecurity Act 2025:1506; Cybersecurity Regulation 2025:1507; NIS2 Directive 2022/2555; MCFFS 2026:11; NCSC's guidance on security measures.

Version 1.0. AI-assisted legal source control and technical file QA November 9, 2026. No external lawyer, authority, certifier, or technical auditor has approved the material. PDF text and all 14 A4 pages are checked, Excel contains 612 formulas and 36/36 scenario tests are approved, and the ZIP is integrity-checked. Use the templates as a basis for actual, separate decisions on applicability, security, contracts, and risk.