{"product_id":"nis2-leverantorscyberintyg-avvikelse-omtest-2026","title":"NIS2 2026 – supplier cyber certificate, non-compliance \u0026 retesting | Word\/PDF\/Excel","description":"\u003csection lang=\"sv\" class=\"mb-product-description\" style=\"line-height:1.67;color:#173B55\"\u003e\n\u003cp\u003e\u003cstrong\u003eYour critical system supplier says security is good – but cannot show a current test of administrator accounts, security updates, or recovery.\u003c\/strong\u003e How do you document the non-compliance, set reasonable requirements, obtain a real retest, and report the risk to senior management? This \u003cstrong\u003eNIS2 specialist package\u003c\/strong\u003e contains templates for risk-based supplier cyber control – from fact-based self-declaration to remediation letter, retest, and decision.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eLegally current:\u003c\/strong\u003e The Swedish \u003cstrong\u003eCybersecurity Act (2025:1506)\u003c\/strong\u003e came into force on \u003cstrong\u003eJanuary 15, 2026\u003c\/strong\u003e. In \u003cstrong\u003eChapter 2, Section 4\u003c\/strong\u003e, \u003cstrong\u003esecurity in the supply chain\u003c\/strong\u003e is specified as one of the areas for appropriate and proportionate security measures for operators covered by the act. According to \u003cstrong\u003eArticle 21.2 d and 21.3 of the NIS2 Directive\u003c\/strong\u003e, the risks in relation to direct suppliers and service providers must be assessed, including their specific vulnerabilities and cybersecurity practices. \u003cstrong\u003eMCFFS 2026:11\u003c\/strong\u003e applies from \u003cstrong\u003eOctober 1, 2026\u003c\/strong\u003e and specifies security measures for affected operators. \u003ca href=\"https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/svensk-forfattningssamling\/cybersakerhetslag-20251506_sfs-2025-1506\/\"\u003eSee the Cybersecurity Act\u003c\/a\u003e and \u003ca href=\"https:\/\/www.ncsc.se\/sv\/regler-och-foreskrifter\/MCFFS-2026-11-foreskrifter-och-allmanna-rad-om-sakerhetsatgarder-och-ledningens-utbildning-for-vasentliga-och-viktiga-verksamhetsutovare\/\"\u003eNCSC's current regulations\u003c\/a\u003e.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eImportant distinction:\u003c\/strong\u003e Not all Swedish businesses or their suppliers are automatically covered by the Cybersecurity Act. The affected operator must first assess their own legal scope and the concrete supplier risks. \u003cstrong\u003eThere is no general mandatory, authority-issued \"NIS2 supplier certificate\" and no universal 14- or 30-day deadlines for standard private remediation letters.\u003c\/strong\u003e A completed form does not certify cybersecurity and does not replace a technical test.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eComplete digital ZIP for 79 SEK:\u003c\/strong\u003e five Swedish working templates and one Swedish and one English user guide – all in editable Word (DOCX) and searchable printable A4 PDF. Also an Excel workbook (XLSX) with nine tabs, \u003cstrong\u003e612 administrative formulas\u003c\/strong\u003e and \u003cstrong\u003e36 approved scenario tests\u003c\/strong\u003e. Total \u003cstrong\u003e7 DOCX + 7 PDF + 1 XLSX = 15 customer files\u003c\/strong\u003e. Five Swedish working documents, two guides, seven independent documents; the PDF copies are not interactively fillable.\u003c\/p\u003e\n\n\u003cdiv style=\"border:2px solid #BDD5E5;border-left:6px solid #2B739C;border-radius:10px;padding:18px 20px;margin:20px 0;background:#EFF7FB\"\u003e\n\n\u003ch2 style=\"margin:0 0 8px;color:#1C5577\"\u003e01 · Package contents\u003c\/h2\u003e\n\n\u003cp style=\"margin:0\"\u003eFive Swedish specialist templates: \u003cstrong\u003e(1) NIS2 applicability and supplier dependency, (2) supplier cyber certificate with evidence questions, (3) written security non-compliance\/remediation request, (4) retest and verification of remediation, and (5) risk and follow-up decision\u003c\/strong\u003e. In addition, a Swedish user guide, English User Guide, and a reset Excel register. Total 15 delivery files.\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003cdiv style=\"border:2px solid #BDD5E5;border-left:6px solid #2B739C;border-radius:10px;padding:18px 20px;margin:20px 0;background:#EFF7FB\"\u003e\n\n\u003ch2 style=\"margin:0 0 8px;color:#1C5577\"\u003e02 · What the files contain\u003c\/h2\u003e\n\n\u003cp style=\"margin:0\"\u003eFields for actual supplier and contract, affected IT service, direct or indirect supplier chain, NIS2 scope, actual technical evidence, test date, version control, contract-based remediation requirement, risk owner, and manual attestation. Excel shows which cases require completion and retest; \u003cstrong\u003eit never issues authority approval, ISO certification, or automatically approved risk.\u003c\/strong\u003e\u003c\/p\u003e\n\n\n\u003c\/div\u003e\n\n\u003ch2\u003eWho is NIS2 supplier control suitable for?\u003c\/h2\u003e\n\n\u003cp\u003eBusinesses that have assessed that they are covered by the Cybersecurity Act – for example, certain actors in energy, transport, food, digital infrastructure, and relevant critical sectors – and that hire IT operations, SaaS, cloud, system developers, security services, or other suppliers that can affect network and information systems. Target groups are especially CISO, IT security officers, procurement, compliance, risk and business owners, internal audit, and procurement managers.\u003c\/p\u003e\n\n\u003cp\u003eIt can also be used by a supplier that needs to \u003cem\u003eprepare concrete documentation\u003c\/em\u003e for a NIS2-regulated customer, but the supplier must not claim that the customer or supplier has automatically been certified. The contract itself and any specific sector regulations must be checked.\u003c\/p\u003e\n\n\u003ch2\u003eExact file list – 15 customer files\u003c\/h2\u003e\n\n\u003cdiv style=\"overflow-x:auto\"\u003e\u003ctable style=\"width:100%;min-width:680px;border-collapse:collapse\"\u003e\n\n\u003cthead\u003e\u003ctr style=\"background:#DFEEF6\"\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003eDocument\u003c\/th\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003eWork step\u003c\/th\u003e\n\n\u003cth style=\"padding:9px;text-align:left\"\u003eFormat\/language\u003c\/th\u003e\n\n\n\u003c\/tr\u003e\u003c\/thead\u003e\n\n\u003ctbody\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e01 Applicability \u0026amp; critical supplier\u003c\/td\u003e\n\n\u003ctd\u003eDefine regulated business, contracts, direct and indirect suppliers, and concrete system dependency.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e02 Supplier cyber certificate and evidence questions\u003c\/td\u003e\n\n\u003ctd\u003eRequest verifiable information about access, MFA, patching, incidents, recovery, and supplier chain.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e03 Security non-compliance and remediation requirement\u003c\/td\u003e\n\n\u003ctd\u003eFact-based supplier letter: specific deficiency, contracted obligation, requested correction, deadline, and evidence.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e04 Retest, non-compliance evidence, and risk decision\u003c\/td\u003e\n\n\u003ctd\u003eVerification against actual system and version, remaining deficiencies, and separate risk owner review.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e05 Supplier follow-up and escalation\u003c\/td\u003e\n\n\u003ctd\u003eAllocation of responsibility, remaining risk, compensatory control, contract options, and decision attestation.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e06 User guide – Swedish\u003c\/td\u003e\n\n\u003ctd\u003eSeven steps, legal definitions, sources, FAQs, and instructions.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e07 English User Guide\u003c\/td\u003e\n\n\u003ctd\u003ePractical guidance for using the Swedish working forms. Not a full English translation of them.\u003c\/td\u003e\n\n\u003ctd\u003eDOCX\/PDF · English\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\u003ctr\u003e\n\n\u003ctd\u003e08 Excel register – suppliers and chain of evidence\u003c\/td\u003e\n\n\u003ctd\u003eNine tabs, 612 formulas, verified status flows, and a reset overview.\u003c\/td\u003e\n\n\u003ctd\u003eXLSX · Swedish\u003c\/td\u003e\n\n\n\u003c\/tr\u003e\n\n\n\u003c\/tbody\u003e\n\n\n\u003c\/table\u003e\u003c\/div\u003e\n\n\u003ch2\u003eExcel – nine tabs and 36 verified functional tests\u003c\/h2\u003e\n\n\u003cp\u003eThe workbook contains \u003cstrong\u003eRead me, Overview, Suppliers, Certificate, Controls, Non-compliance, Retest, Decision, and Sources\u003c\/strong\u003e. Each case is linked with a unique internal ID and actual evidence references. The register is reset upon delivery and contains no customer data or demonstration cases.\u003c\/p\u003e\n\n\u003cp\u003eThe \u003cstrong\u003e612 formulas\u003c\/strong\u003e can provide administrative signals such as \u003cstrong\u003e”TEST SUPPLIER CHAIN”, “TEST APPLICABILITY”, “VERIFY SOURCE EVIDENCE”, “TESTING MISSING”, “SECURITY DEFICIENCY”, “CLARIFY CONTRACT”, “SET DEADLINE MANUALLY”, “DOCUMENT DISPATCH”, “REMAINING ERROR” and “ESCALATE HIGH RISK”\u003c\/strong\u003e. For complete entries, a basis for manual review is displayed instead, never “NIS2-approved”.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003e36 out of 36 technical scenario tests passed\u003c\/strong\u003e after errors in the overview's count handling were corrected. A test specifically verifies that \u003cstrong\u003ehigh risk cannot be marked as automatically closed\u003c\/strong\u003e even when all decision and attestation fields are filled and the user wants to close the case. The customer's 12 overview values are 0 before the first real supplier is registered.\u003c\/p\u003e\n\n\u003ch2\u003ePractical workflow for a supplier with a security deficiency\u003c\/h2\u003e\n\n\u003col\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eAssess the scope.\u003c\/strong\u003e Is your business essential or important according to the Cybersecurity Act? Document the decision, industry, and source in form 01.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eDefine the relevant service.\u003c\/strong\u003e Identify the direct contracting party, which systems the supplier accesses, affected data, and the consequences of a cyber outage.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eRequest proportionate security evidence.\u003c\/strong\u003e Ask for the actual version and proof of MFA, privileged access, vulnerability routines, backup, or incident path depending on the identified risk.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eEvaluate a potential certificate.\u003c\/strong\u003e A signed yes-answer, ISO claim, or supplier policy is not the same as a verified test of the actual system.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eSend a concrete remediation requirement.\u003c\/strong\u003e Specify which contract and which factual control result the requirement is based on. Set a realistic deadline according to the contract; do not invent a universal statutory response time.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003ePerform a retest and preserve the chain of evidence.\u003c\/strong\u003e Check actual configurations, performed remediation, date, and remaining risks. Do not share secret keys or passwords in open spreadsheets.\u003c\/li\u003e\n\n\u003cli\u003e\n\n\u003cstrong\u003eDecide separately.\u003c\/strong\u003e The authorized risk owner makes a decision on continued operation, compensatory protections, escalation, contract change, or exit – without an automatic positive decision from Excel.\u003c\/li\u003e\n\n\n\u003c\/ol\u003e\n\n\u003ch2\u003eLegal basis – what the rules actually mean\u003c\/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eCybersecurity Act (2025:1506), Chapter 2, Section 3:\u003c\/strong\u003e technical, organizational, and operation-related security measures must be appropriate, proportionate, and risk-based. Point 4 concerns security in the supply chain and point 6 concerns assessing the effectiveness of security measures. \u003ca href=\"https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/svensk-forfattningssamling\/cybersakerhetslag-20251506_sfs-2025-1506\/\"\u003eRead the full text at the Swedish Parliament.\u003c\/a\u003e\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNIS2 Directive Article 21.2 d and 21.3:\u003c\/strong\u003e supplier-specific vulnerabilities and the quality of direct suppliers' security work, including secure development, need to be considered. It is a basis for risk-based control – \u003cem\u003enot\u003c\/em\u003e a statutory universal form for all suppliers. \u003ca href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj?locale=sv\"\u003eEU's official directive.\u003c\/a\u003e\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eMCFFS 2026:11:\u003c\/strong\u003e regulations and general advice on security measures and management training for essential and important operators apply from \u003cstrong\u003eOctober 1, 2026\u003c\/strong\u003e. Also verify relevant sector-specific regulations for your own sector. \u003ca href=\"https:\/\/www.ncsc.se\/sv\/regler-och-foreskrifter\/MCFFS-2026-11-foreskrifter-och-allmanna-rad-om-sakerhetsatgarder-och-ledningens-utbildning-for-vasentliga-och-viktiga-verksamhetsutovare\/\"\u003eOfficial NCSC source.\u003c\/a\u003e\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eScope of responsibility:\u003c\/strong\u003e a supplier certifying certain controls does not exempt the customer from assessing whether their own security is sufficient. In addition to NIS2, GDPR, industry regulations, contracts, or sector-specific EU rules may entail other obligations. This package is not an incident report, an authority form, a penetration testing service, or a sanction decision.\u003c\/p\u003e\n\n\u003ch2\u003eDifference from Mallbutiken's other products\u003c\/h2\u003e\n\n\u003cp\u003e\u003ca href=\"\/en\/products\/nis2-mallpaket-cybersakerhetslagen-2026-word-pdf\"\u003eNIS2 Template Package – Cybersecurity Act 2026\u003c\/a\u003e is broader material for the organization's own cybersecurity governance. \u003ca href=\"\/en\/products\/leverantorsrevision-leverantorsaudit-2026-2027-revisionsprotokoll-scar-excel-word-pdf\"\u003eSupplier Audit \u0026amp; Supplier Audit\u003c\/a\u003e is a general supplier\/quality control. \u003ca href=\"\/en\/products\/dora-ikt-leverantorsavtal-compliance-mallpaket-2026\"\u003eDORA ICT Supplier Agreement\u003c\/a\u003e has financial DORA application. \u003cstrong\u003eThis new product focuses specifically on NIS2-relevant cybersecurity evidence, written remediation requirements, and verified retesting at a specific supplier.\u003c\/strong\u003e\u003c\/p\u003e\n\n\u003ch2\u003eFrequently asked questions about NIS2 supplier cyber certificate\u003c\/h2\u003e\n\n\u003ch3\u003eMust all suppliers sign a NIS2 certificate?\u003c\/h3\u003e\n\n\u003cp\u003eNo. There is no universal official supplier certificate that all suppliers must fill out. The company selects appropriate and proportionate control measures based on actual risk and applicable contracts.\u003c\/p\u003e\n\n\u003ch3\u003eIs a small SaaS supplier automatically NIS2-obligated if the customer is covered?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The supplier's own obligations must be assessed separately. A NIS2-regulated customer may still need to set contract-based and risk-managed security requirements.\u003c\/p\u003e\n\n\u003ch3\u003eCan the template be used as an ISO 27001 certificate?\u003c\/h3\u003e\n\n\u003cp\u003eNo. A supplier's self-declaration, or a completed questionnaire, is not an ISO 27001 certification, an independent audit, or a formal authority assessment.\u003c\/p\u003e\n\n\u003ch3\u003eWhat happens when the supplier says a non-compliance has been corrected?\u003c\/h3\u003e\n\n\u003cp\u003eDocument the supplier's statement and check actual evidence and retest against the correct system\/version. Remaining errors are marked and require a separate decision.\u003c\/p\u003e\n\n\u003ch3\u003eMust the supplier respond to the remediation requirement within 30 days?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The Cybersecurity Act's general supplier requirements do not specify such a universal deadline for private remediation letters. Base it on the contract, actual security situation, and a reasonable timeline.\u003c\/p\u003e\n\n\u003ch3\u003eCan Excel automatically approve the supplier's security?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The formulas identify administrative control needs and can never show \"legally approved\" or \"certified\". An actual technical and legal review is required.\u003c\/p\u003e\n\n\u003ch3\u003eDoes incident reporting to the authority apply?\u003c\/h3\u003e\n\n\u003cp\u003eNo. If a significant cyber incident has occurred, the act's incident rules and regulations must be assessed separately. This package concerns supplier control, not official incident reporting.\u003c\/p\u003e\n\n\u003ch3\u003eAre all templates in English?\u003c\/h3\u003e\n\n\u003cp\u003eNo. Five working templates, a Swedish guide, and Excel are in Swedish. An English User Guide is included for use but is not a full translation of the five main templates.\u003c\/p\u003e\n\n\u003ch3\u003eAre the PDF files digitally fillable?\u003c\/h3\u003e\n\n\u003cp\u003eNo. The PDF files are searchable and printable A4 versions. Edit the Word files when filling in your own data.\u003c\/p\u003e\n\n\u003ch2\u003eOfficial legal sources and transparency\u003c\/h2\u003e\n\n\u003cp\u003eSources: \u003ca href=\"https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/svensk-forfattningssamling\/cybersakerhetslag-20251506_sfs-2025-1506\/\"\u003eCybersecurity Act 2025:1506\u003c\/a\u003e; \u003ca href=\"https:\/\/www.riksdagen.se\/sv\/dokument-och-lagar\/dokument\/svensk-forfattningssamling\/cybersakerhetsforordning-20251507_sfs-2025-1507\/\"\u003eCybersecurity Regulation 2025:1507\u003c\/a\u003e; \u003ca href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj?locale=sv\"\u003eNIS2 Directive 2022\/2555\u003c\/a\u003e; \u003ca href=\"https:\/\/www.ncsc.se\/sv\/regler-och-foreskrifter\/MCFFS-2026-11-foreskrifter-och-allmanna-rad-om-sakerhetsatgarder-och-ledningens-utbildning-for-vasentliga-och-viktiga-verksamhetsutovare\/\"\u003eMCFFS 2026:11\u003c\/a\u003e; \u003ca href=\"https:\/\/www.ncsc.se\/sv\/radgivning-och-stod\/cybersakerhetslagen-nis2\/sakerhetsatgarder-enligt-cybersakerhetslagen\/\"\u003eNCSC's guidance on security measures\u003c\/a\u003e.\u003c\/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eVersion 1.0. AI-assisted legal source control and technical file QA November 9, 2026.\u003c\/strong\u003e No external lawyer, authority, certifier, or technical auditor has approved the material. PDF text and all 14 A4 pages are checked, Excel contains 612 formulas and 36\/36 scenario tests are approved, and the ZIP is integrity-checked. Use the templates as a basis for actual, separate decisions on applicability, security, contracts, and risk.\u003c\/p\u003e\n\n\u003c\/section\u003e","brand":"Svenska Dokumentmallar","offers":[{"title":"Default Title","offer_id":56560048832854,"sku":"MB-NIS2-LEVCYBER-2026-V1","price":79.0,"currency_code":"SEK","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0827\/2373\/3846\/files\/mallbutiken-01_NIS2_Leverantorscyber_Huvudbild_1600.png?v=1794231818","url":"https:\/\/mallbutiken.se\/en\/products\/nis2-leverantorscyberintyg-avvikelse-omtest-2026","provider":"Mallbutiken","version":"1.0","type":"link"}