Svenska Dokumentmallar
NIS2 Template Package – Cybersecurity Act 2026 Word/PDF
NIS2 Template Package – Cybersecurity Act 2026 Word/PDF
- File format
- DOCX, PDF
- Document language
- Swedish
- Number of files
- 15
Digital download. No physical product is shipped.
Couldn't load pickup availability
About this template
NIS2 template package for Swedish organizations – Word and PDF
This comprehensive NIS2 template package is designed for companies, organizations, and other operators who need to structure and document their cybersecurity efforts in accordance with the Swedish Cybersecurity Act (2025:1506) and the Swedish implementation of NIS2.
The package contains 15 integrated document templates, checklists, and decision-making templates in a professionally designed and editable Word file, as well as a ready-to-use PDF version. The material is updated for the regulations applicable in 2026 and is also structured with consideration for MCFFS 2026:11, which has been in effect since October 1, 2026, and specifies requirements and general advice regarding security measures and management training.
You receive both Word (DOCX) and PDF. The Word version is fully editable so that the organization's name, roles, risk levels, systems, suppliers, persons responsible, and decisions can be customized. The PDF version can be used as a reference, for printing, or as documentation for internal reviews.
What is included in the package
15 integrated templates and checklists compiled into a 22-page document, in two document formats. These are not 15 separate Word files.
- 1 DOCX: editable Word version of the entire template package.
- 1 PDF: corresponding document for reading and printing.
- 1 ZIP: consolidated download with both the Word and PDF versions.
- Language: Swedish. Document version: 1.0 (2026).
Digital Products has three download attachments available: the ZIP file as well as the DOCX and PDF separately. No Excel workbook is included.
What the files contain
The Word and PDF versions contain the same 15 integrated work components. They help the organization assess applicability, plan security measures, document risks, and follow up on decisions. The documents are filled out and customized by the organization itself.
- Applicability assessment and business classification – support for documenting whether the organization is covered by the Cybersecurity Act, sector/sub-sector, classification, and relevant supervision.
- Cybersecurity and information security policy – goals, principles, responsibilities, management direction, and follow-up.
- Risk management method – model for identification, analysis, evaluation, treatment, and acceptance of cybersecurity risks.
- Risk register and action plan – practical table for assets, threats, vulnerabilities, impact, probability, measures, responsibilities, and deadlines.
- Incident management plan – roles, classification, escalation, containment, recovery, root cause analysis, and lessons learned.
- Incident reporting 24/72 hours and final report – ready-to-use forms for initial notification, incident report, and final report.
- Continuity and crisis management plan – support for prioritization, RTO, RPO, backups, contingency solutions, crisis activation, and exercises.
- Supplier and supply chain security – due diligence, criticality, subcontractors, continuity, and follow-up.
- Security annex to supplier contracts – contractual clauses regarding incidents, access, logging, vulnerabilities, continuity, auditing, subcontractors, and exit.
- Secure development, procurement, and change management – requirements for procurement, development, configuration, patching, and changes.
- Follow-up, metrics, and internal evaluation – KPI/KRI, target values, trends, responsibilities, and improvement measures.
- Cyber hygiene and training plan – customized for employees, IT administrators, the incident response team, and management.
- Encryption, authentication, and secure communication – rules for MFA, encryption, key management, and emergency communication.
- Personnel, access, and asset security – system and information ownership, permissions, and the Joiner-Mover-Leaver process.
- Management’s annual cybersecurity review – ready-made template for documented management follow-up and decisions.
Adapted to the 2026 Cybersecurity Act
The Cybersecurity Act entered into force on January 15, 2026. For organizations covered by the Act, security work must be based on an all-risk perspective and include appropriate and proportionate technical, operational, and organizational security measures.
The template package is built around the central areas that the Act requires affected operators to manage, including risk analysis, incident management, continuity, supply chains, secure system acquisition, monitoring of security measures, cyber hygiene, training, cryptography, access control, and authentication.
Built-in support for incident reporting
In the event of a significant incident, the regulatory framework contains time-critical obligations. The package therefore includes separate forms and control points for initial notification, incident reporting, and final reporting. As a general rule, a significant incident must be notified as soon as possible and no later than within 24 hours, followed by an incident report within the deadline applicable to the organization, and subsequently a final report.
The forms are designed to help the organization collect information regarding, among other things, the sequence of events, detection, affected systems, impact on sector operations, supplier dependencies, consequences, probable root cause, and measures taken.
MCFFS 2026:11 – current security regulations
Since October 1, 2026, MCFFS 2026:11 has been in effect. The regulation contains more detailed requirements and general advice regarding security measures and management training for essential and important entities.
The template package therefore includes support for:
- systematic and risk-based cybersecurity work,
- goals and direction from management,
- risk acceptance criteria,
- information and system ownership,
- risk registers and documented action plans,
- incident and crisis management,
- continuity and recovery prioritization,
- supplier contracts and digital supply chains,
- access management and multi-factor authentication,
- encryption and secure communication,
- follow-up and evaluation of security measures,
- management training and annual follow-up.
Who is this template for?
The package is suitable for Swedish companies, organizations, and other operators who need to create or improve their documentation within the scope of NIS2 and the Cybersecurity Act. It can be used by, for example, the CEO, board of directors, management team, CISO, IT manager, information security officer, compliance function, legal counsel, data protection officer, system owners, and operational managers.
The templates are general and can be adapted to different sectors, organizational sizes, and technical environments. The organization itself fills in responsible roles, systems, classifications, risk levels, deadlines, suppliers, decision paths, and control levels.
Professional and practical design
The document is not just an information guide. It is built as practical working material with fillable fields, tables, checklists, decision boxes, and pre-written formulations. The goal is to reduce the time from regulatory requirement to usable internal documentation.
- 22 professionally designed pages
- 15 integrated templates
- Editable DOCX file
- PDF version
- Risk register and action plan
- Incident forms
- Supplier clauses
- Management review
- Implementation checklist linked to October 1, 2026
- Legal sources and version information
Important note on legal and technical adaptation
The Cybersecurity Act is risk-based and sector-specific. No general document template can alone guarantee that an organization meets all requirements. The documents must be adapted according to the organization's sector, size, system environment, risks, supervisory authority, and any sector-specific or directly applicable EU rules.
For organizations that exclusively operate within certain digital sectors, other detailed rules may be directly applicable, including the European Commission’s Implementing Regulation (EU) 2024/2690. Therefore, always check current laws, ordinances, regulations, and sector-specific requirements before finalizing the material internally.
Format and delivery
Digital product with download after purchase. The delivery in Digital Products offers a ZIP file with the DOCX and PDF, as well as these two files as separate downloads:
- NIS2_Cybersakerhetslagen_Mallpaket_2026.docx
- NIS2_Cybersakerhetslagen_Mallpaket_2026.pdf
No physical product is shipped.
In-depth guides and legal sources
Are you unsure if your organization is covered? Start with the guide which companies are covered by NIS2. Then read about NIS2's ten security areas and risk management to prioritize the work.
For incidents, you can use the guide on reporting within 24 and 72 hours as well as practical incident management. For dependencies and third parties, there is the guide security requirements in supplier contracts. For continuity planning, the BIA guide is also useful.
Primary legal sources: the Cybersecurity Act (2025:1506) and the Swedish Civil Contingencies Agency's current regulations. Always check which regulations apply to your own operations.
Frequently asked questions
Is this a NIS2 policy?
The package contains a policy structure for cybersecurity and information security, but also risk management, incident reporting, continuity, supplier security, MFA, encryption, training, and management follow-up.
Can I edit the template?
Yes. The Word file is fully editable. The PDF version is included as a ready-made reference and print version.
Is the template updated for 2026?
Version 1.0 indicates a review on September 27, 2026, and refers to the Cybersecurity Act (2025:1506), the Cybersecurity Ordinance (2025:1507), MCFFS 2026:1, MCFFS 2026:8, and MCFFS 2026:11 with entry into force on October 1, 2026.
Is the package suitable for all organizations?
It is designed as a broad basic package, but must always be adapted. Sector-specific rules and EU law may impose additional or deviating requirements.
Do 15 templates mean I get 15 separate Word files?
No. The 15 work components are integrated into one editable DOCX file with a corresponding PDF. In addition, the same files are offered together in a ZIP file.
Is the template package enough to comply with NIS2?
No. The package is a documentation aid. The organization needs to determine for itself whether it is covered by the rules, carry out actual security measures, train those affected, and fulfill applicable reporting requirements.
