More actors should be covered by existing requirements for digital security as of now. In addition, security requirements should be increased and become more detailed. Supervision should be tightened and businesses that fail to meet the requirements should be able to be forced to pay fines.
A board or CEO who "intentionally and deliberately" disregards the requirements should also be able to be prohibited from continuing to lead the business.
It will be possible to demand responsibility from officials in vital public services in a way that has not been the case before, says Carl-Oskar Bohlin, Minister for Civil Defence (M).
“Absolutely urgent”
The proposed law is based on the EU's updated directive on cybersecurity, Nis2, which came into force last year. Unlike the previous directive, which was introduced in the EU in 2017, Nis2 covers sectors such as energy, transport and waste, as well as certain medium-sized companies.
Bohlin describes the cyber domain as a "bearer of threats and antagonism that hits straight into Swedish society" and mentions the recent overload attacks against SVT's play function as an example.
Therefore, the government believes that it is absolutely urgent to ensure that we plug the vulnerabilities. That all business operators engaged in vital public services simply work more systematically with cybersecurity issues.
To be sent to the Law Council
In addition to the new law, amendments are proposed to other laws related to electronic communication, top-level domains and secrecy.
The proposed changes are expected to come into force at the beginning of next year. Before the proposal is sent to the Riksdag for decision, it will be reviewed by the Law Council.
