Municipalities and regions
Municipalities, regions and municipal federations are covered regardless of size. Exceptions include their elected assemblies, and special rules apply to security-sensitive activities.
Swedish public sector · ChainSec GRC
NIS2 for municipalities and municipal companies
ChainSec helps Swedish municipalities, regions and municipal companies assess supplier security after procurement. Collect questionnaire responses, document reviews and track gaps, owners and actions to support your NIS2 work.
Review supplier security after procurement.
The contract is in place. The next step is to review responses, track identified gaps and keep evidence current. If you work in Excel, export your list to CSV and import it into ChainSec.
Collect and prioritise
Add suppliers, assign an owner and classify their business impact. Keep contracts and documents on each supplier’s record.
Send security questionnaires
Choose a security questionnaire with the right level of detail for the supplier. The supplier answers the questionnaire and provides evidence for your review.
Review and document
Evaluate responses, document your review and record gaps as nonconformities with an owner and corrective action.
Reassess regularly
Set a reassessment interval for each supplier. Receive weekly email reminders about expiring certificates and suppliers due for reassessment. Track open nonconformities in the to-do list.
Who in Sweden’s public sector is covered?
Sweden’s Cybersecurity Act (2025:1506) implements NIS2 and took effect on 15 January 2026. Municipalities and municipal companies need to be assessed on different grounds.
Municipal companies
Each company is assessed as a separate legal entity based on its activities, size and applicable exceptions. Energy, drinking water, wastewater, port operations and waste management are examples where sector rules need to be checked.
Municipal housing companies
Municipal ownership or renting out housing does not in itself bring a company into scope. Assess its activities separately. Following up IT and service suppliers remains useful outside the Act’s direct scope.
Have the evidence when management asks.
Use the supplier list, reviews and risk register when preparing updates for management or the board. ChainSec keeps the evidence together; you assess the findings and prioritise the work.
Which suppliers have been reviewed?
Export the approved supplier list with status, classification, latest review and certificate validity.
Which risks and requirements remain?
Work with the risk register and NIS2 requirements catalogue. Document risk treatment and requirement status with evidence.
Who takes the next action?
Link actions to risks and requirements, assign owners and dates, and track progress before your next follow-up.
Swedish provider. App data in Stockholm.
Fiive AB in Gothenburg
ChainSec is developed by Fiive AB. Contact us to review your requirements for the service and the evidence you need before purchasing.
Storage within the EU
App data in AWS and MongoDB Atlas is stored in the Stockholm region, eu-north-1. Our security page describes hosting, encryption and access controls.
Swedish interface
Work with suppliers, reviews, risks and actions in a Swedish interface. The product image above shows an example from the register.
Questions from the public sector
Does NIS2 cover every Swedish municipal company?
No. Municipal ownership alone is not enough. Each company needs to assess its activities against the Act’s sector and size rules and exceptions. A municipality and its companies are separate legal entities.
Are municipal housing companies covered by Sweden’s Cybersecurity Act?
Not simply because they are municipally owned or rent out housing. Assess the activities the company actually carries out. Supplier follow-up can still help manage dependencies on services such as IT operations and property systems.
Does NIS2 automatically apply to our suppliers?
No. Being directly covered by the Act is different from having to meet a customer’s security requirements. Procurement and contract requirements may mean a supplier must demonstrate its security practices without being directly covered.
How do we start if our supplier follow-up is in Excel?
Export the spreadsheet to CSV and import your suppliers. Assign owners and reassessment intervals, collect documents and start with security assessments of the suppliers you prioritise.
Can we use the evidence for management and board reporting?
Yes. You can export the approved supplier list and use documented reviews, risks, requirement status and actions when preparing your reporting. You remain responsible for conclusions and decisions.
Does ChainSec replace our procurement or management system?
No. ChainSec supports supplier assessments, risks, requirements and actions. Procurement, document control and your overall management system remain part of your existing processes. The tool does not guarantee compliance.
See how to assess and monitor supplier security.
In the demo, we show how to send security questionnaires to suppliers, document reviews and track identified gaps with assigned owners and actions.