SWEDEN Law and Practice Contributed by: Annika Blomqvist, Sanna Frånlund, Henrik Lindstrand and Viktor Eriksson, Advokatfirman Cederquist
process; access must be withdrawn if an individual no longer satisfies the applicable reliability, loyalty or vulnerability requirements. Sweden does not have a general domestic facility- clearance regime. Entities conducting security-sen - sitive activities must undertake a security protection analysis and implement appropriate information, physical and personnel measures. Where a supplier, contractor or partner may gain access to security- sensitive activities, a written security protection agree - ment, sustainability assessment and consultation with the relevant supervisory authority may be required. Supervision is exercised by the authorities designated under Chapter 8 of the Protective Security Ordinance. 5.3 Classified Information and Official Secrets Classified defence information is primarily regulated under the Protective Security Act, the Protective Security Ordinance, the Public Access to Informa - tion and Secrecy Act and an implementing regula - tion issued by the Swedish Security Service and the Swedish Armed Forces. Information is assigned one of four security classifications according to the poten - tial harm to Sweden’s security if the information is disclosed. The classifications are Top Secret, Secret, Confidential and Restricted. Access is generally granted on a need-to-know basis, where an individual must: • have a legitimate operational need for the informa - tion; • have undergone the required security vetting; and • possess sufficient knowledge of applicable protec - tive security requirements. The relevant operator must implement information, physical and personnel measures preventing unau - thorised disclosure, alteration, destruction or loss of access. Detailed requirements apply to storage, IT systems, communications, copying, transportation, destruction and incident reporting, depending on the information classification. Before granting a contractor access to information classified as Confidential or above, or to activities of
corresponding importance, a special security protec - tion assessment must be conducted, and the parties must enter into a written security protection agree - ment. The agreement must regulate the contractor’s security obligations, following which the contractor is responsible for relevant compliancy. 5.4 Critical National Infrastructure and Defence Assets There is no general single statutory designation of critical national infrastructure for defence assets in Sweden. Such assets and capabilities are protect - ed though overlapping classification and regulatory regimes. Defence assets may constitute security- sensitive activities under the Protective Security Act. If the relevant activity constitutes a security-sensitive activity, the operator must: • notify the relevant supervisory authority; • conduct and document a protective security analy - sis; • implement relevant information, physical and per - sonnel security measures; • security-vet relevant personnel; • enter into protective security agreements with con - tractors where required; and • conduct prior security and suitability assessments before certain procurements, collaborations or transfers. The supervisory authority may prohibit a transfer or agreement that is unsuitable from a security protection perspective. The authority may also impose meas - ures on valid agreements where a protective security aspect is of current relevance, although not relevant at the time of entry into force of the agreement. Military facilities, installations, vessels and other stra - tegically important assets may also be designated as protected objects under the Protection Act (2010:305). Such designation permits restrictions on access, pho - tography and other activities and authorises specially appointed security guards to enforce the restrictions. Lastly, investments in security-sensitive activities, mil - itary equipment and strategically protected technolo - gies fall within the FDI regime. Relevant acquisitions are subject to mandatory notifications and may not
171 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook