SWEDEN Law and Practice Contributed by: Annika Blomqvist, Sanna Frånlund, Henrik Lindstrand and Viktor Eriksson, Advokatfirman Cederquist
be completed before obtaining clearance from ISP. Investments in security-sensitive activities may also be subject to a notification requirement under the Pro - tective Security Act. 5.5 Cybersecurity Requirements for Defence Contractors There is no general mandatory cybersecurity certifica - tion or accreditation scheme for defence contractors in Sweden equivalent to the US CMMC framework. The applicable requirements depend on the nature of the information and whether the relevant activities are security-sensitive under the Protective Security Act (2018:585). Security-Sensitive Activities Where a contractor handles security-classified infor - mation or otherwise participates in security-sensitive activities, the operator must, as applicable: • conduct and document a protective security analy - sis; • implement appropriate information-security, physi - cal-security and personnel-security measures; • security-vet relevant personnel and, where required, conduct register checks; • enter into protective security agreements with con - tractors and subcontractors; • assess and approve relevant information systems before they are put into operation; and • implement appropriate access controls, authenti - cation, security logging, network separation, inci - dent reporting, back-up arrangements and protec - tion against intrusion and malicious code. Security Clearances Issued by FMV The Swedish Defence Materiel Administration ( Försvarets materielverk ; FMV) acts as Sweden’s Designated Security Authority for industrial security. It may issue Facility Security Clearances (FSCs) and Personnel Security Clearances (PSCs). An FSC confirms that a contractor has entered into a Level 1 security protection agreement with FMV, and may handle and store classified information at prem - ises approved by FMV. A PSC confirms that an indi - vidual is authorised to access classified information. These clearances may be issued following an applica -
tion from a foreign state, an international organisation or a company established in Sweden. FSCs and PSCs relate to specified classified activities. They are not general assessments of a contractor’s cybersecurity maturity and are therefore not directly equivalent to CMMC certification. Cybersecurity Act and NIS2 Defence contractors may also fall within the Cyber - security Act (2025:1506), which implements the NIS2 Directive in Sweden. An organisation covered by the Act must register with the competent supervisory authority, implement proportionate technical, opera - tional and organisational cybersecurity measures, and report significant incidents. The Act does not generally apply to a private operator that exclusively conducts security-sensitive activities or exclusively provides services to certain government authorities predominantly engaged in such activities. Such operators are instead subject to the Protective Security Act. Procurement and Contractual Requirements Contracting authorities may impose additional cyber - security requirements in individual procurement pro - cedures and contracts. These may include compli - ance with, or certification under, standards such as ISO/IEC 27001. Such certification is not, however, a general statutory requirement for participation in From 1 October 2026, entities covered by the Cyber - security Act must assess and manage cybersecurity and continuity risks in their digital supply chains under MCFFS 2026:11. This includes obtaining relevant information about subcontractors, particularly where alternative suppliers are unavailable, and assessing cybersecurity risks arising from those subcontractors. Defence Procurements Swedish defence programmes. 5.6 Supply Chain Security Cybersecurity Act and NIS2 Within defence procurements under LUFS, contract - ing authorities and entities may require information relating to the supply chain, aiming to ensure that subcontractors have the capacity to protect security-
172 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook