SWEDEN Trends and Developments Contributed by: Erik Olsson, Christian Hybbinette and Daniel Lundqvist, Kahn Pedersen
account of that company’s specific circumstances in a way that general legislation cannot. Contractually agreed preparedness may therefore be significantly more cost-effective than preparedness imposed sole - ly through legislation. An agreement also creates better conditions for the company to develop a genuine commitment to defence preparedness and to focus its resources on building the greatest possible defence capability. Legislation, by contrast, tends to direct a company’s resources towards compliance rather than capability enhancement. This can create a false sense of pre - paredness where the underlying capability is, in fact, absent. There is also a clear commercial opportunity. Compa - nies that are early in offering their capabilities under F-agreements may help shape the standards govern - ing how such agreements should be structured. Those companies may therefore not only influence the terms applicable to their own operations but also contrib - ute to the development of standards for their wider industry – standards that may ultimately inform future legislation or regulatory practice. The Digital Dimension The largest gap between the assumptions underpin - ning the older preparedness system and modern com - mercial reality may be found in IT services. Sweden is a highly digitalised economy, and critical functions increasingly depend on Software as a Service (SaaS) applications, cloud infrastructure, identity platforms, data centres, managed services, telecommunications and globally distributed support organisations. This reveals a fundamental paradox at the heart of modern total defence. The technologies that have made Swedish society more efficient have, in some respects, also made resilience more difficult to engi - neer. Cloud services are not inherently at odds with resilience. Large providers may offer levels of tech - nical security, redundancy and operational expertise that individual customers could not reproduce. The problem is not merely that a service is external; it is that the customer’s ability to understand, influence and replace that service may be limited at precisely the moment when control matters most.
Traditional preparedness planning typically began with tangible assets and dependencies: a factory, a ware - house, a vehicle fleet, a local workforce or a defined stock of goods. A modern digital service may instead depend on an international chain of data centres, soft - ware components, identity services, telecommunica - tions networks, subcontractors and remote support teams. These digital dependencies are both less vis - ible and more difficult to control. For total defence purposes, the relevant question is therefore no longer merely where the servers are located or where the data is stored. The more dif - ficult questions concern who actually controls the service, which dependencies exist further down the supply chain, where the personnel required to oper - ate and restore the service are located, and whether the customer can continue operating if connectivity or access to external resources is severely disrupted. A service may, for example, store all its data in Swe - den while essential administration, updates or incident response are carried out elsewhere. Data localisation can reduce one category of risk without delivering genuine operational sovereignty. This is also where total defence increasingly intersects with NIS2 and the Critical Entities Resilience Direc - tive, or CER. The three frameworks address related problems, but they do so from different perspectives. Sweden’s Cybersecurity Act, which implements NIS2, focuses primarily on cybersecurity and the security of network and information systems. It requires covered entities to address, among other matters, business continuity, crisis management and supply-chain secu - rity. CER takes a broader, all-hazards approach to the resilience of critical entities and their ability to main - tain essential services. Total defence poses a further and ultimately more demanding question: what must continue to function under conditions of heightened readiness and, ultimately, war? The frameworks are deliberately connected, but over - lap does not amount to equivalence. An organisation may comply with its cybersecurity obligations and still lack the operational resilience required for total defence purposes. Conversely, measures taken as part of total defence planning may also contribute to
182 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook