SWEDEN Trends and Developments Contributed by: Erik Olsson, Christian Hybbinette and Daniel Lundqvist, Kahn Pedersen
compliance with NIS2 or CER. The Protective Security Act may add a further layer where Sweden’s national security is directly engaged. For companies and public authorities, the result is an increasingly complex contractual landscape. A single IT service, outsourcing arrangement or cloud rela - tionship may fall within several legal frameworks at once. More importantly, the organisation bearing the regulatory or preparedness obligation may not itself control the technical capability on which its compli - ance depends. That capability may instead reside with a cloud provider, a SaaS supplier or a subcontractor several steps down the supply chain. This makes contractual design particularly impor - tant. A generic requirement that the supplier comply with applicable law is plainly insufficient. Customers increasingly need visibility into relevant dependencies, timely access to information, clear escalation routes, incident co-operation, continuity commitments and appropriate control over critical subcontracting arrangements. In this sense, the agreement becomes the means by which the customer seeks to extend its resilience requirements into the supplier’s organisation and supply chain. SaaS services illustrate the difficulty particularly clear - ly. The commercial logic of SaaS is based on stand - ardisation and scale. The supplier operates a common service for a large number of customers and retains extensive control over the underlying software, infra - structure, subcontractors and product roadmap. The customer benefits from an efficient and continuously updated service, but has comparatively little opera - tional control. That model can sit uneasily with some of the assump - tions underpinning total defence. A supplier may deliver excellent availability under normal conditions while being unable to guarantee that a Swedish cus - tomer will receive priority access to scarce capacity or specialist personnel during a major international crisis. A function may also fail because a separate identity provider, network connection or integration is unavailable, even though the SaaS platform itself remains operational.
A multi-cloud strategy does not necessarily solve the problem either. Two cloud environments do not pro - vide genuine redundancy if both depend on the same telecommunications provider, identity layer, manage - ment tools or limited pool of specialist personnel. Resilience requires an understanding of common dependencies, not merely a larger number of suppli - ers. None of this suggests that Sweden should seek to reverse decades of digitalisation or eliminate inter - national dependencies. Such an approach would be neither realistic nor necessarily conducive to greater resilience. Sweden’s defence is now embedded in NATO, the Nordic region and the EU, and resilience can be built through trusted interdependence as well as through domestic capacity. For many systems and workloads (but not all), large cloud and SaaS providers may also offer levels of cybersecurity, redundancy and specialist expertise that individual Swedish organisa - tions could not reasonably reproduce. There are there - fore compelling reasons for cautious optimism. Firstly, NIS2, CER and renewed total defence planning are forcing organisations to identify dependencies that have historically remained hidden within techni - cal architectures and supply chains. It is difficult to build resilience around a dependency that no one has identified. Greater visibility is therefore an essential first step. Secondly, contractual practice is developing. Mat - ters that were previously treated as technical details – subcontracting, data location, continuity, recovery, portability and access to key personnel – are increas - ingly becoming substantive negotiation issues. Cus - tomers are beginning to procure continuity, portability and tested recovery as characteristics of the service itself, rather than relying on general assurances about resilience. Thirdly, digitalisation can itself form part of the solu - tion. Properly designed cloud architectures can pro - vide geographic redundancy, rapid restoration and distributed capacity that would have been impossible under older infrastructure models. The problem is not digitalisation as such but unmanaged concentration and dependency.
183 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook