Security laws

Required

• Map the NIS2 measures to controls

  CMP-47 EU law

  If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.

• Register with MCF when the Swedish cybersecurity law covers you

  CMP-84 SE law

  If the cybersäkerhetslag (2025:1506) covers you, register with the Swedish Civil Defence Agency, MCF, as soon as you can. Report any change to the registered facts within 14 days.

• Report exploited vulnerabilities in your products

  CMP-49 EU law

  Since 11 September 2026, report every actively exploited vulnerability and severe incident in a CRA product. Use the ENISA single reporting platform.

Recommended

• Decide whether NIS2 covers you

  CMP-46 EU law

  Decide whether the NIS2 Directive covers you from your sector and size, record the decision, and register with the national authority when it does.

• Decide whether DORA reaches you through financial customers

  CMP-75 EU law

  When you sell software or IT services to EU banks, insurers, payment firms or investment firms, record whether DORA applies to them. Keep a contract annex that covers each item in its Article 30.

• Give financial customers the facts for their DORA register

  CMP-85 EU law

  Keep the facts a financial customer needs for its DORA register of information as one data file. Include your legal identifier, each service, where its data is processed and stored, and every subcontractor.

• Decide whether the Cyber Resilience Act covers your product

  CMP-48 EU law

  List every product with digital elements you place on the EU market, record whether the Cyber Resilience Act applies to each, and record its class.

• Handle vulnerabilities for the whole support period

  CMP-50 EU law

  State a support period of at least five years for each covered product, unless its use is shorter. Ship free security fixes until it ends.

• Publish an advisory for every fixed vulnerability

  CMP-73 EU law

  For each covered product, publish a machine-readable advisory on the day a security fix ships. Name the affected versions, the severity, the impact and how to fix it.

• Prepare the technical file and CE marking

  CMP-51 EU law

  From 11 December 2027, each covered product needs a technical file, an EU declaration of conformity and a CE marking. Keep them for ten years or the support period, whichever is longer.

Read this with

• Connected devices playbook

  The Cyber Resilience Act and the Data Act set legal duties for devices sold in the EU. That chapter holds the scope, reporting and support rules.

• Open source maintenance playbook

  Companies that ship your code face the Cyber Resilience Act. Know what they must report, and when advisories are due.