Support for NIS2 when you review suppliers
Since 15 January 2026 the Swedish Cybersecurity Act has applied, bringing the EU's NIS2 Directive into Swedish law. Supply chain security is one of the measures the act names explicitly. The platform helps you review suppliers, make decisions and show what you have done.
- Templates for NIS2, DORA and ISO 27001
- A log of who did what
- Sanctions checks in an installation that is yours alone
- Advisers who know NIS2
What the act means
The act in three points. Which requirements apply to you depends, among other things, on your sector and the size of your organisation.
Management is responsible
The Swedish Cybersecurity Act (2025:1506) has applied since 15 January 2026 to organisations in the sectors the act lists. Management has a clear responsibility for making sure the security work gets done.
Measures that fit your own risks
You must protect your organisation with technical and organisational measures that fit your risks. Supply chain security, including how you handle your direct suppliers, is named explicitly.
Being able to show what you have done
The supervisory authority can request information and documents that show how you work with security. It then helps to be able to show who assessed what and which decisions were made. The act also sets requirements for handling and reporting incidents, and our advisers can help you there.
Five areas where the platform helps you
The act says what you must achieve, not which tool you must use. Here are five areas where the platform makes the work easier to carry out and to demonstrate.
-
1
Assessments and checks of your suppliers
Send Solvere's ready-made questionnaires to your suppliers. The questions are marked with the frameworks they belong to, such as NIS2 and DORA. The supplier answers and uploads its evidence in a portal of its own. With Risk Score the supplier is also checked against sanctions lists and company registers.
-
2
Risk scores for suppliers and a register for your own risks
Each supplier gets a risk score, Risk Score, from 0 to 100. The higher the score, the higher the risk. The score is built from six areas: cyber exposure, registry status, sanctions, country risk, adverse media and the answers in assessments. You decide how much each area weighs, and the sanctions check runs again every night. For your own risks there is the Risk management module, where you assess risks, decide on actions and follow them up.
-
3
A log of who did what, and signed decisions
The audit log shows who did what, in plain words in Swedish and English. Decisions and approved assessments can be saved as PDF and signed by you, and by the supplier if you wish. The document is then sealed with a digital stamp. You can choose BankID per document, and anyone who has received the document can check that it is genuine without signing in.
-
4
The right access for every job
Give each person the access their job needs, with ready-made groups for common jobs. A new account has no permissions until it is given a group or a role. Access can be given until a set date, and staff can sign in with Microsoft Entra ID.
-
5
Reports, templates and contracts
Cyber exposure reports show what an attacker can see from the outside of the domains you monitor. They are saved as PDF, and earlier versions are kept. The questionnaires can be exported to Word. Signed agreements and approved assessments can carry a validity period with reminders. With the Contracts and licences module, contracts are created from templates, reviewed together with the supplier and monitored ahead of renewal. Risk scores, assessment status, results from the cyber check and reports can also be fetched into your business system.
Cyber exposure Contracts and licences Connection to business systems
One assessment, several frameworks
DORA is the EU's set of rules for banks, insurers and other financial firms, with requirements for how they manage IT risks and IT suppliers. Solvere's templates are linked to DORA and further frameworks, so one assessment can serve several requirements.
- NIS2The EU directive on cybersecurity, brought into Swedish law by the Cybersecurity Act
- DORAThe EU's rules on digital resilience in the financial sector
- ISO 27001 and ISO 27002International standards for managing information security, with their related measures
- NIST 800-171US requirements for protecting sensitive information at government suppliers
- CMMC level 1 and 2Requirements for suppliers to the US Department of Defense
- CIS IG1 and IG2Basic security measures in priority order, steps 1 and 2
- SOC 2US framework for reviewing how service providers protect data
- UK Cyber EssentialsThe UK's basic cybersecurity requirements
- Def Stan 05-138The UK defence requirements for suppliers' cybersecurity
The templates come in four levels, from a basic level to an in-depth review, so you can choose by how important the supplier is. They can be exported to Word and are part of the Vendor assessment module.
Help with the whole NIS2 effort
Solvere Group also helps with NIS2 work: mapping what is missing, governance, incident handling and the supply chain. The platform and the advice can be used together or on their own.
Case study: NIS2 compliance
We mapped an international industrial group against NIS2, the EU's supplementary NIS2 rules and the Swedish Protective Security Act. We then drew up a phased five-year plan. Supply chain risk management is one part of it.
Advice on cybersecurity and regulations
Support with NIS2, the ISO 27000 series, NIST 800-171, CMMC and UK Cyber Essentials, adapted to your organisation.
See how you take control of your suppliers
In 30 minutes we show how you send questions to a supplier, review the answers and sign the decision. Then we work out a price that fits you.