Responsibility you can show
Every Control has an owner, a date and evidence. Management sees the status in one place – the training requirement included.
Solutions · Prepare for NIS2
NIS2 puts the responsibility on management. Show that you are in control.
Map the requirements to Controls, give every measure an owner, bring your suppliers into the same thread and run incidents with the deadlines built in – on the foundation that also holds your contracts.
NIS2Cybersecurity ActISO 27001
Incident · Service outage
- Early warningSent · 14 h
- NotificationDue in 41 h
- Final reportDue 12 Dec
- OwnerSecurity Officer
Sound familiar?
Sound familiar?
“We have the policies. We can't show that anyone follows them.”
“Supplier security lives in a spreadsheet nobody owns.”
“If an incident happens on a Friday night – who reports it, and to whom?”
Why now
The law is in force. The accountability is personal.
Sweden's Cybersecurity Act, which implements NIS2, has applied since 15 January 2026. Management must be trained in cybersecurity and answers for the risk-management measures. For essential entities, fees can reach EUR 10 million or 2% of global annual turnover.
Source: Swedish Civil Contingencies Agency (MCF) and the Riksdag committee report on the Cybersecurity Act.
Today's alternatives and what good looks like
How it is usually solved
- Spreadsheets and SharePointCheap to start, impossible to prove.
- A separate GRC toolStrong on controls, blind to your contracts and suppliers.
- A consultant projectA good report – then the work comes back to you.
What good looks like
- Every measure has an owner and a date.
- Evidence is collected where the work happens.
- Management sees the status without asking.
How it runs in Paragraf
From the law to a board-ready status in five steps.
Step 1 of 5
Decide what is covered.
Mark the entities, services and Workspaces that fall under NIS2. Everything else keeps working as before.
Scope · NIS2
- Entities in scope3 of 7
- Critical servicesPayments, Logistics
- WorkspacesSecurity, Procurement
Step 2 of 5
Turn requirements into Controls.
The measures in article 21 become Controls in the NIS2 framework. Reuse what you already do for ISO 27001.
NIS2 art. 21 · Controls
- Risk analysisCurrent
- Incident handlingCurrent
- Supply chain securityMissing evidence
- Training for managementDue 30 Nov
Step 3 of 5
Give every Control an owner.
Each Control gets an Obligation Task with an owner, a date and a recurrence. Nothing depends on someone's memory.
Obligation Tasks
- Supply chain securityHead of Procurement
- Access reviewIT Manager · quarterly
- Management trainingCEO · yearly
Step 4 of 5
Bring suppliers into the thread.
Link supplier agreements to the Control. Luis finds the security clauses, and a supplier review Process collects the evidence.
Supplier review · Nordlog AB
- ClauseSupplier agreement § 14.2
- Self-assessmentReceived
- ReviewStep 3 of 5
- EvidenceSigned with BankID
Step 5 of 5
Run incidents with the clock built in.
An incident Process tracks the NIS2 deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within a month.
Incident · Service outage
- Early warningSent · 14 h
- NotificationDue in 41 h
- Final reportDue 12 Dec
- OwnerSecurity Officer
What you get
Three things that change.
Suppliers in the same thread
The supplier agreement, its security clause and the latest review are linked. No separate supplier spreadsheet.
Incidents with a clock
The deadlines are part of the Process, with owners and a log of every step, so the report is ready when it is due.
When the board asks, the answer is one click away.
Every Control, owner and piece of evidence in one view – so the people who answer for NIS2 can show it, not just say it.
Before you decide
The questions that usually hold teams back.
Changing how work is followed up is a real decision. Here is how we make it a safe one.
Where do we start?
With one situation, not the whole organisation. We go through your systems and requirements together, set up the first flow with you, and then your teams build further on their own.
Do we have to change how we work?
No. Start from the contracts, templates and policies you already have. Paragraf takes over the follow-up – who does what, by when, and what proves it.
What happens to our data?
It stays yours. Everything follows your permissions, sensitive data is masked on the server and every change is logged. Ask us where data is stored and how export works – we answer in writing before you decide.
What if it isn't right for us?
Start with a limited first scope and clear acceptance criteria, agreed up front. You evaluate on your own data before you expand.
For the buying group
Everyone in the decision gets an answer.
A decision like this involves many people. This is what each of them can say when they bring it to the others.
- CEO“Management can see that we are in control – without asking around.”
- Compliance“I can show evidence to the auditor or supervisor whenever they ask.”
- CISO“It follows our permissions and gives one log for people, systems and AI.”
- Procurement“Supplier terms, dates and reviews have owners, not reminders.”
- CIO“One data model instead of another silo – and teams can build on it.”
Related
- Supplier contracts under NIS2 and DORAFind the gaps in what you have signed→
- TrainingPolicies turned into lessons people understand→
- Meet DORAICT contracts, register and exit plans in one place→
Next step
Fewer systems.
More control.
Book a walkthrough of your systems and requirements. We show you the thread from requirement to proof – with your own requirements.