MUST
Swedish Military Intelligence and Security Service — experience of requirements for security-protected procurement.
Compliance & Frameworks
Frameworks, oversight and evidence that holds.
NIS2, DORA, CRA, CER, GDPR, the Swedish Protective Security Act and more. We issue no certificates — we deliver the technical evidence that auditors, supervisory authorities and management systems need.
Frameworks & regulations
Evidence for regulatory compliance
Our penetration tests and audits are designed so findings, remediation and evidence can be used directly in your compliance work. The table shows what we can deliver as supporting evidence.
| Framework | Scope | What we deliver as evidence |
|---|---|---|
| NIS2 | Essential and important entities across the EU | Penetration tests, incident routines and remediation evidence for risk management |
| DORA | Financial entities — ICT risk and digital resilience | Testing of critical systems, third-party risk and incident exercises |
| CRA | Products with digital elements (Cyber Resilience Act) | Security testing and vulnerability management for products |
| CER | Critical infrastructure — resilience of critical entities | Resilience testing, dependency analysis and incident preparedness |
| GDPR | Personal data — privacy and information security | Technical and organisational safeguards, Article 32 |
| Säkerhetsskyddslagen | Security-sensitive operations in Sweden | Security vetting, classification and protective security analysis |
| SSMFS | Nuclear operations (Swedish Radiation Safety Authority) | IT security reviews for nuclear facilities |
| IAEA | International nuclear material control | Protective security and information security for nuclear material |
| IEC 62443 | Industrial control systems (ICS/OT) | Segmentation, network security and OT penetration tests |
| NERC CIP | Electric power systems — critical infrastructure | Protection of operational environments and control systems |
| PDL | Patient Data Act — healthcare | Access control, logging and confidentiality in care systems |
| MDR | Medical devices | Security testing for medical device software |
| EHDS | European Health Data Space | Protection of health data and access control |
| ISO 27001 | Information security management systems | Pentests, risk assessments and evidence for Annex A controls |
| SOC 2 | Cloud and SaaS providers | Testing of availability, security and confidentiality |
| PCI DSS | Card payments | Penetration tests and segmentation for card data |
| CIS | Baseline hardening (Center for Internet Security) | Configuration review and hardening audits |
| NIST | Cybersecurity frameworks (CSF/800-53) | Gap analysis and technical controls against NIST requirements |
We do not issue certificates and do not approve audits. Certification is issued by accredited audit bodies — our role is to produce the technical evidence that makes the audit possible to pass.
Authorities
MUST, FRA, the Government Offices and Sida
Our consultants have long backgrounds from work close to the Swedish Armed Forces, signals intelligence and the Government Offices — not as employees, but as consultants in close cooperation. We are used to their requirements for protective security, confidentiality and delivery reliability.
FRA
National Defence Radio Establishment — background in signals intelligence and secure communications.
Regeringskansliet
Experience of assignments close to the Swedish Government Offices — strict confidentiality requirements.
Sida
Swedish International Development Cooperation Agency — security for international operations.
Protective Security & Total Defence
Protective security and total defence
For organisations covered by the Swedish Protective Security Act or part of total defence, we help with the technical evidence: protective security analysis, classification, security vetting and hardening of systems critical to Sweden's ability to sustain essential services.
- Protective security analysis and classification
- Technical evidence for security vetting
- Hardening of systems in total-defence-critical operations
- Continuity planning for crisis and heightened alert
Evidence & redacted reports
Evidence and redacted reports
Redacted reports and proof of completed engagements are published under Disclosures — to the extent the engagements are not covered by confidentiality.
Do you need evidence for an audit?
Tell us which framework applies to your organisation and we will get back to you with a plan and a quote.