NIS2 asks for evidence.Here it is
The Cybersecurity Act has applied since 15 January 2026, and its rules on security measures apply from 1 October 2026. PollySec watches your attack surface all year and gives you a technical evidence report mapped to Article 21(2), as a PDF your auditor can read.
The reports
In force since January.Security measures from 1 October
Sweden's Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) is the Swedish NIS2 law. It arrives in two steps.
15 January 2026
The Swedish NIS2 law has applied since this date.
1 October 2026
The rules on security measures, management training, and security audits and scans apply from this date.
Covered yourself,or asked by a customer
NIS2 reaches you in one of two ways. Either way, someone will ask you to show your security measures work.
You are covered
Around 1,500 Swedish companies are covered directly (Prop. 2025/26:28), managed IT service providers among them. You need evidence that your measures work, all year.
Your customer is covered
Not covered yourself? NCSC still advises reviewing the requirements, because covered customers pass them on to their suppliers. Your customer's NIS2 becomes your questionnaire.
Mapped pointby point
The NIS2 Technical Evidence Report maps what PollySec measures to the risk-management measures in Article 21(2), the same points the Cybersecurity Act restates. Each row says what it evidences and where that evidence stops.
Risk analysis
A discovered asset inventory with active/inactive status and a risk-ranked asset table, as input for your risk analysis.
Vulnerability handling
Findings with severity, CVE, known-exploited flag, status and age.
Effectiveness
Remediation aging: open count, median age, and what has been open past 30 and 90 days.
Asset management
Assets with active/inactive status and last-seen date.
The report is evidence for the technical side of these measures. Policies, procedures and the rest of your NIS2 programme are documented outside the platform. PollySec supports compliance. It does not certify it.
Answer the questionnairewith a link
Send your customer a trust link instead of filling in another questionnaire: a report of your security posture that they can open without an account.
Expires and can be revoked
You choose how long it lives, from 1 to 180 days, and you can revoke it at any time.
Counts only
It shows the numbers, not the findings. Hostnames appear only if you choose to include them.
A frozen snapshot
The page shows your posture as it was when you shared it, so what the customer reads is what you sent.
Watchingall year
An audit asks what was true all year. PollySec watches all year, outside and inside, and ranks every finding on one score from 0 to 100.
External + internal
The internet-facing surface and the internal network, in one inventory.
Checked findings
Serious findings are tested live by ARIA where a test can settle them. A finding that turns out wrong is withdrawn, never counted as fixed.
ISO 27001 too
The same data, mapped to ISO/IEC 27001:2022 Annex A in its own report.
ISO 27001 evidenceGet your NIS2 evidence started
We'll generate the NIS2 report on a live surface with you, and show you the trust link.
Book a demo