CER
Essential services must withstand disruption
The EU directive on the resilience of critical entities is called CER. It is about protection against anything that could stop an essential service, not only cyberattacks. Most EU countries already apply it, and Sweden proposes a new law from 1 January 2027.
The directive
What CER is
CER is Directive (EU) 2022/2557. Member states were to transpose it by 17 October 2024. They were to identify their critical entities by 17 July 2026.
Many countries have already transposed the directive, including Denmark, Finland, Italy, Belgium and Austria. Sweden, France and the Netherlands have not yet done so. The European Commission has therefore referred them to the EU Court of Justice.
CER
Covers resilience in general. That includes natural disasters, sabotage, terrorism and cyberattacks.
NIS2
Covers cybersecurity. An entity identified as critical under CER is also an essential entity under NIS2.
In Sweden
A new law on the resilience of critical entities
The Swedish government submitted bill 2025/26:303 to the Riksdag in July 2026. The law is proposed to apply from 1 January 2027. Check whether the Riksdag has adopted it before you plan.
The law covers eleven sectors, including energy, transport, health care, drinking water and food. An authority decides which entities are critical. The entity is notified of the decision in writing.
| Requirement | When it applies |
|---|---|
| Carry out a risk assessment | Nine months after the decision |
| Take measures and follow a resilience plan | Ten months after the decision |
| Run background checks on staff in certain roles | Ten months after the decision |
| Report incidents within 24 hours and submit a report within one month | Ten months after the decision |
| Appoint a contact point for the supervisory authority | Ten months after the decision |
The measures must be appropriate and proportionate. They can be technical, security-related and organisational. Entities that do not comply can be fined. For companies, the fine can reach 2 percent of global turnover or EUR 10 million, whichever is higher.
The review
What XoT helps with
The table shows what the law requires and what XoT does. The rows where XoT helps are marked in green.
| Need | What XoT does | XoT |
|---|---|---|
| Technical protection against unauthorised access to systems | A Lock in front of the equipment. It is invisible to unauthorised users. | Yes |
| Control who reaches the most important systems | Access per person, device and time. Each request can be approved. | Yes |
| Limit the consequences of an incident | The network is divided into smaller parts. An attack does not spread between them. | Yes |
| Secure remote access for vendors | Time-limited access through the XoT-Bridge, with no open ports. | Yes |
| Evidence when an incident must be reported | The XMS logs connections and changes. The logs can be sent to your SIEM. | Partly |
| Risk assessment and resilience plan | The entity does this itself. | No |
| Physical protection, backup power and background checks | These are outside XoT. | No |
A SIEM is a system that collects and analyses logs.
The sectors
Examples from the sectors we work in
Energy
Substations, power plants and district heating have control systems that are often old and hard to update.
Food
CER covers the production, processing and distribution of food. Our assessment is that individual stores will rarely be identified. Warehouses, distribution and large food producers may be.
Common questions
Are we in scope?
An authority decides this. If you matter for energy, water, food or health care, you may be identified. If you are already in scope of NIS2, it is worth preparing.
Does CER already apply in other countries?
Yes, in most EU countries. If you operate in Finland or Denmark, for example, the law may already apply there.
Is XoT enough to comply?
No. XoT helps protect systems and the access to them. You do the risk assessment, the plan and the physical protection yourselves.
How does CER relate to NIS2?
NIS2 sets cybersecurity requirements. CER sets resilience requirements in general. An entity that is critical under CER is also an essential entity under NIS2.
This is our reading of the directive and the Swedish bill, not legal advice.
Have you received, or are you expecting, a decision?
We are happy to show how XoT can be part of your resilience measures.