NIS2
How XoT helps you with the requirements in NIS2
NIS2 is the EU directive on cybersecurity. It lists ten areas in which organisations must take measures. Here we go through all ten and show where XoT helps.
The law in Sweden
The Swedish Cybersecurity Act has applied since January 2026
In Sweden, NIS2 applies through the Swedish Cybersecurity Act. The Act came into force on 15 January 2026. The Swedish Civil Defence Agency coordinates the work. Each sector also has one or more supervisory authorities of its own.
Whether the Act applies to your organisation depends on your sector and size. We do not make that assessment for you.
Point by point
The ten points in Article 21.2
The table shows the ten areas that the directive lists in Article 21.2. The last column shows whether XoT helps.
| Point | Area | XoT |
|---|---|---|
| a | Risk analysis and information system security | No |
| b | Incident handling | No |
| c | Business continuity, backups and crisis management | No |
| d | Supply chain security | Partly |
| e | Security in acquisition, development and maintenance, including vulnerability handling | Partly |
| f | Procedures to assess whether the measures work | No |
| g | Basic cyber hygiene and training | No |
| h | Cryptography and encryption | Partly |
| i | Human resources security, access control and asset management | Partly |
| j | Multi-factor or continuous authentication, secure communications | Partly |
XoT helps with part of the requirements in five of the ten points. The remaining five concern work in your organisation that no product can do for you.
Where XoT helps
Five points where XoT helps with part of the requirements
h – cryptography and encryption
XoT encrypts the traffic to the equipment with WireGuard. The point also covers your company's procedures for using encryption. You need to draw those up yourself.
Point h is often confused with point j. Encryption is point h. Multi-factor authentication and continuous authentication are point j.
i – access control
Each authorisation applies to a specific user, specific equipment and a specific period. XoT has no shared logins and no passwords of its own. The point also covers human resources security and asset management. XoT does not help with those.
j – continuous authentication
The point mentions multi-factor authentication, where users show at least two different kinds of proof of identity. It also mentions continuous authentication, where identity is checked throughout the connection.
In XoT, the user and the Lock check each other twice a minute while the connection is open. XoT can also require multi-factor authentication through your identity service. The point also covers secure voice, video and text communication. XoT does not help with that.
d – supply chain
The point covers security in your relationships with suppliers. XoT limits what a vendor can reach. Contracts, follow-up and audits of vendors remain your company's work.
e – vulnerability handling
XoT does not remove vulnerabilities in the equipment. But the Lock stops all traffic to the equipment from anyone without an authorisation. This is called a compensating control, because it reduces the risk without removing the vulnerability. Describe the protection in those terms in your documentation.
Traceability
The log shows that access was controlled
Controlling access is only half the job. You also need to be able to show it afterwards.
Remote Access logs every connection. The log shows who connected, to what, from where, when and for how long. You can forward the log to a SIEM system, which collects logs from across the organisation.
Penalties
Fines under the directive
The directive divides organisations into two groups: essential and important entities. The Swedish Act calls them essential and important operators.
Article 34 of the directive sets how high the fines must be able to go. For essential entities, the maximum fine must be at least EUR 10 million or 2 per cent of global annual turnover. The higher of the two amounts applies. For important entities, the corresponding levels are EUR 7 million and 1.4 per cent.
These are the directive's levels. Swedish law and the supervisory authorities decide how they are applied in Sweden.
Common questions
Do we comply with NIS2 if we use XoT?
No, not through XoT alone. XoT helps with part of the requirements in five of the ten points in Article 21.2. The rest is work in your organisation.
Can we use XoT for equipment that cannot be updated?
Yes. The Lock stops traffic to the equipment from anyone without an authorisation. State in your documentation that the vulnerabilities remain but that unauthorised users cannot reach them.
Do you help with the documentation?
We describe exactly what XoT does. You assess whether your company complies with the law yourselves, ideally together with a lawyer or auditor.
Does NIS2 apply to our organisation?
It depends on your sector and size. We do not make that assessment for you.
What we write here is our interpretation of the directive. It is not legal advice.
Ask for material
We are happy to explain how XoT can be described in your NIS2 documentation.