Sweden MCFFS 2026:12 Security Audit and Security Scanning Regulations 2:9: Before a security audit begins the supervisory authority must have approved its scope and approach

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in 2 kap. Säkerhetsrevision: security audit by an independent body engaged by the supervisory authority (2 kap. 1 to 11 §§) – Sweden MCFFS 2026:12 Security Audit and Security Scanning Regulations

• 2:1 A security audit must assess the operator's level of cybersecurity and whether its security measures meet the requirements of the Cybersecurity Act and its subordinate regulation
• 2:10 If a previously unpublished vulnerability is found in the operator's digital environment during an audit, the supervisory authority must ensure the independent body informs the operator and the authority without delay and in an appropriate manner
• 2:11 After the audit the supervisory authority must ensure the independent body compiles the results in a written report and hands the report and other relevant documentation to the authority in the manner the authority directs
• 2:2 The independent body engaged for a security audit must be a legal person or sole trader whose staff have knowledge sufficient for the design of the assignment and, where needed, of the operator's business
• 2:3 The supervisory authority must ensure the independent body audits impartially, independently and objectively, is bound by no confidentiality agreement with the operator that limits the authority's access to information, protects assignment information securely, uses it only for the audit, and destroys it afterwards unless otherwise agreed with the operator
• 2:4 When a security audit starts, the supervisory authority must inform the operator of the assignment's scope, of its right to report shortcomings in the independent body's conduct of the audit, and of how to do so
• 2:5 The supervisory authority must ensure the independent body documents every deviation from compliance with the Cybersecurity Act and its subordinate regulation
• 2:6 A security audit checks both the design and the application of security measures and must be designed so it causes the operator no more cost or inconvenience than necessary