Sweden MCFFS 2026:12 Security Audit and Security Scanning Regulations 3:3: The supervisory authority must ensure a security scan goes no further than supervision requires and covers only systems the operator controls within its own activities

What else in your programme already covers this

This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in 3 kap. Säkerhetsskanning: security scanning of the operator's digital environment (3 kap. 1 to 9 §§) – Sweden MCFFS 2026:12 Security Audit and Security Scanning Regulations

• 3:1 Through security scanning the supervisory authority assesses the effectiveness of the security measures implemented in the operator's digital environment
• 3:2 A security scan is performed by a supervisory authority, which may engage an external actor, and by personnel with knowledge sufficient for the assignment
• 3:4 The supervisory authority must ensure a security scan is carried out so that negative impact on system functionality and other adverse consequences for the operator are minimised
• 3:5 When an external actor performs a security scan, the supervisory authority must ensure it is bound by no confidentiality agreement with the operator that limits the authority's access, protects assignment information securely, uses the information only for that scan, and destroys it afterwards unless otherwise agreed with the operator
• 3:6 In choosing a scanning method the supervisory authority must consider the systems' importance to the operator's activities, and where a significant risk of adverse consequences is identified must consider alternative methods and whether to scan at all
• 3:7 Before deciding to scan, the supervisory authority must ensure the operator and the systems were selected by a risk-based method and that the methods to be used suit the identified risks and the systems, and must document that assessment and decision
• 3:8 Before a security scan, unless special reasons weigh against it, the supervisory authority together with the operator must assess the risk of operational impact, plan the scan to minimise system load, prepare a plan to abort the scan, and assess the need to secure recovery of systems that could be harmed
• 3:9 The supervisory authority must ensure the operator is informed without delay and in an appropriate manner of shortcomings and vulnerabilities found in a security scan so that it can act promptly