Areas /Information security
The large customer wants to see your information security policy before signing.
You have one. It is from 2023 and does not mention the cloud service you moved to.
-
Information security policy
GDPR Article 32
-
Routine for access and permissions
GDPR Article 32
-
Supplier requirements
Customer requirements and GDPR Article 28(3)
-
Material for security questionnaires
Customer requirements
In plain terms: no Swedish statute says you must have an information security policy. The requirement arrives anyway, from two directions.
The GDPR requires appropriate technical and organisational measures for a level of security that matches the risk. That is a requirement about outcome rather than about a particular document, but in practice you need to write down how you work.
The other direction is your customers. Their questionnaires go further than the law, and they get tighter every year as requirements travel down the supply chain.
Do any of these sound familiar?
- What do you answer when the next customer sends a security questionnaire?
- Where is it written who should have access to what?
- What requirements do you place on your own suppliers?
Examples of the documents you get
| DOCUMENT | STATUTE |
|---|---|
| Information security policy | GDPR Article 32 |
| Routine for access and permissions | GDPR Article 32 |
| Supplier requirements | Customer requirements and GDPR Article 28(3) |
| Material for security questionnaires | Customer requirements |
Do we have an escalation routine for a serious incident at a customer?
Often it lives in the heads of a few people. Write it before you need it, because once the incident is happening there is no time left to agree on anything.
Johan Gerebro, CEO and co-founder, answers the question we get most. The Swedish cybersecurity act covers eighteen designated sectors. Outside those you are not caught, whatever your size. ISO 27001 is a voluntary certification rather than a legal requirement. The requirement can still reach you: a customer who is caught by it passes the terms down by contract, and then it makes no difference that the act does not point at you.
Checked against GDPR Article 32 · Updated 10 October 2026
With Ordning
You know where the documents are, that they are the current version when created, and that they cover what you need.
With Kontroll
You know it holds together every day. Change the AI policy and you see what it means for the IT security policy.