Swedish Energy Agency Cooperation Cybersecurity NIS-implementation

NIS-implementation

Implementation of the NIS Directive The National cyber security policy Law and ordinance Regulations

Information for operators of essential services (OES) in the Energy sector

If an incident occurs in your network or information system that affects the continuity of the provision of the service, you are then obliged to report this. One of the basic requirements is that actors affected by the legislation must report to the responsible supervisory authority.

This applies in accordance with the Act (2018: 1174) on information security for Essential services and Digital services.A supplier of essential services in the Energy sector must report to the Swedish Energy Agency without delay.

 

  • The Swedish Energy Agency

    The Swedish Energy Agency is the supervisory authority for companies and businesses that have identified themselves as OEC in the energy sector.Actors in the diverse sectors of the Swedish society are themselves responsible for identifying whether they are affected by the legislation or not. The law covers both the private and public sectors.

    Checklist: Does your business meet the basic criteria?

    There are four criteria that must be met for your company or business to be considered a provider of OEC:

    • The service that you deliver must be of essential services as described in- Swedish Civil Contingencies Agency (MSB) MSB's regulation 2018: 7
    • The company or business must be established in Sweden
    • The delivery of essential services is depending on a network and information system
    • An incident in the network and information system would disrupt the continuity of the provision of the OEC  

    The Swedish Civil Contingencies Agency regulation 2021:9 (pdf, swedish)

  • Criteria for Operator of essential services in electricity

    Electricity

    To be an OEC in electricity, you must, in addition to the basic criteria, meet at least one of the following criteria:

    1. electricity transmission provided by a certified transmission network company in accordance with the Act (2011: 710) on certification of transmission network companies for electricity.
    2. electricity transmission in regional networks as defined in § 2 14 p The Energy Market Inspectorate's regulations (EIFS 2020: 2) on amendments to the Energy Market Inspectorate's regulations and general guidelines (EIFS 2012: 4) on the reporting of network activities3.
    3. electricity distribution to electricity users with a board of priority class 1–5 in accordance with section 5 of the ordinance (2011: 931) on planning for prioritization OEC electricity users4.
    4. electricity production directly, or via production networks, connected to trunk or regional networks with the exception of industrial back pressure or other electricity production directly connected to industry, if
      1. installed capacity in a cohesive production facility exceeds 30 MW, or
      2. The supply agreement also covers production with balance risk or with support services for network stability, or
    5. electricity trading conducted by the person who has undertaken balance responsibility in accordance with the Electricity Act (1997: 857).  
      Wind farms and / or solar parks where several suppliers have production facilities that share a connection point to the overhead network, shall be regarded as a production facility when calculating installed capacity or when producing with balance risk or support services.

  • Criteria for Operator of essential services in gas

    Gas

    To be a OEC in the gas supply, in addition to the basic criteria, you must meet at least one of the following criteria:

    1. Transmission System Responsibility Service (TSO);
    2. System balance responsibility service,
    3. System distribution service (DSO), or
    4.  gas suppliers with balance responsibility service.

  • Criteria for Operator of essential services in oil

    Oil

    To be a OEC in oil, you must in addition to the basic criteria meet at least one of the following criteria:

    The services of import, export, production, refining, processing or sales that handle at least:

    • 500,000 tonnes / year for petroleum-based fuels and fuels or
    • 50,000 tonnes / year of biofuels and biofuels.

    Fuel depots and depots with:

    • total capacity of at least 100,000 m³
    • total capacity of at least 20,000 m³ and of crucial importance for regional supply, or
    • total capacity of at least 10,000 m³ for jet fuel

    Transmission service in pipelines, own transmission or logistics for liquid fuels and fuels with capacity for:

    • 50,000 tonnes / year, or
    • 25,000 tonnes / year for jet fuel.

    A service under the first paragraph if it is performed for own use in an industrial area is not covered.Depot areas where several suppliers have tanks with common loading or unloading equipment shall be considered as a fuel warehouse when calculating volume

  • Registration

    It is the legal person who delivers the service who must register. If you have identified several areas in the company or business where you are OEC,  you must send in a application per area.

    1. 1. Fill in the application form (form in swedish): Anmälan för leverantörer av samhällsviktiga tjänster - Energisektorn
    2. 2. Enter the contact person and responsible for incident reporting accounts in the report. Additional reporters for incident reporting are reported to the Swedish Civil Contingencies Agency.  
    3. 3. Print out the form
    4. 4. Send your application by “registered letter” (rekommenderad brev) to the address:
      The Swedish Energy Agency
      Att: Supervision NIS
      Box 310
      631 04 Eskilstuna

     

    What happens when I submit a report?

    Please note that the Swedish Energy Agency does not confirm any notification via email. This with regard to possible protection values, individually and at an overall level.When your business has registered, you will be contacted for quality assurance of registration by phone.

    We forward your report to the Swedish Civil Contingencies Agency (MSB). MSB compiles all Swedish suppliers and reports them to the EU.MSB establishes personal accounts and certificates for incident reporting.

    You state who will be the contact person and responsible for incident reporting accounts in your report. To report additional reporters, you will be contacted by MSB.

    MSB contacts all designated incident reporters via e-mail and SMS. You will receive instructions on how to activate accounts and download certificates. 

  • Report changes

    Report changes via the application form (form in swedish):

    Anmäl förändringar via anmälningsformuläret

    Examples of changes that must be reported to the Swedish Energy Agency

    • Change of contact person and responsible for incident reporting accounts.
    • Change in information about activities for providers of OEC in the energy sector.
    • Cancellation of activities for providers of OEC in the energy sector.

    Please note that changes to additional incident reporters are reported to MSB.

    When you register your company or business as an OEC, we will process your personal data.We will pass on the name, e-mail address and mobile phone number to MSB.  We do this so that MSB can create a personal account for incident reporting. An account is required to be able to report incidents in accordance with MSB's regulations.

  • Iceland

Last updated: 2022-07-20
Cookies