Schema record
@proseid v2026.01.15 SE

Swedish Cybersecurity Act significant-incident report

Records the documented applicability decision for Sweden's Cybersecurity Act, then captures a potentially significant incident and tracks the applicable 24-hour initial notice, 24- or 72-hour incident notification, and final or status report.

Compatible with
FormGuided assessmentDeterminationCompliance checklistAPI
Use Schema in a Flow
Publication
Protocol
Proseid_v1.0
Version
v2026.01.15
Applies in
Sweden
Recommended language
English
Fields
43
Flow price
$0.20
Publisher fee
None
Standard base $0.20 · exact total is frozen when a Flow is created
Legal history

Time periods

swedish_cybersecurity_act_20262026-01-15 → continues indefinitely
Current
Controlling sources
Cybersäkerhetslag (2025:1506) 1 kap. 3–16 §§; 2 kap. 5–10 §§
Source ↗
Cybersäkerhetsförordning (2025:1507) 6 § and 31 §
Source ↗
Directive (EU) 2022/2555 (NIS2) Articles 2, 3 and 23; Annexes I and II
Source ↗
Commission Recommendation 2003/361/EC Annex, Articles 2–6
Source ↗

Schema fields

43 fields
Reporting entity
String
—
Req
Applicability assessment reference
String
—
Req
A covered activity and the required Swedish nexus have been established
Boolean
—
Req
Size-independent or special scope basis
Select
Choices: None, Covered public entity, Sole critical or special importance, Trust service provider, Public electronic communications, TLD DNS or domain registration, Other formally confirmed basis
Req
Staff headcount used in the size assessment
Number
—
Opt
Annual turnover used in the size assessment (€)
Currency
—
Opt
Annual balance-sheet total used in the size assessment (€)
Currency
—
Opt
Required partner and linked-enterprise data were included
Boolean
—
Opt
Preliminary ordinary-route size result
String
—
Opt
DORA or equivalent sector rules displace these incident-reporting duties
Boolean
—
Req
The entity's applicability under the Swedish Cybersecurity Act is confirmed
Boolean
—
Req
Sector
Select
Choices: Energy, Transport, Banking, Financial market, Health, Drinking water, Waste water, Digital infrastructure, ICT service management, Public administration, Space, Postal, Waste, Chemicals, Food, Manufacturing, Digital providers, Research, Higher education
Req
Incident-notification deadline category
Select
Choices: Standard operator, Trust service provider
Req
When you became aware
Date
—
Req
Awareness time and time zone
String
—
Req
What happened
String
—
Req
Significant incident? (severe operational disruption, financial loss, or harm to others)
Boolean
—
Req
Suspected unlawful or malicious cause
Select
Choices: Yes, No, Not yet known
Req
The incident could have cross-border impact
Boolean
—
Opt
Initial incident notice submitted
Boolean
—
Opt
Initial-notice submission date, time, and zone
String
—
Opt
Initial notice submitted within 24 hours of awareness
Boolean
—
Opt
Fuller incident notification submitted
Boolean
—
Opt
Incident-notification submission date, time, and zone
String
—
Opt
Incident notification submitted within its 24- or 72-hour deadline
Boolean
—
Opt
Initial severity and impact assessment
String
—
Opt
Indicators of compromise are available
Boolean
—
Opt
Available indicators of compromise provided through the reporting channel
Boolean
—
Opt
The authority requested an interim report
Boolean
—
Opt
Requested interim report submitted
Boolean
—
Opt
Interim status update
String
—
Opt
One month has passed since the incident notification
Boolean
—
Opt
Incident still ongoing one month after the incident notification
Boolean
—
Opt
One-month status report submitted for an ongoing incident
Boolean
—
Opt
One-month status update
String
—
Opt
The incident has been handled after the one-month status report
Boolean
—
Opt
Final report submitted
Boolean
—
Opt
Detailed final incident description, severity, and impact
String
—
Opt
Threat type or root cause
String
—
Opt
Mitigation measures applied or in progress
String
—
Opt
It is appropriate to inform affected service recipients
Boolean
—
Opt
Affected service recipients informed without undue delay
Boolean
—
Opt
Swedish incident-reporting track
String
—
Opt

Example payload

JSON 
{
  "responses": {
    "entity_name": "",
    "scope_assessment_reference": "",
    "covered_activity_and_swedish_nexus": false,
    "size_independent_basis": "",
    "staff_headcount": null,
    "annual_turnover_eur": null,
    "annual_balance_sheet_total_eur": null,
    "partner_and_linked_enterprise_data_included": false,
    "dora_or_equivalent_sector_rules_displace_reporting": false,
    "nis2_scope_confirmed": false,
    "sector": "",
    "reporting_entity_type": "",
    "became_aware_at": "",
    "became_aware_time_and_zone": "",
    "incident_summary": "",
    "is_significant": false,
    "suspected_unlawful_or_malicious_cause": "",
    "cross_border_impact": false,
    "initial_notice_submitted": false,
    "initial_notice_submitted_at": "",
    "initial_notice_within_24_hours": false,
    "incident_notification_submitted": false,
    "incident_notification_submitted_at": "",
    "incident_notification_within_applicable_deadline": false,
    "initial_severity_and_impact_assessment": "",
    "indicators_of_compromise_available": false,
    "available_indicators_provided": false,
    "interim_report_requested": false,
    "interim_report_submitted": false,
    "interim_status_update_summary": "",
    "one_month_reporting_point_reached": false,
    "incident_still_ongoing_at_one_month": false,
    "status_report_submitted": false,
    "one_month_status_update_summary": "",
    "incident_handled_after_status_report": false,
    "final_report_submitted": false,
    "final_incident_description_and_impact": "",
    "threat_type_or_root_cause": "",
    "mitigation_measures": "",
    "service_recipient_notice_needed": false,
    "service_recipients_informed": false
  },
  "effective_at": "2026-07-30"
}

The request body this schema expects. Fill in responses and keep the field IDs unchanged. Validation becomes callable after you use this release in a published Flow.

API usage

Create a Flow from this schema, then replace the route placeholders with that Flow's organization and address. Validation is free and runs against the exact release bound to the Flow. It returns the engine's resolved fields and legal time period when ready, or a structured error with field-level issues.

cURL 
curl -X POST https://proseid.com/api/v1/validate/{your-org}/{flow-slug} \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @payload.json
200 OK
{
  "valid": true,
  "status": "READY",
  "definitions": { ... },
  "issues": [],
  "effective_at": "2026-07-19",
  "temporal_context": {
    "logic_version": "current",
    "valid_range": ["2026-01-01", null]
  }
}
422 Invalid
{
  "error": {
    "code": "validation_failed",
    "message": "the document did not pass validation",
    "details": {
      "status": "INCOMPLETE",
      "issues": [{
        "field_id": "entity_name",
        "kind": "missing_required",
        "severity": "error",
        "trigger": "completion",
        "message": "Required field is missing"
      }]
    }
  }
}
A completed webhook also depends on the Flow's experience, signing, pricing, and delivery settings. Create a Flow with this schema, then use Send sample completion in its delivery settings to receive the full signed JSON without using your balance. Webhook guide

Published versions

Permanent, attributable versions
Loading published versions…

Trust ledger

Crowd → credentialed
P
Provenance
Community publisher (unverified)
@proseid · latest v2026.01.15
Community signal
0
0 votes

No votes yet.

Attestations · by version
0 total

No attestations yet. A verified professional can vouch for a specific version.

Discussion

0 comments
to join the discussion.
Continue exploring
Browse all records →
v2026.07.27

Anmälan av allvarlig arbetsolycka eller allvarligt tillbud

@proseid · 14 fields

 v2026.07.26

FDA food-facility registration determination

@proseid · 17 fields

 v2026.06.19

EU right-of-withdrawal record

@proseid · 25 fields

 v2026.07.24

EU whistleblowing internal-report deadlines

@proseid · 48 fields