> Source: https://complior.se/en/compliance/ Compliance / From requirements to working practices # Requirements on paper. Control in everyday operations. Make security requirements concrete in your environment. We help you with technology, agreed operations and documented controls that can be followed up. [Discuss your requirements →](https://complior.se/en/contact/) - 01 / UNDERSTAND Your requirements and risks Start with your information, your organisation and the regulations that affect you. - 02 / DESIGN Clear control points Decide on technical protection, responsibilities and the activities to be carried out. - 03 / FOLLOW UP Evidence that can be reviewed Document the work and follow up on shortcomings, changes and actions. Where Complior contributes ## Three areas. Practical controls. Organise requirements around what you need to control. Service scope and responsibilities are defined for your environment. - 01 ### Infrastructure & operations A Swedish platform, hardening, updates, backup and follow-up within the agreed service scope. [Explore Compliant Cloud →](https://complior.se/en/compliant-cloud/) - 02 ### Data protection & keys KMS and HSM for key management and cryptographic protection. The control model depends on the integration. [Explore KMS & HSM →](https://complior.se/en/key-management/) - 03 ### Identity & access Identification, authentication and permissions through IDombud's services. [Understand identity & access →](https://complior.se/en/idp/) Complior's managed operations services apply to its own infrastructure. For cloud, SaaS and other environments, integrations and responsibilities need to be assessed separately. Navigate the requirements ## Different requirements. A structured approach. The rules have different purposes and scopes. Start by determining what applies to you and which documentation you need. ### GDPR Personal data #### What does it cover? Principles and responsibilities for processing personal data. Security is part of the work, alongside matters such as lawful basis, purpose and data subjects' rights. [Guidance from IMY ↗](https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/grundlaggande-principer/) #### Bring to your provider discussions What data is processed, where does processing take place and who has access? Review data processing agreements, technical protection and any transfers to third countries. [Data protection & key control →](https://complior.se/en/key-management/) ### NIS2 Cybersecurity #### What does it cover? The EU's cybersecurity directive has been implemented in Sweden through the Swedish Cybersecurity Act. Organisations within scope are subject to requirements for risk management, security measures and incident reporting. [Swedish guidance from NCSC ↗](https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/) #### Bring to your provider discussions How are vulnerabilities, continuity and supplier dependencies managed? Agree contact channels and supporting records for your own incident management and follow-up. [Security work in Compliant Cloud →](https://complior.se/en/compliant-cloud/#cc-assurance) ### DORA Financial sector #### What does it cover? The EU regulation on digital operational resilience for financial entities. It covers areas including ICT risks, incident reporting, testing and risks associated with third-party providers. [About DORA at Finansinspektionen ↗](https://www.fi.se/sv/betalningar/it-risker-dora/om-dora/) #### Bring to your provider discussions What dependencies do you have on the provider? Agree contracts, continuity objectives, testing, follow-up and how future changes to the service will be handled. [Managed operations services and responsibilities →](https://complior.se/en/compliant-cloud/#cc-operations) ### PCI DSS Card information #### What does it cover? A security standard for protecting card information. The systems and processes included in the assessment scope need to be clearly defined. [The standard at PCI SSC ↗](https://www.pcisecuritystandards.org/standards/pci-dss/) #### Bring to your provider discussions Request a current Attestation of Compliance (AOC), confirming compliance within the stated assessment scope. Clarify which requirements the provider addresses and which activities remain your responsibility. [Swedish foundation and audit evidence →](https://complior.se/en/trust/) This is an overview. Your compliance needs to be assessed across the organisation as a whole. Neither a particular data location, encryption nor a provider's certificates alone means that all your requirements are met. An agreed managed operations service ## What does Compliance involve? In Compliant Cloud, Compliance is also the name of a managed operations service. It covers more extensive security work and documented follow-up on Complior's own infrastructure. [Compare On Call, Premium and Compliance →](https://complior.se/en/compliant-cloud/#cc-operations) Examples of agreed activities - Hardening, critical system updates and review of security logs. - Internal and external vulnerability checks. - Quarterly documentation for follow-up and audit. Supporting records may cover critical updates, vulnerability findings, network diagrams and firewall rule reviews, as agreed. You remain responsible for your organisation's overall compliance. Start with the right questions ## What do you need to demonstrate? Bring your key requirements and the evidence you need to provide. Together, we review your environment, possible controls and who is responsible for what. [Discuss your requirements →](https://complior.se/en/contact/) [Explore our Swedish foundation →](https://complior.se/en/trust/) - Which information and systems are involved? - Which requirements and risks have you identified? - Which controls do you perform yourselves, and where is support needed? - What evidence do management, customers or auditors need?