Developments in the world situation in recent years and Sweden’s accession to NATO have put the country’s preparedness to the test.
All actors in society, including the country’s organisations, are being called upon to strengthen their ability to manage and prevent crises, disruptions and interruptions to society and to their operations. One of the directives aimed at strengthening resilience in critical sectors is the CER Directive (Critical Entities Resilience). Critical activities are activities, services or infrastructure that maintain or ensure societal functions necessary for society’s basic needs, values or security.
The directive covers certain critical activities in the following sectors:
• Energy
• Financial services
• Health and social care
• Food supply and drinking water
• Transport
It also covers certain parts of:
• Public administration
• Industry
• Research
The CER Directive is expected to enter into force in Sweden in 2026, and by then the country must have completed the identification of the critical entities it covers.
In practice, this means that organisations covered by the directive need to establish a structured approach to their physical security, while the NIS2 Directive sets requirements for cyber security. Physical security includes the ability to carry out risk assessments, having processes for how operations can continue even in a crisis, control over who is present on the premises, supplier management and clear incident procedures. Consequently, the directive also affects suppliers to these organisations, as any shortcomings on the part of a supplier could have negative consequences for operations.
A large part of physical security is about having control over who is on the premises, why they are there and for how long. For this reason, a visitor management system is an extremely important part of an organisation’s security, and the system and its supplier are therefore obliged to comply with the requirements of the CER Directive. PartnerSec works methodically and consistently to meet the directive’s requirements for physical security as a supplier of visitor management systems to critical infrastructure.
Our visitor management system CavVisit has a wide range of features that give administrators full traceability of their visitors, as well as the ability to produce various reports and logs in line with the requirements of the CER and NIS2 directives. Hosts can easily approve or reject a visit, ensuring that every visitor is authorised and approved by the organisation. The ability to pre-book a visit and, at the same time, let visitors accept the company’s policy relevant to the visit in advance ensures that no visitor can check in without having read and accepted the required policy. It is also possible to trace when the visitor accepted the policy and which version was accepted.
CavVisit has well-designed check-in and check-out processes that send a reminder to the host if a visitor has not checked out, giving an exact picture of who is actually on the premises at any given time.
CavVisit has been developed to meet the requirements of the CER Directive, but the work does not end there. A modern visitor management system must be able to adapt to new directives and regulations; only then can it be a sustainable part of an organisation’s security.
