Anders Åhlgren isn’t your typical consultant. With decades of experience in information security management and advising the European Commission on the Network Code on Cybersecurity for the European Electrical Energy Sector in parallel with the NIS2 directive as well as Member of The EU Commission Smart Grid Task Force, he brings both policy expertise and hands-on pragmatism to every engagement.

Today, through his consultancy Protinus, he serves as a fractional Chief Information Security Officer (CISO) for 12 energy companies in Sweden. Most of these companies are small, often fewer than 40 employees, but they face the same compliance burdens as much larger enterprises.

To meet those demands without inflating costs or complexity, Anders relies on Cyberday.

“Cyberday is a part of my offer. I tell clients: yes, you can do this without it, but it’s going to be a lot of work.”

Low awareness, high stakes

When Anders begins work with a new client, he may find a familiar set of challenges: low cybersecurity maturity, limited in-house expertise, and leadership teams that underestimate the importance and scope of what’s required.

“The knowledge level can be low,” he says. “Leadership may not be very interested. And there are no rules in place. Few policies, and a lack of ownership.”

Still, regulatory pressure is mounting. While Sweden has yet to publish its national version of the NIS2 directive, the EU-level obligations are already on Anders’ and his clients' radar.

Unfortunately, without a clear framework or workflow, many companies struggle to even start. “One customer tried without me, and it ended up without any progress,” Anders recalls.

Cyberday as Protinus’ backbone

Cyberday became part of Anders’ consulting toolkit almost by accident. One of his first freelance clients had already implemented it, and he was expected to make it work.

“It was a horrible time at first,” he laughs. “But then I started to love it. I realized it could solve a lot of problems for the energy sector.”

Today, Cyberday is embedded in his consulting practice. Every Protinus client engagement begins the same way: get familiar with the tool, activate the NIS2 framework, and gradually build out the information security management system (ISMS).

Anders works with clients remotely, usually meeting online once a week for a few hours. In between, he remains available via email and can directly support their Cyberday environments.

How It Works: Anders’ NIS2 maturity model

Anders follows a step-by-step maturity model to help organizations gradually establish a working ISMS aligned with NIS2. The process spans five stages, from initial setup to full optimization. Here's how he guides his clients through it using Cyberday:

1. Initial

“Set up Cyberday in Teams.”
Clients begin by getting access to Cyberday and starting to explore it inside their Microsoft Teams environment. This helps them become familiar with the tool in their daily workflow.

2. Managed

“Work through the 104 tasks for NIS2.”
The next step is activating the NIS2 framework in Cyberday. Clients begin completing the 104 related tasks, which introduce them to the scope of compliance requirements and helps build momentum.

3. Defined

“Assign theme owners and perform an internal audit.”
As they progress, Anders encourages clients to delegate responsibility by assigning theme owners for HR, suppliers, plans, etc. This distributes the work and builds shared accountability. At this stage, they also conduct a basic internal audit.

4. Quantitatively Managed

“Address audit findings and launch the staff guidebook.”
Here, the team begins to close identified gaps. They address any nonconformities from the audit and create a guidebook in Cyberday to support ongoing training for staff.

5. Optimizing

“ISMS is now established.”
At this final stage, the ISMS is operational and embedded in day-to-day work. Organizations are managing:

• Deviations and incidents
• Continuous improvements
• Staff training
• Supplier controls
• Internal audits
• Management reviews