This study evaluates the preparedness of Swedish critical infrastructure for the NIS2 directive, which sets enhanced EU standards for information- and cybersecurity. The research reveals a generally low competence level, highlighting a lack of readiness for the directive’s requirements. Variations in competence are influenced by organizational size, resource availability, and existing strategic processes. Larger organizations with roles like CISOs tend to have higher competence levels, yet significant gaps remain in meeting the directive’s demands. The study emphasizes the need for comprehensive business and gap analyses to identify critical areas for improvement. Organizations should adopt strategic, systematic approaches to cybersecurity that integrate with existing processes. Enhancing competencies requires increased investment in education and training, supported by leadership committed to fostering a robust security culture. The NIS2 directive should be seen not as a regulatory burden but as an opportunity to enhance resilience against cyber threats. Methodologically, the study uses a consistent semi-structured interview approach with experts and authorities to ensure validity and reliability. Although the qualitative nature of the research limits generalizability, it offers critical insights into Sweden’s cybersecurity readiness and the need for strategic improvements.