Before we take the step into 2024, we look back with great confidence on the record year 2023 – a year characterized by strong growth, refined collaborations, new customer relationships and, not least, many new fantastic employees who have laid the foundation for new opportunities as we tackle 2024 with great enthusiasm and faith in the future. The successes during the year are many and in this annual summary you will take part in 6 highlights from the past year.

1. NEW CEO – Birgitta Hedegård
   We have had the pleasure of welcoming many new and enthusiastic colleagues in 2023 and not least we have gained a new CEO in Birgitta Hedegård. Birgitta has long-standing experience from leading positions in the consulting brokerage and IT industry and has now been entrusted with leading Upgraded towards new successes. This has not only strengthened our corporate structure but also injected new energy and vision into our work.
2. Gazelle company
   We are proud to now call ourselves a Gazelle company. Upgraded’s strong growth in 2023 resulted in us being named a Gazelle company by Dagens Industri (DI). DI Gasell is an award that has been awarded annually by the newspaper Dagens Industri to Sweden’s fastest growing companies since 2000 and is an award that is awarded to less than one percent of all companies in Sweden.
3. Strong growth – turnover over 1 billion
   Even though there are still a few days left in 2023, it is clear that we will by a wide margin, for the first time, exceed a billion in sales in 2023. This means that we will be able to present sales growth exceeding 50% during the year. A fantastic achievement dedicated entirely to our outstanding employees and culture.
4. New graphic identity
   We have undergone a total makeover of our graphic identity, where we have refined not only our logo but our entire expression. This is to better reflect our commitment, our attitude and the professionalism you can expect from working with us.
5. New customers and strengthened collaborations
   The year has been marked by increased engagement with existing customers and partners, while we are proud to present a number of new and exciting clients. These include Region Skåne, Lund University, Adda Inköpscentral and others.
6. Expansion outside Sweden
   During the year, we have written the first chapters of our international journey by taking the step beyond Sweden’s borders and establishing ourselves in Norway and Denmark, with the vision of continuing the expansion in 2024.

Establishing ourselves in Norway and Denmark represents not only a symbolic achievement but also a concrete progress strategy for our expansion and presence on the Nordic scene.

We at Upgraded would like to extend a big thank you to our customers and partners for the past year and look forward with great confidence to 2024 as a year of continued growth, developing both new and existing partnerships and not least continuing to refine our fantastic culture!

Upgraded People AB has signed an agreement with the City of Landskrona and the Municipality of Eslöv for comprehensive IT consultancy services with an estimated value of 90 million sek.

By acting as a broker of expertise in the IT sector, Upgraded People AB has established itself as a reliable partner for companies, authorities and organizations that strive to improve their technical infrastructure. The agreement with the City of Landskrona and the Municipality of Eslöv means that Upgraded People AB will bring together competent IT experts with the cities’ needs for qualified services within Business Development and Strategy, Management and Governance, System Development and System Management, Data & Analysis, Information and IT Security, Usability, Infrastructure and Technology, and IT Support and Training.

“We always strive to offer our clients tailor-made solutions through a careful matching of qualified consultants with each client’s unique requirements and needs. We are very proud to have received this trust from Landskrona City and Eslöv Municipality and look forward to a stimulating and developing collaboration for all parties,” says Birgitta Hedegård, CEO of Upgraded People AB.

Upgraded People AB are experts in the placement of consultants with a specialization in the IT area. Upgraded was started in 2010 and is today established in 5 locations and has over 1000 consultants engaged in assignments across the Nordic market. Turnover for 2023 amounted to just under 1.1 billion.

On 18 October 2024, the NIS2 Directive will enter into force in the EU, replacing the original NIS Directive. The upgraded directive aims to improve collective cybersecurity within member states. This means that more organisations will have to meet stricter cybersecurity requirements. In this article, we will give you a summary of NIS2, find out what it is about, whether the directive affects your organisation and what you should do if so. What new security requirements are placed on these organisations and what is required to meet the new requirements? How do you get started with NIS compliance?

What are the major changes in NIS2?

• More sectors of organizations will be affected.
• Minimum requirements for actions will be introduced.
• More precise reporting requirements will be implemented.

Is your organization covered by the new NIS Directive?

The NIS Directive was created to increase the Union’s level of security within network and information systems for essential services. The NIS Directive covered the following sectors, which are unchanged in NIS2:

Essential units:

• Energy
• Transport
• Banking
• Financial Market Infrastructure
• Healthcare
• Drinking Water Supply and Distribution
• Digital Infrastructure

However, from the first directive it has been identified that even more sectors need to be included and therefore it has been expanded to also include:

Other important devices:

• Wastewater
• ICT service management
• Public administration
• Space services
• Postal and courier services
• Waste management
• Manufacture, production and distribution of chemicals
• Production, processing and distribution of food
• Manufacture of certain essential products such as pharmaceuticals
• Digital providers such as social networking platforms
• Research

Organizations are also divided into essential and important entities, based on their importance to the sector they belong to, as well as their size.

What happens if the NIS2 Directive does not apply to me?

It is not entirely clear which activities actually fall into each sector and even if your organisation will not have to comply with the NIS2 Directive you may still want to consider building your security work to comply with the Directive. The organisations covered by NIS2 are many and these organisations must ensure that their suppliers are also secure. This means that many companies will ultimately have to comply with the NIS2 Directive because the companies they work with do. This makes NIS2 a directive that most of us should be aware of.

Ten basic security measures required by NIS2

According to NIS2, organizations must take appropriate and proportionate risk management measures to prevent security incidents and minimize their impact. NIS2 includes a list of 10 basic measures that all organizations must take:

1. Information systems risk analysis and security guidelines
2. Incident management
3. Business continuity, such as backup and disaster recovery, and crisis management.
4. Supply chain security, including security-related issues related to the relationship between each business and its direct suppliers or service providers.
5. Security in the acquisition, development, and maintenance of networks and information systems, including vulnerability management and disclosure.
6. Policies and processes for assessing the effectiveness of cybersecurity risk management measures.
7. Secure cybersecurity fundamentals and cybersecurity training
8. Policies and procedures for the use of cryptography and, where applicable, encryption
9. Human resource security, access control policies, and asset management
10. Use of multi-factor authentication or continuous authentication solutions, secure voice, video, and text communications, and secure emergency communication systems within the organization, where applicable.

The year 2023 has been a record year for Upgraded People AB, which presents a turnover growth of 51% and turnover for the full year of 1,058 million sek (701 million sek). During the year, we have worked intensively to diversify the service offering, strengthen collaborations and improve the customer experience. Looking at the last three years, the turnover growth is 322%.

Going against the grain and being able to present such strong growth in the weaker economic climate that has characterized 2023 feels fantastic and is proof of the competence and driving force that exists in the organization, says Birgitta Hedegård, CEO of Upgraded People AB.

Upgraded’s growth philosophy is based on an organic growth journey. Growing organically is a basic requirement for a service-driven company to develop and maintain its attractiveness for both employees, customers and partners. The culture in the company and the execution power of each individual are what make Upgraded what it is and the results speak for themselves, continues Birgitta.

Upgraded offers the market tailored solutions to meet the unique needs and wishes of its clients. We provide the right resources at the right time to enable our customers’ goals and visions for the benefit of the individual, organizations and society. We have a focus on services that lead the digital transformation in order to sleeplessly take on the challenges and opportunities of the future.

Today, we operate across a large number of industry segments in the Nordic market, such as:

• Banking, Finance and Insurance
• Public Sector
• Manufacturing
• Retail
• Transport
• Energy
• Telecom

With 15 years of experience from acting as a competence catalyst for forward-thinking companies and organizations in both the private and public sectors, we have a solid network of specialists in a wide range of services such as System Developers, Project Managers, Architects, Testers, Test Managers, Management Consultants, Change Managers, Copywriters, ADs, UX/UI, SEO/SEM, BI, AI, etc. always ready to support our clients.

Important events during the year

• New CEO Birgitta Hedegård with many years of experience from leading positions in both consulting brokerage and IT and Digital communication.
• Internationalization in that Upgraded is establishing itself outside Sweden’s borders for the first time through its entry into Norway and Denmark.
• Several new strategic framework agreements signed in both the public and private sectors.
• The growth journey is recognized by Dagens Industri through the awarding of DI Gasell 2023.

Upgraded has signed a four-year framework agreement with the Swedish Debt Office that covers the provision of specialists in several areas of expertise such as, Management and Governance/Business Development, System Development, Infrastructure, Architects, IT Security, Testing and Service Desk.

“We are pleased to continue to be trusted to support the Swedish National Debt Office in their operations by providing value-creating IT consultants. As account manager, I look forward to being a part of working and further developing their important function in society,” says Hanna Werner, Team Lead at Upgraded People AB.

The Swedish National Debt Office is the central government financial administration and also has assignments that contribute to safeguarding financial stability. The Swedish National Debt Office is a government agency that reports to the Ministry of Finance. It is the Government that appoints the board and the Director of the Swedish National Debt Office, who is the highest-ranking manager of the Swedish National Debt Office. The Swedish National Debt Office was founded in 1789.

“That Upgraded wins this type of framework agreement is clear proof that we create value for our clients. We want to help our clients in their quest to find relevant and sought-after expertise in today’s competitive climate.

These successes are a result of the work and values ​​we work for in the organization with a wonderful drive, quality and helpfulness of all fantastic employees.” says Hanna.

DORA (Digital Operational Resilience Act) is a comprehensive regulatory framework within the EU for managing digital risks in the financial sector. Through DORA, the scope is expanded from only looking at the financial situation of companies to also include stability in their operations. This takes into account how well they cope with various business-impacting digital incidents, cyber threats and other IT problems. The purpose of DORA is to ensure that financial institutions and market participants are equipped to manage and prevent cyber threats, while maintaining operational stability. This is particularly important given the increasing digitalization of the financial sector and the increasing number of cyber attacks. Companies must broaden their view of identifying resilience for critical functions and underlying processes. They will need to improve their understanding of critical business processes, improve their detection capabilities and incident management routines, expand their testing of critical ICT systems and work closer with their suppliers, who will also have the same obligations. The regulatory framework and its follow-up are under the responsibility of the European Supervisory Authorities (ESAs). ESA will have the power to request information, carry out inspections and issue recommendations, administrative sanctions and remedial measures.

DORA should be seen as a catalyst for strategic improvements in companies’ risk management and increase management awareness of the consequences of serious operational disruptions and increased understanding of the organization’s limitations.

From an EU perspective, nearly 25,000 financial companies and ICT providers are covered by DORA. Those covered include banks and other credit institutions, investment firms, insurance companies, crypto asset providers, data reporting providers and cloud service providers.

The regulations take a cohesive approach to effective risk management, the organization’s ability to manage IT and cybersecurity risks and the management of third-party risks. This is to achieve stability and structure in its entire service delivery. Looking at the regulations, the following points are particularly central:

• Risk management of ICT services.
• Reporting of ICT-related incidents.
• Testing of digital resilience.
• Risk management of third-party ICT service providers.

Companies affected by DORA should be prepared for increased supervision. When it comes into force, both Swedish and EU regulators will receive extensive new mandates and powers. Looking at experiences from the UK and their new regulatory framework, the authorities have been “pressure testing” companies and asking affected companies about their recovery plans and processes already the same week the regulations were implemented. In other words, companies should, given the tight timeframes, focus on areas that require review by regulators.

The regulation came into force on 16 January 2023, which means that organisations covered by DORA have until 16 January 2025 to comply with its requirements. That means there is now only one year left.

What should you as a company do?

A GAP analysis based on the requirements of DORA should be initiated immediately to identify the deficiencies that will need to be addressed in 2024.

How can Upgraded help?

We have specialists who can help you understand the regulation and its impact on your business, identify the actions that need to be taken, and have access to the resources to implement the changes required to become DORA compliant.