eID at work

Several workforce credentials are only offered to certain sectors. SITHS is aimed at health care, social care and the public sector, and EFOS at central government agencies.

Choose Municipality if you are a municipality, also for municipal schools and municipal health and social care. School, university or college refers to independent school providers and higher education institutions.

The number affects what is reasonable to run yourself, such as issuing your own cards, and when automating the lifecycle pays off.

Include everyone who should be able to use a workforce credential: employees, consultants, hourly staff and elected officials.

An employer cannot assume, or require, that employees use a private phone for work. Mobile credentials therefore only work fully for users who have a work phone.

In health care, social care, schools and manufacturing, many staff lack a work phone of their own. They need a carrier that is not a phone, such as a card or a security key.

Different groups have different conditions. Consultants and partners, for example, should normally not get the same account or credential as employees.

Many Swedish eIDs require a Swedish personal identity number. Foreign staff, visiting researchers and some consultants therefore need a different route.

For people with protected personal data, name and personal identity number must not be visible to anyone but specially authorised staff. The credential, the card and the IdP then need to handle an alias or an employee ID instead.

On shared devices the credential must follow the person rather than the device, which rules out solutions that only live on one particular computer.

Each service decides which credentials and which level of assurance it accepts. The more services you have, the more you gain from handling sign-in in one place.

The level of assurance sets the requirements for the whole authentication chain, from how the credential is issued and used to how the identity is passed on to the service. It only needs to be high where a service requires it.

DIGG's trust framework for Swedish eID has three levels, 2–4, with progressively higher requirements on identity proofing and security. Level 2 already requires two-factor sign-in. Level 3 corresponds to the eIDAS level substantial and is required, among other things, for access to the National Medication List and for administrators of SDK's shared components. Level 4 corresponds to the eIDAS level high and requires, among other things, hardware-based protection of the credential. It is perfectly fine not to know; mapping it will then be a first step.

Signatures have their own requirements, both for the credential and for the signing service used. It is better to plan for them from the start.

Advanced electronic signatures (AdES) under eIDAS are tied to an eID and produce a signed document that can be validated afterwards, for example for decisions, contracts and certificates.

We want to see what can be reused and what should be phased out. Some methods, such as passwords with SMS codes, are no longer sufficient against phishing.

An IdP lets you connect a credential once and then reuse it across all services. It also decides which methods work out of the box.

IdP stands for Identity Provider: the service that handles sign-in and passes on who the user is to other services, for example via SAML or OpenID Connect.

The service does not see the eID; it sees the identity assertion the IdP sends. A user signing in with a level 3 eID does not automatically make the assertion level 3. The IdP and its processes must also meet the requirements.

Answer yes if your assertion issuance, meaning the IdP and configuration that send the assertions, is covered by a trust review for level 3, for example within a federation. If you are unsure, "Don't know" is a perfectly reasonable answer; it then becomes something to verify.

A workforce credential should be tied to an employment or an assignment. That is far simpler, and safer, when an authoritative system such as HR drives the accounts automatically.

We prioritise the roadmap by what helps you most, not only by what is technically possible.

Private BankID and Freja are convenient, but they often live on the employee’s private phone. The employer can offer this as a voluntary option but cannot require it.

Many organisations need more than one carrier, for example an app for people with a work phone and a card or key for everyone else.

If computer sign-in also uses the credential, the password can often be removed completely for the user. That places requirements on the carrier and the client environment.

A card that is a credential, an access badge and a print card at the same time is something users always carry. It requires coordination with facilities and printing.

Covered organisations need to show that access is risk-based and that strong authentication is used where needed.

The Swedish Cybersecurity Act (2025:1506), in force since 15 January 2026, implements the NIS2 Directive and covers more sectors than before, including municipalities and regions. Suppliers may be covered directly through their own operations or be affected through their customers’ security requirements.

Protection should be proportionate to the information. Sensitive personal data and classified information justify stronger protection.

Answer based on the most sensitive information that any user group accesses. Differences between groups are then handled with the right level for each service, not by giving everyone the same requirement.

A large share of account takeovers happen when users are tricked into handing over codes or approving sign-ins. Phishing-resistant methods cannot be tricked that way.

Phishing-resistant means authentication is cryptographically bound to the right verifier or to the right sign-in session, so a fake website cannot obtain a result that works against the real one. FIDO2/passkeys and certificate-based sign-in do this. What matters is not whether the flow uses a QR code, push or an app, but whether that binding exists. SMS codes, one-time codes and ordinary push approvals do not count, and number matching on push makes attacks harder but is not enough on its own.

Swedish eIDs are based on personal identity numbers, but far from every service needs to know them. Data minimisation is both a GDPR principle and a protection for staff.

It is one of the decisions that affects cost and responsibility the most. Being your own issuer gives control but requires an organisation, procedures and sometimes audits. Buying issuance as a service moves much of that responsibility to the provider. Most organisations have not decided yet.

Identity proofing answers who the person is. This question is about why the person is entitled to the organisation’s credential, and who makes sure that entitlement ends. Without a clear owner, both issuance and revocation become unreliable.

Identity proofing is the foundation of all trust. For level of assurance 3 it is not enough for a manager to vouch for someone.

A credential that outlives the employment is a common audit and security issue.

When the credential is the only way in, there must be a safe way back that does not become a shortcut for attackers.

The driver decides what comes first. A regulatory requirement with a deadline leads to a different order than a goal of better user experience.

The timeframe decides whether it makes sense to start with a quick solution for the most urgent needs and build from there.

The next steps differ depending on whether you are trying to understand the need, need a basis for a decision or are already implementing.