About the Programme Secure Identity and Access Management
The continuous development initiatives in identity and access management are coordinated within a long-term programme running until October 2028 called Secure Identity and Access Management. Here you can read about what our objective “the right person gets the right access at the right time” means and why we are working on this initiative.
Why Are We Doing This?
The goal is to create a digital work and study environment that is fit for purpose while ensuring that both KTH’s information and systems, as well as individuals’ data, are protected securely.
What Does It Mean?
Secure identity and access management refers to systems and processes that ensure the management of individuals’ identities and their access to information or systems is carried out in a legally compliant, transparent, and understandable manner.
This means that identities are verified correctly, access to information and systems is granted and managed according to clear and lawful rules, and users’ rights and privacy are safeguarded.
Key Components of This Work
-
Identity Verification
Ensuring that a person attempting to gain access is truly who they claim to be. -
Access Control
Regulating who is authorized to access specific data and system functionality, and at what times. Access is granted based on the user’s current role, authority, or business need. -
Transparency and Traceability
Establishing clear and traceable processes and procedures for identity and access management that can be audited to ensure compliance with applicable laws and regulations. -
Protection of Individual Rights
Users’ rights to privacy and protection of personal data must be maintained through clear procedures and supporting tools (e.g., protected identities, HR data, etc.).
Background: Why the Programme Is Needed
Ensuring that the right person has access only to the right resources at the right time requires stable and efficient identity and access management.
Examples illustrating why new processes need to be developed include:
-
A large portion of identity and access management is handled manually and needs to be automated for both security and resource-efficiency reasons.
-
As a government authority, KTH must comply with applicable legislation regarding data protection, information security, and environmental considerations. This requires the continuous removal of information associated with students, employees, and affiliates who no longer have a connection to KTH.
-
Hardware and software, monitoring, maintenance resources, and licenses incur costs that need to be optimized according to operational needs.
-
An increasing number of students study fully or partly remotely, and KTH’s services for these students need to be strengthened.
-
Employees work remotely to a large extent, whether from home or while traveling on business. This places specific demands on secure and user-friendly identity verification and access management.
-
There is a growing number of cyber threats, intrusion attempts, and other security-related incidents targeting Swedish universities and government agencies.
About the Programme
The work is carried out through smaller projects and activities that ensure progress and incremental delivery of results. These are coordinated within a common programme structure.
-
Secure Identity and Access Management at KTH
Programme Directive, registration number V-2024-0554.
Ongoing Subprojects:
-
Continuation: Ensuring Identity and Service Lifecycle Management 2026–2027
Project Plan, registration number V-2024-0554.
Completed Subprojects
-
Measures to Ensure Identity and Service Lifecycle Management
Final Report, registration number V-2024-0554. -
FrejaID+ for KTH Account Management
Final Report, registration number V-2024-0554. -
Measures for the Use of KTH Accounts
Final Report, registration number V-2024-0554. -
Adaptation to BankID Secure Start
Assignment Report, registration number V-2023-0064. -
Digital Provisioning of IT Accounts
Final Report, registration number V-2023-0064.
Governance and Long-Term Management
The programme is intended to contribute to the long-term governance of legally secure identity and access management at KTH, with clear responsibility for support, maintenance, and ongoing development.
The governance model will ensure that the processes and technical solutions developed within the programme remain secure, reliable, and aligned with the needs of the organization even after the programme concludes in October 2028.
