Protective Security Act
Protecting what matters to Sweden's national security
The Swedish Protective Security Act applies to anyone who carries out activities that matter to Sweden's national security. This can be authorities, municipalities and private companies, for example in energy and water.
What the law is
A Swedish law on security-sensitive activities
The Protective Security Act (2018:585) applies to activities of importance to Sweden's national security. These are called security-sensitive activities. The law protects against espionage, sabotage and terrorist offences, among other things.
The law is not based on an EU directive. The Protective Security Ordinance and the Swedish Security Service's regulations describe the requirements in more detail. The Swedish Security Service, the Swedish Armed Forces, the county administrative boards and several other authorities carry out supervision. Who supervises depends on the activity.
Protective security assessment
You must assess what needs protecting and against what. The assessment must be updated when needed and at least every two years.
Three areas
The measures cover information security, physical security and personnel security. They must follow from the assessment.
Head of protective security
The organisation must have a head of protective security, unless this is clearly unnecessary.
Notification
You must notify the supervisory authority when you start and when you stop carrying out security-sensitive activities.
Suppliers
Before a supplier gets access, you carry out a special protective security assessment and a suitability assessment. Sometimes a protective security agreement is required.
Personnel
Anyone who will hold a security-sensitive position must undergo security vetting.
IT and control systems
Requirements for systems in security-sensitive activities
An information system in a security-sensitive activity must not be put into operation until you have approved it from a protective security perspective. This also applies to control systems. For some systems, you must first consult the Swedish Security Service.
The protection must detect, impede and handle harmful interference and unauthorised access. Events that matter for security must be traceable. The Swedish Security Service's regulations also require multi-factor authentication and restricted access rights that are reviewed.
The table shows our simplifications of the requirements. Rows where XoT helps are highlighted in green.
| Need | What XoT does | XoT |
|---|---|---|
| Only authorised users reach the systems | The Lock stops all traffic that no policy allows. No inbound ports are opened. | Yes |
| Restricted access rights for a set time | Each policy applies to one person, specific equipment and a set time. The Policy Graph shows who can reach what. | Yes |
| Multi-factor authentication | Hardware key, smart card or an authenticator app through your directory. | Yes |
| Traceability | The XMS logs every connection and every policy change. Logs can be sent to your SIEM. | Yes |
| Suppliers reach only what they should | Access to a specific machine for a set time. You can approve each connection. | Yes |
| Protective security agreements and suitability assessments | These are agreements and assessments that you make. | No |
| Transfer of classified information | Requires encryption approved by the Swedish Armed Forces. XoT is not approved for this. | No |
| Assessment, physical security and personnel security | Work in your organisation. | No |
Where XoT runs
You decide where XoT runs
If a supplier gets access to the security-sensitive activity, a special protective security assessment is required first. This can also apply if someone else runs the XMS for you. The XMS holds information about your equipment and your policies, and it may need protection.
That is why all of XoT can run under your own control, in your own data centre or fully separated from the internet. XoT is developed in Sweden, and the XoT-S1 hardware is designed and manufactured in Sweden.
Common questions
Is XoT approved for classified information?
No. The encryption in XoT is not approved by the Swedish Armed Forces. Do not use XoT to transfer classified information.
Who approves a system that includes XoT?
You do, because you carry out the activity. We describe how XoT works, so that you have a basis for the assessment.
How does the law relate to the Swedish Cybersecurity Act?
Both can apply to the same organisation. The Cybersecurity Act protects essential services. The Protective Security Act protects what matters to Sweden's national security.
Can we sign a protective security agreement with you?
Contact us early in the procurement. We will tell you what we can offer.
What we write here is our interpretation of the law. It is not legal advice.
Do you carry out security-sensitive activities?
We are happy to explain how XoT can run entirely in your own environment.