How Swegon works with security
Principles
Swegon treats security as a quality attribute of everything it builds and runs, across the whole lifecycle. Four principles guide the work.
- Secure by design. Security is considered from the first architecture decision, to keep the attack surface small: threat modelling before building, penetration testing before release.
- Secure by default. Swegon's products ship with secure defaults wherever interoperability with existing building systems allows, and newer software replaces shared factory passwords with unique or user-set credentials. Connections to Swegon's cloud services are encrypted and mutually authenticated. Building-automation protocols that have no authentication of their own stay open for interoperability; each product's Security & Trust Overview says what applies to it, and what the network must do.
- Defence in depth. Several independent layers, so that no single failure exposes the whole: authentication and role separation, verified software updates, logging, and the segmented network the installation provides.
- Continuous improvement. Swegon reviews and updates its measures as threats and practice change: it monitors vulnerability sources, publishes advisories when customers need to act, and invites reports through its disclosure programmes.
Security of a connected building is shared, and the line moves with how the equipment is connected: the more of the connectivity Swegon provides, the more Swegon carries. Who does what is set out under securing your installation.
The full description is the Swegon Security & Trust Overview. The policy behind it is the Swegon Information Security Policy.
Standards & compliance
The standards and regulations Swegon works to, grouped by the kind of relationship Swegon has with each, so that the list is not read as blanket certification.
- Frameworks Swegon aligns with: ISO/IEC 27001 and the NIST Cybersecurity Framework guide the information security management system.
- Standards Swegon's products are assessed or designed against: the EU Radio Equipment Directive (2014/53/EU), through EN 18031-1 conformity where it applies; IEC 62443 as a design reference for industrial and building-automation security. Each product's documentation says what applies to it.
- Regulations Swegon addresses: the EU Cyber Resilience Act, NIS2, GDPR, and further product regulation as it applies.
Swegon puts documented security requirements to its suppliers and service providers, and to its own products with digital elements and OT environments.
- Security Requirements for IT Service Providers, for every supplier and service provider
- Security Requirements for IT Solutions, for those who develop IT solutions and digital services for Swegon
- Security Requirements for Products with Digital Elements, for those who develop or manufacture products Swegon places on the market
- Security Requirements for OT/ICS, for suppliers of production and facility systems
Assessment and certification evidence for a product, where it exists, is described in the product's Security & Trust Overview and available on request.
Data protection & privacy
Swegon protects the data it holds against unauthorised access, alteration and loss, and processes personal data under the EU General Data Protection Regulation (GDPR). Read the Swegon privacy policy.
Evidence on request
The Swegon Security Assurance Summary, aligned with ISO/IEC 27001, gives the detail behind this page, including a control-by-control mapping to the Annex A controls to support security questionnaires. Swegon provides it to customers under NDA, through the Swegon sales representative.