Sweden’s Trafikförvaltningen has issued a request for information (RFI) focused on Identity Governance and Administration (IGA) for technical environments supporting traffic-management and air traffic services. Responses are due March 5, 2026 at 16:59 CET. The notice cites TOT Ref 136007065 and includes an alternative Luftfartsverket (LFV) reference of A-2026-026319. The purpose is to gather market input that will inform baseline requirements for a potential future IGA supplier framework.
IGA is a core identity security discipline that governs who has access to which systems, under what conditions, and with what oversight. In critical infrastructure, that role expands from standard enterprise access control into governance for operational technology (OT) environments where user actions can have direct safety and continuity implications. In practice, identity lifecycle controls, role and entitlement management, and access certification can become security controls that sit alongside network segmentation and monitoring in a broader defense model.
The RFI scope indicates a focus on technical operational systems used in transportation and air traffic management rather than general back-office IT. That distinction raises the assurance bar. Access governance in these environments often needs stronger separation of duties, tighter entitlement review cycles, and clearer auditability for privileged actions. It can also involve identity and access policy alignment across multiple agencies and suppliers, particularly where operational workflows depend on shared systems and shared data.
Both Trafikförvaltningen, the regional transport authority, and LFV, the Swedish civil aviation authority, are among the organizations whose technical systems fall within the RFI’s scope. The market consultation is presented within a broader feasibility track tied to future operational concepts for transportation infrastructure, suggesting that identity governance is being evaluated as part of a wider modernization effort rather than as a standalone IT refresh.
The RFI also fits a broader European pattern: critical infrastructure operators are increasingly treating identity and entitlement governance as foundational security infrastructure, aligned with zero-trust access principles. In this approach, identity is not simply an administrative directory function. It is a policy enforcement layer for controlling access to safety-critical systems, limiting lateral movement, reducing standing privilege, and improving visibility into who can do what across complex technical estates.
Sweden’s broader market activity around digital identity and identity services continues to develop, with vendors positioning for increased institutional demand. Signicat’s appointment of a dedicated Sweden country manager is one example of how suppliers are staffing for expanded engagement with enterprise and public-sector buyers pursuing higher-assurance identity and access programs.
This transportation-focused RFI is a market consultation, not a formal solicitation. Responses will feed a requirements definition process that would precede any competitive procurement for an IGA supplier framework covering the transport and aviation environments described in the notice.
Interested parties have until March 5 to submit responses through the official channels referenced by Trafikförvaltningen and LFV.
Sources: Trafikförvaltningen, Luftfartsverket (LFV)
–
By Ji-seo Kim
