On 19 October 2026 the Swiss Federal Office for Cyber Security published a five-level classification of authentication methods. A password alone sits at the lowest level, passkeys at the medium level and hardware keys at the high level. What it means for SMEs.
Password, SMS code, authenticator app, passkey, security key: there are many ways to protect a login, but they do not offer the same protection. On 19 October 2026 the Swiss Federal Office for Cyber Security (FOCS) published a technology brief that sorts them into five security levels.
The classification is based on the Authentication Assurance Levels (AAL 1–3) of the US NIST, adapted and extended to take real-time phishing attacks into account. It is not a certification, but according to the FOCS it can give organisations and companies a practical basis for internal rules, recommendations and best practices.
The five levels at a glance
There are three basic levels, "low", "medium" and "high". The last two have a variant marked with an asterisk (*), reserved for methods that also resist real-time phishing and attacks in which someone places themselves between the user and the service.
- Low. The information used to log in is static and always the same: username and password, a fixed API key, a session identifier stored in a cookie. The level stays low even with an encrypted connection or a password manager. According to the FOCS these methods should be avoided and, where possible, replaced.
- Medium. The information changes with every login and depends on at least one other security element. Examples: password with an SMS code, apps with one-time codes such as Google or Microsoft Authenticator.
- Medium*. Like medium, but the login stays bound to the device or session in which it took place, so it cannot be reused elsewhere. This includes passkeys that sync across devices and passwords with device binding.
- High. On top of that, a cryptographic key is needed that is kept in a hardware module it cannot be extracted from, unlocked with a further check and handed over personally through a traceable process. Examples: hardware one-time-code tokens and Mobile ID.
- High*. The high level with resistance to real-time phishing: for example FIDO2 keys that cannot be synced or exported, in other words physical security keys, or certificates stored in hardware.
Three useful clarifications
Adding methods of the same level does not raise the level. The FOCS gives an example: passkeys stay at medium even when combined with a password and an SMS code.
SMS is the last resort. The document notes that the security of SMS-based methods is in doubt and that they should only be used when there is no better alternative.
A hardware key cannot be copied. Precisely because the key cannot be extracted, it cannot be backed up: a backup requires a second device.
There is also a point for anyone using integrations and automations: API keys should be kept in dedicated systems, not passed in a URL or in automatically sent cookies, and short-lived keys and credentials are preferable.
What it means for an SME in Ticino
The classification is also aimed at large organisations, but the logic works for any company. Five concrete steps:
- List the logins that matter: email, online banking, business software, accounting, the website admin panel, domain and hosting, social media accounts. For each one, note how you log in today.
- Remove password-only access from important accounts. That is the low level: where the service allows it, add at least a second factor.
- Prefer passkeys or authenticator apps to SMS. SMS is better than a password alone, but the FOCS treats it as a fallback.
- Protect administrator accounts better. For the domain, hosting, the owner's mailbox and e-banking, consider a physical security key, with a second spare key stored separately.
- Put your API keys in order. Keep them out of code, emails and shared documents, with the minimum permissions needed and an expiry date.
This is not a theoretical issue: the FOCS recently recorded a record number of reports, mostly phishing and scams, as we described in 1587 reports in one week.
Our approach
ElaraTeq Sagl builds websites, business software and digital services for SMEs and public bodies in Ticino, with hosting in Switzerland, encrypted connections and protected access. If you want to know what level your company's logins are at today and what to improve first, get in touch.
Sources
- FOCS, "Technology brief: Authenticating securely – five levels for greater clarity", 19 October 2026: https://www.bacs.admin.ch/en/26-tb-authentifizierung-en
- FOCS, "Security categories for authentication procedures, methods and services" (PDF), September 2026: full document
