Anpassning av identitetshantering som en del av en organisations riskhantering i enlighet med NIS2 : En studie på Trafikverket

Sammanfattning

This study examines the implications of the NIS2-directive at Trafikverket, with a particular focus on the roles of application owners and IT architects. The study investigates how Trafikverket is currently managing the implementation of the NIS2-directive and handling the ongoing organizational transition. A qualitative case study was conducted within the IKT section of Trafikverket. The purpose of the study was to identify potential knowledge gaps and determine what forms of support employees may require in order to effectively comply with the NIS2-directive. A literature review was conducted to identify existing research gaps, which were then applied to the organizational context of Trafikverket. The theoretical foundation consisted of sociotechnical systems theory and change management theory. A purposive sampling strategy was applied to ensure that participants possessed relevant expertise. A total of five interviews were conducted across two demographic groups, which enabled the study to compare perspectives and strengthen the credibility of the findings. The empirical material was collected through semi-structured interviews, while previous research contributed to the development of the analytical framework. The results indicate a lack of knowledge regarding both the implementation and significance of the NIS2-directive among respondents. Differences were also identified between the demographic groups participating in the study. The findings suggest that there is no single solution to the challenges Trafikverket is facing. The identified lack of knowledge and documentation regarding the NIS2-directive and its implications highlights a need for improved communication between organizational roles. Uncertainty regarding IAM and security-related responsibilities may potentially contribute to future operational and security-related issues.