Cybersecurity Regulation Compliance in Swedish Municipalities : Understanding Cultural Aspects of Cybersecurity Policy Implementation & the appearance of NIS2

Sammanfattning

There is an increasing number of cybersecurity threats and with the introduction of NIS2, this createsnew demands on Swedish municipalities with them being responsible for critical societal infrastructure.Limited research exists within this context, and on how municipal information security managers bothperceive and implement new cybersecurity legislation in practice. The purpose of this study was toexamine how Swedish municipalities perceive and manage new cybersecurity legislations, specificallyconsidering the emergence of NIS2. To achieve this purpose, two research questions were posed. Onequestion is investigating the effects new cybersecurity legislation has on municipalities’ informationsecurity work. The other question investigates the organizational factors affecting municipalities’cybersecurity culture. The study was conducted through interviewing seven information securityprofessionals from different Swedish municipalities. The data was analyzed using thematic analysis andwas supported by Huang and Pearlson’s (2019) organizational cybersecurity culture model. Findingsindicate that prior compliance efforts connected to prior legislation facilitated municipalities’preparation for NIS2. Challenges include the allocation of resources for cybersecurity efforts and theavailability of cybersecurity competencies. Top management support and inter-department collaborationwere shown to be drivers in cybersecurity culture fostering efforts. This study contributes valuableinsights from cybersecurity organizations within the public sector. The conclusion also recommendsfuture studies to explore these organizations in greater detail and also push for the model by Huang andPearlson (2019) to be remade for greater application in the public sector.