Cybersecurity Strategy And Its Implementation By Member States Within The Eu : A Comparative Analysis Of Members’ Strategies

Sammanfattning

The rapid digitisation of society has brought with it systemic cybersecurity risks thattranscend national borders. In response, the European Union adopted the NIS 2 Directive toharmonise cybersecurity standards across all member states. However, the transposition ofsuch top-down requirements often passes through the filter of diverse national institutionalcultures and legal traditions. This study examined how cultural, societal, and institutionalfactors influenced the implementation of the NIS 2 Directive in the Czech Republic, Estonia,and Sweden. A comparative qualitative analysis of nine strategic and legislative documentsfrom the EU and selected member states was conducted. The data were interpreted throughthe theoretical frameworks of Beck’s “risk society,” Braithwaite’s “regulatory governance,”and Johnston and Shearing’s “nodal governance.” The findings revealed significantdifferences in regulatory mentalities despite a harmonised legal framework. The CzechRepublic adopted a hierarchical “command-and-control” model that views threats from ageopolitical perspective with a strong emphasis on repressive sanctions. Sweden demonstrateda consensual approach, prioritising social trust and systemic resilience over formalenforcement. Estonia presented a pragmatic “existential” model in which cybersecurity isdeeply integrated into the digital state's fabric.