From Cybersecurity Governance to Everyday Practice: A Study of Governance–Practice Gaps in Swedish SMEs

Sammanfattning

This thesis examines how formal information and cybersecurity requirements are operationalised in practice in Swedish small and medium-sized enterprises. It focuses on governance-practice gaps between formal cybersecurity governance, including policies, standards and regulatory requirements, and everyday organisational practices. More specifically, the thesis addresses four research questions concerning: (1) how cybersecurity governance structures and regulatory requirements are translated into operational practices; (2) how information classification is applied in SMEs; (3) what governance-practice gaps emerge between formal policies and everyday practice; and (4) how a structured assessment model can support the identification and analysis of such gaps. The study adopts a qualitative multiple-case design involving four Swedish organisations. It combines semi-structured interviews, document analysis and employee survey responses. The analysis is guided by IT governance theory and organisational perspectives on security implementation. The assessment model served as an analytical prototype for comparing evidence across cases, rather than as a standalone compliance tool. The findings show that cybersecurity requirements are translated pragmatically and incrementally rather than implemented as fixed compliance packages. Governance-practice gaps were identified in all cases, but appeared in different forms, including limited policy familiarity, weak follow-up, informal workarounds, unclear routines and inconsistent employee adoption. Information classification emerged as a concrete example of this broader implementation challenge. The study shows that cybersecurity governance in SMEs depends not only on formal policies and responsibilities, but also on whether these are understood, maintained and embedded in daily work. The assessment model supported systematic comparison across cases, but its outputs remained supplementary and required qualitative interpretation.