Hur tolkas och översätts regulatoriska krav kopplade till informationssäkerhet : En kartläggning av medelstora organisationer i Sverige

Sammanfattning

This study examines how medium-sized companies make sense of regulatory requirements in information security, with a focus on incident management and supply chains. Using a sensemaking perspective and semi-structured interviews, the study analyses how such requirements are understood, discussed and translated into practice. The findings show that regulatory requirements are often perceived as ambiguous and therefore require organisational interpretation. Companies manage this uncertainty through industry networks, internal responsibility structures, and the development of routines and controls. The study contributes empirical knowledge about how regulatory uncertainty is handled in medium-sized organisations.