Indikatorer och metoder för att bedöma cybersäkerhetsmedvetenhet i Organisationer: En systematisk litteraturöversikt

Sammanfattning

Cybersecurity awareness is increasingly recognised as a critical component of organisational security strategy.Despite its importance, there remains significant ambiguity regarding how organisations evaluate the effectivenessof CSA initiatives. This study presents a Systematic Literature Review (SLR) aimed at identifying the indicators,measurement approaches, and dimensions employed by organisations to assess CSA. The review follows astructured methodology based on PRISMA guidelines and includes studies from four academic databases: IEEEXplore, Scopus, SpringerLink, and ACM Digital Library. Following the inclusion and exclusion process, 52 studiespublished between 2010 and 2026 were selected for in-depth analysis. The findings show that CSA is assessedusing a diverse range of self-reported, knowledge-based, behavioural, and organisational indicators. Self-reportedindicators derived through questionnaires and surveys appeared most frequently across the reviewed studies,while behavioural and organisational indicators such as phishing simulation outcomes, incident reporting, andtraining participation records appeared comparatively less often. The review further identified ten recurringCSA dimensions, with email use and phishing susceptibility, password management, and information handlingreceiving the greatest attention, whereas dimensions such as cloud service use and workstation security receivedcomparatively limited attention. In addition, SME-focused CSA measurement research remains substantiallyunderrepresented within the literature. This study contributes by providing a structured synthesis of currentCSA measurement practices, identifying dominant assessment trends, and highlighting key research gaps withinthe existing literature.