The implementation of an Identity and Access Management (IAM) solution is a complex process to manage, consuming multiple years and involves organizational changes. In its nature, several challenges tend to appear to different stakeholders involved in the process. However, prior research has mainly addressed the technical components of an IAM-solution, hence the technical challenges that emerge during development and implementation. Therefore, the non-technical challenges of the IAM-project work and the challenges that constitute the client implementation are understudied. The purpose of this thesis is to visualize the challenges that emerge when an IAM-solution is implemented. In addition, the challenges when organizational changes occur. The empirical data is conducted through a series of semi-structured interviews with individuals in the IAM line of business. In addition, secondary data is gathered through the review of papers and reports in Information Systems (IS) and Information Technology (IT) projects and outsourcing projects, as well from a non-academical organization with in-depth knowledge of IAM implementations. A qualitative case study of IAM implementations was conducted to investigate the studied complex phenomenon. The findings display the challenges of Insight, Communication, and Endurance (ICE), which tend to be obstacles for all stakeholders involved. Additionally, the organizational changes describe three further challenges of Anchoring, Communication, and Vision (ACV). These challenges mainly appear in client changes, which IAM implementations initiate. The thesis display connections and incoherent with prior research on IS/IT-projects and IAM-projects. In addition, newly uncovered aspects that contribute to research areas are highlighted. The thesis is summarized with some implications and possibilities for future research. / En IAM implementeringen är en komplex och utdragen process som kan ta flera år samt skapar en förändringsresa hos kund. I sin natur skapas flera utmaningar till olika involverade aktörer. Tidigare forskning har främst fokuserat på de tekniska komponenterna som en IAM lösning baseras på, därav de tekniska utmaningarna som tillkommer. Till följd har de icke-tekniska utmaningarna inom IAM projekt och utmaningarna med en implementation hos kund fått bristande uppmärksamhet där få studier har genomförts. Syftet med detta examensarbete är att visualisera de utmaningar som uppstår vid en IAM implementering. Arbetet fokuserar även på utmaningarna med organisatorisk förändring, vilket genomförandet av en IAM lösning skapar. Den primära datainsamlingen genomförs av halvstrukturerade intervjuer med personer inom IAM-branschen. Dessutom samlas sekundär data in från informationssystem (IS) och informationsteknik (IT) projekt samt outsourcingprojekt. Därtill några icke akademiska rapporter med fördjupande information om IAM implementeringar. Examensarbetet är gjort som en kvalitativ fallstudie av IAM implementeringar, detta för att förstå komplexiteten av ämnet. Resultatet visar utmaningar som Insikt, Kommunikation och Uthållighet, vilket tenderar att vara hinder för alla involverade aktörer. Dessutom beskriver de organisatoriska förändringarna tre ytterligare utmaningar för Förankring, Kommunikation och Vision. Dessa utmaningar förekommer hos kund som implementerar en IAM lösning. Uppsatsen visar sammanhängande och osammanhängande aspekter med forskningen inom IS/IT projekt och IAM projekt. Dessutom framhävs nya upptäckta insikter som bidrar till forskningsområdena. Slutligen sammanfattas arbetet med några implikationer samt förslag på vidare forskning.

In some instances, Information Systems and Information Technology (IS/IT) practitioners have been noted to commit privacy violations to Personally Identifiable Information (PII). However, computing exemplars, due to their notable dispositional Hallmark Features of morality, understandings of ethical abstractions, and other components that comprise their virtuous makeups, are theoretically less likely to commit privacy violations to PII. This research attempted to verify if those IS/IT practitioners who identify with some of the Hallmark Features of moral and computing exemplar were less willing to commit privacy violations to PII than were those IS/IT practitioners that did not identify themselves with some of the Hallmark Features of moral and computing exemplars. In order to accomplish this, this research developed and validated two new survey instruments capable of identifying those IS/IT practitioners that were more and less willing to commit unethical privacy violations to PII, and contrast them against some of the Hallmark Features of computing exemplars. The findings of this research supported the conclusion that IS/IT practitioners that identify with some of the Hallmark Features of moral and computing exemplars were less willing to commit privacy violations to PII than were other IS/IT practitioners. Specifically, the results indicated that the most prominent predictor to indicate a lesser willingness to commit privacy violations to PII was that of those IS/IT practitioners that displayed prosocial orientations. Additionally, the predictors of age, level of education, and how ethical IS/IT practitioners assessed themselves to be, proved to be significant markers for those individuals that were less willing to commit privacy violations to PII. While the results are promising, they are also alarming, because the results also indicate that IS/IT practitioners are blatantly willing to commit privacy violations to PII. Thus, two immediate implications resonate from the results of this research. First, there are those individuals that have been given the trusted position of guardianship for society's personal information that should probably not have it, and secondly, further investigations are warranted to determine what other predictors may promote a lesser willingness to commit privacy violations to PII. The contribution of this research to the fields of IS/IT, personnel selection and testing, and organizational assessment and training is unique. This is because, to date, no other discernable literatures have ever investigated the rating and rankings of the severity of PII privacy violations, nor has any other research investigated what Hallmark Features of individuality contribute to a less willing disposition to commit PII privacy violations.

<p>Verksamheters säkerhetsproblem i samband med informationssystem och informationsteknik (IS/IT) är ett område som uppmärksammats kraftigt de senaste åren. Denna avhandling syftar till att ge en ökad förståelse av informationssäkerhet; begreppet i sig, dess hantering i</p><p>verksamheter samt dess betydelse för verksamheter. För att nå en ökad förståelse för informationssäkerhet och dess hantering består avhandlingen till stora delar av konceptuella resonemang. Avhandlingens huvudsakliga kunskapsbidrag är:</p><p>- En kritisk granskning och en revidering av den begreppsapparat som dominerar i Sverige inom området informationssäkerhet och dess hantering.</p><p>- En generisk modell (ISV-modellen) avseende verksamheters hantering av informationssäkerhet.</p><p>ISV-modellen beskriver vilka grundläggande förutsättningar, aktiviteter, resultat och konsekvenser som kan kopplas till hantering av informationssäkerhet i verksamheter. Informationssäkerhetsområdet betraktas utifrån ett perspektiv som har sin grund i Skandinavisk informationssystemforskning. Ett viktigt kännetecken hos detta perspektiv är att IS/IT betraktas i en verksamhetskontext där bl a människors roller och aktiviteter utgör en viktig del.</p><p>Studien bygger på både teoretiska och empiriska studier som har skett parallellt och genom växelverkan. De teoretiska studierna har främst bestått av litteraturstudier och konceptuellt modellerande som har konfronterats med empiriskt material vilket huvudsakligen har hämtats genom en fallstudie på en kommun i Bergslagen.</p>

<p>IS- och IT-strategier är ett koncept som idag är av stor betydelse för verksamheter, både inom den privata och offentliga sektorn. Problemställningen i detta arbete syftar till att undersöka vad som bör ingå i en IS/IT-strategi för att den ska vara ett bra styrdokument för en offentlig verksamhet. Informationen från studien syftar även till att finna ett tillvägagångssätt som är lämpligt vid utvecklandet av en IS/IT-strategi.</p><p>De slutsatser som drogs från studien påvisar att IS/IT-strategier bör vara heltäckande för verksamheter och att strategin har tydliga kopplingar till verksamhetens övriga mål. En IS/IT-strategi bör vara ett måldokument där detaljrikedomen är lång och verksamhetstiden är mellan 3 och 5 år.</p><p>Studien påvisar även att det kan fungera bra att utveckla en IS/IT-strategi internt inom kommuner, men att ett bra resultat även kan uppnås med extern hjälp. En viktig faktor för att skapa en framgångsrik strategi är att ha delaktighet vid utvecklandet. Det anses inte behövas några metoder vid utvecklingen utan diskussioner leder fram till ett bra resultat.</p>

<p>Background: The notion of IT strategies has changed during recent years, because our perspectives towards IT in the organizations have changed. We expect IT to be fulfilling business goals and lever-age business opportunities and we have strengthened the role of IT in the supply chain. Our individual view on IT, whether it is strategic or supportive, whether the infrastructure should be standard-ized or individualized etc., most likely affects how IT strategies are interpreted and conducted in the organization. This is critical in companies who have their subsidiaries on foreign land. It is not obvi-ous that managers in different countries interpret the IT strategy the same way, just because it happens to be the same company. In most large global coalitions, a common central strategy for IT is the standard. I have chosen to examine Argentinean subsidiaries to Swedish companies as an example. Eight research questions were formulated, with the purpose of finding what is included in a generic IS/IT strategy, if the perspectives of managers are in line with the theory, whether views are consistent throughout the concern, and determine the challenges of global IS/IT management.</p><p>Purpose: This paper aims at finding the generic parts in a IS/IT strategy formulation and explain how business management and IT specialists of global coalitions interpret the concept IS/IT strat-egy. A sub-purpose is to define the priorities in global IS/IT management. The analysis of the paper culminates in a model - “the interpretation of IS/IT strategies”, with the ambition to give guidelines for managers and strategy formulators in a global environment.</p><p>Method: The study is of qualitative, exploratory and explanatory type, it has a descriptive part and a theory enhancing rational. By a thorough literature study and a pre- study I wished to explore and shed light on the perplexities in IS/IT management, nationally and globally. The broad research spectrum was a conscious choice to cover the complex area of IS/IT strategy and the various people affected. By conducting interviews; through questions and observations I also aimed at describing and explaining how IS/IT strategies are interpreted in practice. As a result of my hermeneutic research approach I am drawing conclusions from the similarities and dissimilarities I found in the different perceptions and relate it to the result of previous studies. The idea is thus to combine these insights in order to enhance theory in the area.</p><p>Analysis and result: what could be determined from the analysis is:</p><p>• IS/IT strategy composed of strategic planning, alignment between business- and IT, competitive advantage, knowledge management, responsibilities, system architecture, interaction and security.</p><p>• No “generic” strategy exists. A good strategy for a global coalition is forward-looking and flexible and frequently evaluated. The strategy gives competitive advantage if leveraged; the results are related to IS paradigm view.</p><p>• IT people proves short sighted while business/strategy management have long term perspective, which contradicts Earl, (1999). The difference could be due to culture in this case. The organiza-tional structure does not determine IT architecture, which contradicts King Sethi (1999).</p><p>• Managers and IT people are generally not in agreement. Interpretations of strategy are not consistent in global firms. Managers and not IT people need to take responsibility for the formulation and realization of the strategy. This is in accordance with Axelsson, (1995).</p><p>The implications to managers are: The organizational structure chosen should not be steering the politics for architecture, moreover that IT specialists with a technical view can not be responsible for strategy work or global standards. Managers are encouraged to develop knowledge management, to include intellectual assets in the IS/IT strategy and work with culture enhancement programs.</p>

Information systems and technology strategy has been discussed by many researchers and authors over last three decades. The concepts of business alignment, competitive advantage, value generation etc. have been elaborated and still similar discussions continue. While the advances in IS/IT strategy formulation were being made, the businesses were changing their operating models. More specifically they became global businesses active in multiple geographies at the same time. This research aims to provide deeper understanding of IT developments in global organizations as manifested in the changing social and political environment of the organization and the reciprocal effect of social and political changes on IT strategies. Further it aims to investigate whether the relevant theories and concepts can be integrated to develop a new model that can incorporate the socio-political aspects into IS/IT strategy formulation. To achieve this objective the literature survey was conducted to explore available published papers in the sphere of IS/IT strategy formulation. Considering that the applicability of information systems and technology falls into the sphere of social sciences, the research design focused on the qualitative approach. The primary method of data collection was through semi-structured interviews with IT managers. This was complemented by interviews with business managers and consultants. Further the experiences of the researcher in the earlier role of practitioner were taken into account. Using grounded theory approach the information collected through interviews, own experiences and the data gathered from literature survey were used to develop a new model of IT strategy formulation. The model addresses the context part of IT strategy formulation process. This model development is aimed to counter and account for the political and social aspects of strategy development and deployment in global corporations characterised by diversity of cultures, attitudes and behaviours.

Background: The notion of IT strategies has changed during recent years, because our perspectives towards IT in the organizations have changed. We expect IT to be fulfilling business goals and lever-age business opportunities and we have strengthened the role of IT in the supply chain. Our individual view on IT, whether it is strategic or supportive, whether the infrastructure should be standard-ized or individualized etc., most likely affects how IT strategies are interpreted and conducted in the organization. This is critical in companies who have their subsidiaries on foreign land. It is not obvi-ous that managers in different countries interpret the IT strategy the same way, just because it happens to be the same company. In most large global coalitions, a common central strategy for IT is the standard. I have chosen to examine Argentinean subsidiaries to Swedish companies as an example. Eight research questions were formulated, with the purpose of finding what is included in a generic IS/IT strategy, if the perspectives of managers are in line with the theory, whether views are consistent throughout the concern, and determine the challenges of global IS/IT management. Purpose: This paper aims at finding the generic parts in a IS/IT strategy formulation and explain how business management and IT specialists of global coalitions interpret the concept IS/IT strat-egy. A sub-purpose is to define the priorities in global IS/IT management. The analysis of the paper culminates in a model - “the interpretation of IS/IT strategies”, with the ambition to give guidelines for managers and strategy formulators in a global environment. Method: The study is of qualitative, exploratory and explanatory type, it has a descriptive part and a theory enhancing rational. By a thorough literature study and a pre- study I wished to explore and shed light on the perplexities in IS/IT management, nationally and globally. The broad research spectrum was a conscious choice to cover the complex area of IS/IT strategy and the various people affected. By conducting interviews; through questions and observations I also aimed at describing and explaining how IS/IT strategies are interpreted in practice. As a result of my hermeneutic research approach I am drawing conclusions from the similarities and dissimilarities I found in the different perceptions and relate it to the result of previous studies. The idea is thus to combine these insights in order to enhance theory in the area. Analysis and result: what could be determined from the analysis is: • IS/IT strategy composed of strategic planning, alignment between business- and IT, competitive advantage, knowledge management, responsibilities, system architecture, interaction and security. • No “generic” strategy exists. A good strategy for a global coalition is forward-looking and flexible and frequently evaluated. The strategy gives competitive advantage if leveraged; the results are related to IS paradigm view. • IT people proves short sighted while business/strategy management have long term perspective, which contradicts Earl, (1999). The difference could be due to culture in this case. The organiza-tional structure does not determine IT architecture, which contradicts King Sethi (1999). • Managers and IT people are generally not in agreement. Interpretations of strategy are not consistent in global firms. Managers and not IT people need to take responsibility for the formulation and realization of the strategy. This is in accordance with Axelsson, (1995). The implications to managers are: The organizational structure chosen should not be steering the politics for architecture, moreover that IT specialists with a technical view can not be responsible for strategy work or global standards. Managers are encouraged to develop knowledge management, to include intellectual assets in the IS/IT strategy and work with culture enhancement programs.

IS- och IT-strategier är ett koncept som idag är av stor betydelse för verksamheter, både inom den privata och offentliga sektorn. Problemställningen i detta arbete syftar till att undersöka vad som bör ingå i en IS/IT-strategi för att den ska vara ett bra styrdokument för en offentlig verksamhet. Informationen från studien syftar även till att finna ett tillvägagångssätt som är lämpligt vid utvecklandet av en IS/IT-strategi. De slutsatser som drogs från studien påvisar att IS/IT-strategier bör vara heltäckande för verksamheter och att strategin har tydliga kopplingar till verksamhetens övriga mål. En IS/IT-strategi bör vara ett måldokument där detaljrikedomen är lång och verksamhetstiden är mellan 3 och 5 år. Studien påvisar även att det kan fungera bra att utveckla en IS/IT-strategi internt inom kommuner, men att ett bra resultat även kan uppnås med extern hjälp. En viktig faktor för att skapa en framgångsrik strategi är att ha delaktighet vid utvecklandet. Det anses inte behövas några metoder vid utvecklingen utan diskussioner leder fram till ett bra resultat.

This diploma thesis analyzes the information system of a small company and suggests improvements. In theoretical part are specified current methods for evaluation of information systems effectiveness.

The thesis deals with the information strategy scheme for the company operating within the tertiary industry. The enterprise is analyzed via various methods, with emphasis on the current state of IS/IT and on business needs in this area. A comprehensive information strategy is designed on the basis of the analysis to ensure the day to day business operation, competitiveness and the scope for its further growth.