The human factor and insider threats play a crucial role in information security. In today’s digital age, protecting organizational data requires a deep understanding of human behaviour and its impact on information security. The increasing volume of electronically stored data has led to a rise in cyber threats and breaches, necessitating effective information security policies and regulations. This study focuses on the experiences and perspectives of employees and top management in government agencies regarding the development, communication, compliance, and attitudes towards information security policies and regulations. Semi-structured interviews were conducted with participants from both top management or information security officers and regular employees, which allowed for an in-depth exploration of their experiences and perspectives. The findings show that government agencies systematically develop policies by engaging stakeholders, ensuring accessibility, and adhering to legal frameworks. Addressing the human factor involves training, awareness programs, and top management support. Policy development and implementation include risk assessment, stakeholder identification, objective setting, continuous review, and integration into daily operations. Communication channels such as intranets, training, coordinators, and awareness events are utilized, but their effectiveness is not directly measured. Proposed improvements include enhancing accessibility, improving policy document management, and using clearer language. Employees generally possess a positive attitude towards information security, though their understanding varies, and challenges to their understanding include complex language and unclear instructions. Compliance also varies, with difficulties arising from technical terminology and information overload. Enhanced compliance can be achieved through simplified language, providing better resources, and top management support. Proactive incident management focuses on learning and risk minimization. The human factor and insider threats remain significant concerns, which emphasizes the need for further education, awareness training, and motivation.

All organizations, regardless of size, are affected by information security awareness. Information security awareness is an important component, especially for organizations in the IT industry, to be able to respond to new cyber threats but also comply with requirements and regulations for handling customer data. The purpose of the study is to improve awareness-raising measures used by Swedish micro and small companies in the IT industry to increase information security awareness among employees. The study is performed through semi-structured interviews and then analyzed using the Grounded theory-method. The study highlights the awareness measures used in the IT industry and how they are used among companies to make employees aware of information security. In addition, the companies' underlying motives for their choice of awareness measure and their perspective on adapting the measure are examined. The study's conclusions present recommendations that can be used by micro and small companies in the IT industry to improve their awareness-raising measures. The study highlights the importance of adapting training measures, but also that companies should present reality-based scenarios to employees. In addition, it is also emphasized that incentives should be used by information security officers for employees to ensure compliance. / Alla organisationer, oavsett storlek påverkas av informationssäkerhetsmedvetenhet. Medvetenhet om informationssäkerhet är en viktig komponent i synnerhet för organisationer inom IT-branschen för att kunna bemöta nya cyberhot men också efterleva krav och regleringar för hantering av kunddata. Syftet med studien är att förbättra medvetenhetshöjande åtgärder som används av svenska mikro- och småbolag inom IT-branschen för att öka informationssäkerhetsmedvetenheten bland anställda. Studien utförs genom semistrukturerade intervjuer och analyseras sedan med hjälp av Grundad teori-metoden. Studien synliggör vilka medvetenhetsåtgärder som används inom IT-branschen och hur de används bland bolagen för att göra anställda medvetna gällande informationssäkerhet. Dessutom framgår bolagens bakomliggande motiv för deras val av medvetenhetsåtgärd samt deras perspektiv på anpassning av åtgärd. Studiens slutsatser presenterar rekommendationer som kan användas av mikro- och småbolag inom IT-branschen för att förbättra deras medvetenhetshöjande åtgärder. Studien lyfter fram betydelsen av anpassning av utbildningsåtgärder, men även att bolagen bör presentera verklighetsförankrade scenarier till de anställda. Därtill framhävs även att incitament bör användas av informationssäkerhetsansvariga till anställda för att säkerställa efterlevnad.