Background: In an era defined by urgent global crises such as climate change, businesses encounter multifaceted challenges alongside the imperative for sustainable development. The Corporate Sustainability Reporting Directive (CSRD) by the European Union (EU) in 2024 reflects a pivotal response to this pressing need. The purpose of the framework is to increase transparency and engage companies in sustainability actions. The defense industry is one sector with high confidentiality regarding data sharing. As stakeholders navigate this complex landscape, understanding the impact of CSRD preparation on sectors like defense becomes increasingly important.  Purpose: The purpose of this bachelor's thesis is to examine how the preparations for the Corporate Sustainability Reporting Directive (CSRD) influence the Swedish Defense Industry. The researcher employs the theoretical frameworks of "stakeholder theory" and “institutional theory” for this purpose.  Method: The research used a qualitative methodology, employing interviews with firms operating within the defense sector and with experts within the CSRD-field. The adoption of this methodological approach facilitates researchers and readers in attaining a holistic comprehension of the dynamics of the defense industry and the repercussions and impacts of the implementation of CSRD.   Conclusion: The results show the need for well-established preparation within companies in order to succeed with the implementation of CSRD. Findings show that a change in the infrastructure will be required within the Swedish defense industry to collect all information for sustainability reporting due to classified information. Additionally, the result of valuable communication is emphasized among the companies. Lastly, the stakeholders within the industry need to be included in the dialogue to increase awareness of expectations aligned with CSRD.

In information security, the success of security policies is critically dependent on their implementation in organizations. This thesis explores the gap between formal definitions and the actual implementation of security policies, focusing on roles within a Swedish defense company. Using a qualitative research approach, this study employs semi-structured interviews to gather in-depth insights from individuals directly involved in security management, with the aim of uncovering the real-world complexities and challenges faced in policy implementation. This study identifies several core issues that affect policy implementation: ambiguity in role definitions, inconsistencies in policy communication at different organizational levels, and the frequent need for individuals to adapt policies to practical and situational needs. These factors contribute to the risk of security breaches by creating conditions in which policies are misunderstood or incorrectly applied. The findings highlight a significant discrepancy between how policies are intended to function and how they are implemented in daily operations, revealing a critical vulnerability in organizational security frameworks. This thesis contributes to the existing body of knowledge by mapping the landscape of security policy implementation within the context of the highly regulated defense industry. The results provide empirical evidence that improves the understanding of the interaction between policy, practice and the human element in security regimes with the aim of improving clarity and reducing the incidence of human error in security practices.