An information classification model for public sector organizations in Sweden: a case study of a Swedish municipality

Abstract

Purpose The purpose of this study is to create an information classification model that is tailored to suit the specific needs of public sector organizations in Sweden. Design/methodology/approach To address the purpose of this research, a case study in a Swedish municipality was conducted. Data was collected through a mixture of techniques such as literature, document and website review. Empirical data was collected through interviews with 11 employees working within 7 different sections of the municipality. Findings This study resulted in an information classification model that is tailored to the specific needs of Swedish municipalities. In addition, a set of steps for tailoring an information classification model to suit a specific public organization are recommended. The findings also indicate that for a successful information classification it is necessary to educate the employees about the basics of information security and classification and create an understandable and unified information security language. Practical implications This study also highlights that to have a tailored information classification model, it is imperative to understand the value of information and what kind of consequences a violation of established information security principles could have through the perspectives of the employees. Originality/value It is the first of its kind in tailoring an information classification model to the specific needs of a Swedish municipality. The model provided by this study can be used as a tool to facilitate a common ground for classifying information within all Swedish municipalities, thereby contributing the first step toward a Swedish municipal model for information classification.

Problems in information classification: insights from practice

“…The classified assets act as the primary input to the risk analysis, which is needed to understand what kind of protection to apply. Conducting information classification is often done with the use of a classification scheme that contains a chosen number of consequence levels and definitions of each level in terms of confidentiality, integrity and availability (Bergquist et al, 2021). It is necessary to define the stated levels clearly; not doing so can result in uneven classifications if there is too much room for interpretation.…”

“…Once the classification of assets is set, the result act as input into the risk assessment where classified information is required to analyze, prioritize and manage risks and apply protection (Bergström and Åhlfeldt, 2014; Everett, 2011; Webb et al , 2014). Thus, it is an essential piece of risk analysis and management within organizations (Bergquist et al , 2021; Everett, 2011; Gerber and Von Solms, 2005). According to Veritas (2015), 54% of data in organizations are unclassified and unlabeled; the result is difficulties in effectively spending and using organizational resources as there is no possibility of applying protection to assets you do not know exist.…”

“…The occurrence of human-organizational problems in information classification has previously been identified (Bergström and Åhlfeldt, 2014), and further investigation has been suggested (Bergquist et al , 2021). This paper presents an analysis of problems to shed light on them from a practice point of view.…”