When Words Lose Their Edge : Analysing Keyword Loss of Specificity in Swedish and UK Information Security Policies

This section presents the abstract of the thesis. Background: Information Security Policies (ISPs) guide employee behaviour in protecting organisational information assets. Clear communication through directive keywords (such as "must", "shall", "should") is fundamental for policy effectiveness. Previous research by Rostami and Karlsson (2024) found that Swedish public agencies frequently use keywords for purposes other than providing clear actionable advice, potentially reducing policy clarity. Purpose: This study examines how directive keywords convey actionable advice in operational ISPs from Swedish and UK higher education institutions. The research investigates whether keyword usage patterns differ between linguistic contexts and measures the extent of keyword loss of specificity in both countries. Method: Using qualitative content analysis, we analysed 30 operational ISPs (15 Swedish, 15 UK) from higher education institutions. We developed a custom tool, the ISP Keyword Analyzer, to extract and classify 2,314 sentences containing predefined keywords. Each sentence was classified as either Actionable Advice (AA) or Other Information (OI). We calculated keyword loss of specificity metrics to compare effectiveness across languages. Result: Swedish ISPs demonstrated lower keyword loss of specificity (33.7%) compared to UK policies (49.7%), indicating more consistent use of keywords for actionable advice. Swedish policies relied heavily on two keywords ("ska" at 45.5% and "inte" at 35.1%), while UK policies showed more balanced distribution across four main keywords ("must" 28.6%, "should" 25.3%, "not" 21.9%, "shall" 19.3%). Individual keyword analysis revealed that equivalent terms function differently across languages, with some showing minimal difference (e.g., "måste"/"must" at 0.8 percentage points) while others varied substantially (e.g., "behöver"/"need" at 53.1 percentage points).