Cybersecurity in Critical Infrastructures: Comparing the Swedish Approach with the EU and NATO Members

Introduction: This thesis compares critical infrastructure cybersecurity measures in Sweden and countries belonging to the European Union (EU) and/or the North Atlantic Treaty Organization (NATO) from the sociotechnical systems theory perspective, aiming to identify common practices and regional differences in implementation. Understanding the practices and differences is crucial for developing effective and universal critical infrastructure cybersecurity. Research Question: The main research question is: What are the common practices in cybersecurity governance for critical infrastructures across Sweden and in the countries belonging to the EU and NATO? The secondary research question is: What are the key differences in the approaches to implementing cybersecurity governance common practices for critical infrastructures in Sweden and in the countries belonging to the EU and NATO? Method: Twenty three studies were systematically reviewed. Documentary research was the data collection method, and thematic synthesis was the qualitative data analysis method. Results: The identified common practices were public-private cooperation, governance framework, coordination, cyber resilience measures, knowledge and capacity building, and national cybersecurity strategy. Sweden's approach, unlike centralized and co-regulatory models, featured sector-specific legislation, sectoral responsibility, and non-institutionalized public-private cooperation. Sweden should institutionalize public-private collaboration. Discussion: The findings mainly emphasized centralized coordination, mandatory incident reporting, and institutionalized public-private cooperation. Critical infrastructure protection requires the contribution of all stakeholders and the balancing of comprehensive cybersecurity measures with profit maximization. Limitations include reliance on secondary data and regional focus, limiting the applicability of the findings. Future research could explore the long-term effectiveness of critical infrastructure cybersecurity practices and policies.