When words lose their edge: a comparative analysis of information security policy keywords in the UK and Sweden

Purpose The purpose of this paper is to analyse and compare how congruent keywords are used to convey actionable advice in UK and Swedish information security policies (ISPs). Design/methodology/approach The authors conducted a qualitative content analysis of 30 ISPs from higher education institutions, 15 from each country. To support analysis, the authors developed the ISP Keyword Analyzer software, which extracted 2,314 sentences containing analysed keywords. Each sentence was classified as actionable advice or other information. For comparison, the authors used the Keyword Loss of Specificity and Total Keyword Loss of Specificity metrics to measure how congruently keywords were used within each ISP. Findings The authors found two main patterns in keyword use. First, certain keywords are more prominent in ISPs from one country than the other, indicating differing importance across languages and national contexts. Second, the congruence in how keywords are used to convey actionable advice also varies. Swedish ISPs use keywords more congruently to guide employees towards action, whereas UK ISPs more often use them to convey other information than actionable advice. Research limitations/implications Differences in how ISPs are formulated across countries suggest that previous studies on ISP content and design are contextually bound. Practical implications The identified differences highlight how language and national context influence the clarity of ISPs, with implications for organisations operating in multilingual or international environments. Originality/value To the best of the authors’ knowledge, this is the first study to compare how keywords are used in ISPs in different countries to express actionable advice.