Efterlevnad av policy och informationssäkerhetsarbete : En fallstudie om informationssäkerhetspolicys på småföretag inom vårdbranschen

This thesis examines the information security awareness and compliance to related policies by employees at small companies, and to which degree the company’s policies fulfil requirements according to standards for security policies. A case study was carried out at a small healthcare company by collecting and analysing information security related documents and by conducting interviews with employees. The assessment of the company’s policy documents was made by comparing them to policy requirements established by the ISO 27000 standards. The information security awareness and policy compliance at the company was graded using an information security maturity model with a scale of 0 to 5. The highest degree of policy compliance was found in rules regarding anonymising sensitive information in text-based communication and deleting it when it is no longer needed. Compliance to mail and password routines was identified as the most neglected part of analysed policy documents. The awareness and policy compliance at the company conforms to level 2 of the maturity model. As for the policy documents, they partly or fully fulfilled a majority of the ISO requirements included in the comparison. However, 7 out of 17 requirements were missing completely in the policy documents, and only two out of eight requirement categories were fully fulfilled. The requirement category that the policy documents fulfilled to the highest degree concerned protecting sensitive information during transfer, while the biggest shortage concerned requirements on having documentation establishing a regular control systems and education on information security and policies within the organisation