# A Qualitative Content Analysis of Actionable Advice in Swedish Public Agencies' Information Security Policies

Elham Rostami, Fredrik Karlsson

► To cite this version:

Elham Rostami, Fredrik Karlsson. A Qualitative Content Analysis of Actionable Advice in Swedish Public Agencies' Information Security Policies. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.157-168, 10.1007/978-3-031-38530-8_13 . hal-05462099

HAL Id: hal-05462099

https://inria.hal.science/hal-05462099v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# A Qualitative Content Analysis of Actionable Advice in Swedish Public Agencies’ Information Security Policies

Elham Rostami(✉) and Fredrik Karlsson

Informatics, School of Business, CERIS, Örebro, Sweden
{elham.rostami,fredrik.karlsson}@oru.se

**Abstract.** Information security policies (ISPs) are an essential type of formal control that must be designed in a manner that is easily understandable for employees. Prior studies have recommended the inclusion of actionable advice; however, it is unclear how such advice should be worded to minimize the scope for interpretation. Therefore, this study investigates existing ISPs to assess how clear the pieces of actionable advice are and provide suggestions on how actionable advice should be worded in order to be clear. A qualitative content analysis of 15 ISPs from public agencies in Sweden was conducted with the aid of Orange Data Mining Software. First, the findings revealed an unbalance between the ISPs, where one-third of the ISPs provide over 50% of the analyzed actionable advice. Second, around two-thirds offer advice that is ambiguous and does not provide advice that employees can act upon. We, therefore, recommended that ISP designers exercise caution when using words in the ISP and maintain consistency in their word choices throughout.

**Keywords:** Information Security Policy · Qualitative Content Analysis · Actionable Advice · Orange Data Mining Software

## 1 Introduction

In today's digital world, organizations face an unprecedented level of information security threats from both external and internal sources that can lead to information security breaches. These breaches can cause severe damage to organizations' reputation, financial stability, and even survival (Kör and Metin 2021). External threats (e.g., malicious software, hacking) are a significant concern for organizations as they are usually beyond an organization's control. However, as Willison and Warkentin (2013) stated internal threats are equally concerning as external threats. Insiders often have access to sensitive information, such as trade secrets, customer data, and intellectual property. Insiders may also cause damage to the organization intentionally or unintentionally. For example, an employee may inadvertently share confidential information or intentionally leak information for personal gain. Intentional and unintentional behavior of employees without any malicious intention is known as human error. Human behavior has been consistently
reported as a top-ranked information security threat over the last three decades (Chowdhury et al. 2019; Loch et al. 1992). Thus, it is natural that organization take steps to improve the information security posture and help employees do their daily tasks in a secure manner. One of the most important types of formal controls is the information security policy (ISP) which is used to regulate employees' behavior regarding the use, handling, and protection of information assets.

ISP has been defined as “a document that states how an organization plans to protect its information assets from external and internal threats, operationalizes the implementation of security, and provides guidelines for employee and management conduct” (Goel and Chengalur-Smith, 2010, P 282). ISPs generally can be defined at three levels. At the highest level, there is top management’s expression of the organization’s strategic direction, scope, and tone for all information security efforts (known as strategic ISP). At the middle level, procedures and guidelines are defined to instruct employees’ behavior regarding information assets and controls (known as operational ISP). Thus, operational ISPs are created to provide employees with guidelines concerning how to ensure information security when they are performing their job (Bulgurcu et al. 2010). At the lowest level, ISPs are related to the security architecture of information systems (known as technical ISP) (Whitman, 2008). In this paper, our focus is on operational ISPs that guide employee behavior.

Since ISPs are developed to support employees with their daily work, it is important that employees understand these ISPs and comply with them. However, employees’ poor ISP compliance is a perennial problem for many organizations (Ponemon Institute LLC, 2020; PWC, 2014). Rostami (2023) asserted that ISP non-compliance could have at least two reasons: the employees’ behavior and the ISP design. Thus, employees should not always be blamed for non-compliance, the design of ISP can also make ISPs hard to comply with it. Considering this point, several studies can be found that emphasize designing clear and understandable ISPs (e.g., Höhe and Eloff, 2002 b; Karlsson et al. 2017; Stahl et al. 2012). In addition, the ISO/IEC 27002 standard and other regulations, such as EU directives (Sundt, 2006), provide information about ISP design. However, most of these papers and guidelines provide high-level recommendations such as providing Actionable Advice (AA) to the employees or state what topics should be included in ISPs. In this paper by AA, we mean instructions provided for employees about “what is allowed and what is not allowed regarding a specific work task” (Rostami et al. 2023). These instructions can be associated with one or more consequences, to sanction non-compliance. At the same time, few guidance are provided on how AA should be worded to be easily understood by employees. One exception is Diver (2021), recommending style guidelines to ensure that pieces of AA are easy to understand for employees. Against this backdrop, the aim of this paper is *to investigate existing ISPs to assess how clear the pieces of actionable advice are and provide suggestions on how actionable advice should be worded in order to be clear*.

## 2 Literature Review

There are several studies that address the importance of writing useful instructions for employees about how to handle information assets in a secure manner (e.g., Alshaikh et al. 2015; Goel and Chengalur-Smith, 2010; Rostami et al. 2020; Stahl et al. 2012).
However, these studies offer limited guidance on how to write an instruction that is clear, leaving little or no room for interpretation. For instance, Stahl et al. (2012) conducted critical discourse analysis on British NHS ISPs. The result of their study revealed that there was a significant amount of ambiguity, especially with respect to the ISPs' objectives and intended targets, as well as significant evidence of the use of jargon and unfamiliar language. Based on their findings, they provided a set of recommendations that should be considered when writing ISP. For example, they suggested that accessible language and terminology should be used, and that specific AA and practical guidelines should be given to employees. However, as they provided high-level recommendations, there is not enough information for information security managers about what is an accessible language or what a piece of AA is or how it should be written.

Goel and Chengalur-Smith (2010) examined the literature on ISPs and identified three dimensions: breadth, clarity and brevity that could be used to characterize how well an ISP is written. They defined breadth as the level of comprehensiveness of the ISP, by clarity they mean an ISP should be easy to read and understand and by brevity they meant that an ISP should not include redundancy, wordiness, jargon, evasiveness, and circumlocution. These dimensions are important and need to be considered when writing ISPs. However, it is not clear what should be done in order to have an ISP that is easy to read and understand at an instruction level, especially how AAs should be worded in the ISP.

Alshaikh et al. (2015) provided a comprehensive overview of the management practices of ISP and developed a practice-based model. Within their model, they emphasized the significance of the length, writing style, and the use of appropriate language in creating ISPs. They noted that if the ISP is too lengthy, the users are likely to ignore it. Nevertheless, their model did not provide sufficient details regarding what constitutes an appropriate language or how the writing style should be crafted to be comprehensible for employees.

Based on existing research, Rostami et al. (2020) provide 14 requirements for developing a computerized tool to design ISPs. These requirements can be considered characteristics of a high-quality ISP. These characteristics are Actionable advice, Adapted to the work practice, Based on identified risks, Clarifying responsibilities, Clear and uniform target groups, Clear communicative objectives, Clear structure, Clearly defined concepts, Informed by laws, regulations, and standards, Internally congruent ISP actions, Keep up-to-date, Goal alignment, Styling, and Tailorable design. Although the provided list of requirements is valuable and should be considered in designing ISPs, these requirements are defined in an abstract level. For example, Rostami et al. (2020) describe that AA should inform employees on how to act with regard to information security. As is evident, this requirement does not provide any details about how the ISP should be worded in order to give clear instructions to employees on how to act.

In conclusion, the studies reviewed highlight the importance of writing clear and comprehensive instructions for employees. However, while these studies offer valuable insights, they provide limited guidance on the actual process of writing instructions that can guide employees towards executing their work tasks in a secure manner. Therefore, there remains a gap in the literature regarding how to write instructions that are easy to read, understand, and follow for employees. This gap shows the need to focus on
providing concrete practical guidance and examples to ensure the development of clear
and AA for employees.

## 3 Research Method

The research approach taken in this study is qualitative content analysis (Assarroudi et al. 2018). This research approach uses a systematic process of coding to describe and interpret textual data. According to Hsieh and Shannon (2005), there are three distinct approaches to qualitative content analysis: conventional, directed, or summative. Key differences among these approaches center on how initial codes are developed. Conventional analysis derives categories from data during analysis, allowing for a richer understanding of a phenomenon. Directed analysis uses existing theory to develop the initial coding scheme, with the scheme being refined as analysis proceeds. Summative analysis approaches text as single words or specific content to interpret contextual meaning based on patterns. In this paper, the third approach was taken to identify patterns in ISPs. In the following, the process of data collection and data analysis is presented.

### 3.1 Collecting ISPs

As an empirical starting point for our study, we obtained access to ISPs from public agencies in Sweden. The ISPs were requested from the Swedish Civil Contingencies Agency, which had compiled the ISPs. We choose to address public agencies since according to the principle of public access to official records (SFS, 2009) documents stored, received, and established at an agency are made public upon request if they are not classified as confidential. Furthermore, as discussed in Sect. 1, our focus is on operational ISPs. This meant that our criterion for including an ISP is that its main focus is on guiding employees' behavior. Thus, ISPs that set the organizations' overall information scope or provided detailed information security configurations of information systems were not included. In total, we have included 15 ISPs in this study. Although these ISP all target employees they differ in length. They ranged between 3 and 22 pages. In total, we have analyzed 124 ISP pages.

### 3.2 Identifying the Keywords

As outlined in Sect. 2, the existing body of research does not provide clear guidance on how to construct pieces of AA that are direct, imperative, and easily comprehensible. In Sect. 1 we referred to the work of Karlsson et al. (2017), who proposed eight quality criteria for the design of ISPs. One of these criteria stresses the importance of incorporating instructions that are aligned with the employees' current work practices. However, similar to Stahl et al. (2012) this particular criterion is formulated at an abstract level, and it does not offer a detailed explanation of how to achieve congruence between the instruction and the work task. Consequently, there remains a gap in our understanding of how to develop clear and understandable pieces of AA that are compatible with the tasks performed by employees.
Nonetheless, moving beyond research, practitioner guidelines for designing ISPs have been proposed, such as those offered by Diver (2021). These suggestions may serve to complement the work of Karlsson et al. (2017) as they offer practical guidelines for writing ISPs. Diver (2021) has recommended following certain style guidelines to ensure that AA are easy to understand by employees. For instance, it is advisable to use concrete language and avoid abstract terminology that can be confusing. Negative statements such as “never” should be avoided, as they introduce shades of prohibition that may not be clear. Instead, the focus should be on presenting AA that are clear, usable, and unambiguous about actions that are allowed or disallowed, as well as any exceptions that apply. Diver (2021) further recommended using “must” in place of “shall” and “will,” where “must” is intended, to avoid inconsistencies and prevent confusion between future tense and mandatory language.

Drawing upon the work of Diver (2021), and to operationalize assessing clear pieces of AA in ISPs we selected nine keywords and translated them to English: “aldrig” (never), “inte” (not), “ej” (not), “förbjuden” (forbidden), “ska” (shall), “skall” (shall), “behöver” (need), “bör” (should), and “måste” (must). The translation was necessary since the collected ISPs were in Swedish. These keywords later on helped us to extract relevant sentences (e.g., potential AA) to analyze.

## 3.3 Extracting Sentences in Each ISP

As discussed above, we had 124 pages of text to analyze. To increase efficiency and consistency in the research process we used the Orange Data Mining Software (Demsar et al. 2013) to extract relevant sentences from the ISPs. Orange is a powerful toolkit for machine learning, data mining, and data visualization. Figure 1 shows the Orange software user interface and the workflow that was created to extract sentences. As the workflow shows a corpus, i.e., a collection of authentic texts, in our case the 15 ISPs, was migrated to the software through Import Document widget. Then the concordance widget was connected to the Import Document. Concordance is essentially a search engine tool which is used to examine the corpus in order to view words in context and extract information about frequency, range (how many different texts a word/phrase is used in), collocation and grammar. Finally, Concordance is connected to Corpus Viewer widget as an output of matching documents (in our case the ISPs including our desired keywords). This way of extracting sentences allow researchers to make decisions based on actual usage, rather than relying on intuition.

In this paper, the application of the concordance widget allowed us to identify sentences in the ISPs containing our predefined keywords (e.g., “ska” and “måste”), along with their surrounding contextual words (see Fig. 2). In the figure we have masked minor parts of some sentences to avoid disclosing the agencies. Concordance was applied nine times, once for each keyword. During each application, the ISPs containing the target keyword were selected and output to the corpus viewer widget for further investigation. In total 890 sentences were extracted from the 15 ISPs, each containing at least one of our predefined keywords.
<figure><img src="image_4.png" /><figcaption>Fig. 1. The workflow for extracting sentences in Orange software.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 2. The result of searching the keyword “ska” in Concordance widget</figcaption></figure>

## 3.4 Analyzing the Extracted Sentences

Upon identifying the sentences in each ISP, the authors proceeded to analyze them. The sentences were extracted from the corpus viewer and stored in an Excel sheet. The set of sentences was divided between the authors and the analysis was done individually. After completing the individual analyses, the authors engaged in a comprehensive examination of the challenges encountered during the analysis process, specifically focusing on the sentences that posed uncertainties in terms of categorization. This discussion was conducted during a dedicated session and helped the authors to settle any inconsistency. After the session, the individual analyses were later merged into one.
During the analysis, the authors categorized the extracted sentences (that contains the keywords) as either AA or Other information (OI) depending on the type of information conveyed. Although categorizing the sentences was relatively straightforward it was not mechanical. If the sentence contained sufficient information to act upon without any ambiguity, it was categorized as clear AA; otherwise, it was categorized as OI. Accordingly, the OI represents both ambiguous instructions and sentences that are similar to AA but are written at a high level. For example, sentences such as “Passwords must not be given over the phone” or “read e-mail that does not need to be saved should be deleted in order not to take up unnecessary space on the server” were classified as AA, as they provided specific directions for employees to follow. On the other hand, sentences such as “all staff must exercise caution when using e-mail” or “orders must be submitted to IT in good time for planning the implementation of the order” were classified as OI (not well-written instructions). The former sentence was considered vague because it lacked specificity on how to approach e-mails, while the latter was ambiguous since “good time” could be interpreted differently by employees. Meanwhile, sentences such as “the information in the X IT system sometimes concerns the personal circumstances of individual citizens, e.g., protected identity, and must therefore be carefully protected against unwanted changes as well as loss and disclosure” were also classified as OI because they provide an overall direction that is more suitable for ISPs at the strategic level, despite including relevant keywords.

## 4 Result

In this section, we present the analysis of the extracted ISP sentences. The results are summarized in Table 1, which provides an overview of the distribution of AA and OI in each ISP. The leftmost column lists the identifier of the ISP, while the second and third columns show the number of sentences classified as AA and OI, respectively. The fourth column provides the total number of extracted sentences for each ISP. The last two columns present the percentage of AA and OI in each ISP, providing a comprehensive view of the distribution of the two categories of sentences in the entire dataset.

As Table 1 shows, overall, 890 sentences were extracted from 15 ISPs that included at least one of our keywords (e.g., “ska”, “måste”) that are suggested to guide AA. Among these sentences, 294 of them were AA (33%), and 596 of them (67%) were OI. Looking at the ISPs in Table 1, only in three ISPs (ISP 1, ISP 4, and ISP 6) more than 50% their extracted sentences classified as AA. There are four ISPs (ISP 7, ISP 10, and ISP 13) that 11% or less of their extracted sentences were classified as AA. Overall, we found that only one-third (33%) of the extracted sentences containing the predefined keywords provided clear instructions for employees. The remaining two-thirds (67%) of the sentences contained the keywords but conveyed other types of information.

To investigate the distribution of the keywords used in the extracted sentences, we analyzed the number of times each keyword appeared in AA and OI. Table 2 presents the distribution of the keywords in an AA sentence and Table 3 shows the number of times each keyword was used in an OI sentence. With initial inspection, it is evident that there is a degree of similarity between the two tables. Notably, all predefined keywords were utilized in both AA and OI sentences, and in general, the keywords have been distributed with almost a same pattern in the two tables.
<table><caption>**Table 1.** The overall distribution of extracted sentences</caption><thead><tr><th>ISPs</th><th>AA</th><th>OI</th><th>Total</th><th>% of AA</th><th>% of OI</th></tr></thead><tbody><tr><td>ISP 1</td><td>42</td><td>7</td><td>49</td><td>86%</td><td>14%</td></tr><tr><td>ISP 2</td><td>23</td><td>34</td><td>57</td><td>40%</td><td>60%</td></tr><tr><td>ISP 3</td><td>20</td><td>21</td><td>41</td><td>49%</td><td>51%</td></tr><tr><td>ISP 4</td><td>36</td><td>27</td><td>63</td><td>57%</td><td>43%</td></tr><tr><td>ISP 5</td><td>7</td><td>24</td><td>31</td><td>23%</td><td>77%</td></tr><tr><td>ISP 6</td><td>23</td><td>14</td><td>37</td><td>62%</td><td>38%</td></tr><tr><td>ISP 7</td><td>5</td><td>59</td><td>64</td><td>8%</td><td>92%</td></tr><tr><td>ISP 8</td><td>20</td><td>139</td><td>159</td><td>13%</td><td>87%</td></tr><tr><td>ISP 9</td><td>13</td><td>19</td><td>32</td><td>41%</td><td>59%</td></tr><tr><td>ISP 10</td><td>4</td><td>36</td><td>40</td><td>10%</td><td>90%</td></tr><tr><td>ISP 11</td><td>41</td><td>82</td><td>123</td><td>33%</td><td>67%</td></tr><tr><td>ISP 12</td><td>35</td><td>71</td><td>106</td><td>33%</td><td>67%</td></tr><tr><td>ISP 13</td><td>2</td><td>16</td><td>18</td><td>11%</td><td>89%</td></tr><tr><td>ISP 14</td><td>12</td><td>16</td><td>28</td><td>43%</td><td>57%</td></tr><tr><td>ISP 15</td><td>11</td><td>31</td><td>42</td><td>26%</td><td>74%</td></tr><tr><td>sum</td><td>294</td><td>596</td><td>890</td><td>33%</td><td>67%</td></tr></tbody></table>

Table 2 shows that out of the nine keywords analyzed, “inte” (not), “skall” (shall), and “ska” (shall) were used most frequently with 70, 55, and 131 occurrences, respectively. Among the rarely used keywords we found “aldrig” (never) and “förbjuden” (forbidden), they were used only 3 and 2 times each in AA sentences.

Table 3 shows a similar pattern in OI sentences, with “inte” (not), “skall” (shall), and “ska” (shall) used most frequently and “aldrig” (never) and “förbjuden” (forbidden) used least frequently. However, the keyword “måste” (must) appeared more frequently in OI sentences compared to AA sentences. An example sentence including this keyword is “all paper-based information of a sensitive nature must be handled carefully, even within the X’s premises. “ This sentence leaves room for ambiguity since multiple interpretations could be made regarding what constitutes “handling carefully.”

Several ISPs listed in Table 3 exhibit a notable frequency of the keyword “ska” (shall), as seen in ISPs 7, 8, 11, and 12, which was used 48, 111, 64, and 64 times, respectively. An example sentence including this keyword is “all orders shall be approved by both the immediate manager and the IT manager before the assignment is carried out, however, the IT manager alone can approve the order within the framework of his powers.” This sentence is ambiguous not only because the meaning of “framework of his powers” is unclear but also because it appears to be a general guideline for an ISP at a strategic level.
<table><caption>**Table 2.** Number of keywords for AA</caption><thead><tr><th>ISP</th><th>Aldrig (never)</th><th>Inte (not)</th><th>Ej (not)</th><th>Förbjuden (forbidden)</th><th>Skall (shall)</th><th>Behöver (need)</th><th>Bör (should)</th><th>Måste (must)</th><th>Ska (shall)</th></tr></thead><tbody><tr><td>ISP 1</td><td>0</td><td>21</td><td>2</td><td>0</td><td>11</td><td>2</td><td>0</td><td>0</td><td>6</td></tr><tr><td>ISP 2</td><td>2</td><td>5</td><td>1</td><td>0</td><td>6</td><td>0</td><td>0</td><td>0</td><td>9</td></tr><tr><td>ISP 3</td><td>0</td><td>0</td><td>1</td><td>0</td><td>16</td><td>0</td><td>1</td><td>1</td><td>1</td></tr><tr><td>ISP 4</td><td>1</td><td>7</td><td>2</td><td>0</td><td>19</td><td>0</td><td>6</td><td>1</td><td>0</td></tr><tr><td>ISP 5</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>7</td></tr><tr><td>ISP 6</td><td>0</td><td>14</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>7</td></tr><tr><td>ISP 7</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>4</td></tr><tr><td>ISP 8</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>2</td><td>3</td><td>1</td><td>13</td></tr><tr><td>ISP 9</td><td>0</td><td>5</td><td>0</td><td>2</td><td>3</td><td>0</td><td>1</td><td>1</td><td>1</td></tr><tr><td>ISP 10</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>3</td></tr><tr><td>ISP 11</td><td>0</td><td>7</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>34</td></tr><tr><td>ISP 12</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>34</td></tr><tr><td>ISP 13</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>1</td><td>1</td></tr><tr><td>ISP 14</td><td>0</td><td>3</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0</td><td>2</td><td>6</td></tr><tr><td>ISP 15</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>0</td><td>5</td></tr><tr><td>Sum</td><td>3</td><td>70</td><td>6</td><td>2</td><td>55</td><td>5</td><td>15</td><td>7</td><td>131</td></tr></tbody></table>

## 5 Discussion and Conclusion

The empirical findings of this study were unexpected. The inclusion of operational ISPs led us to anticipate a greater proportion of actionable advice (AA) within each ISP. However, our results indicate that contrary to the prevailing emphasis in the literature on the importance of clear and understandable ISPs (e.g., Alshaikh et al. 2015; Rostami et al. 2020; Stahl et al. 2012) a majority of the ISPs assessed do not provide employees with unambiguous instructions on how to use and handle information assets in a secure manner.

Upon a closer examination of the ISP sentences, it becomes apparent that the actual AA provided in the ISPs aligns with the recommendation made by Diver (2021). For example, the analysis of the sentences in the ISPs revealed a scarcity of negative statements such as “aldrig” (never) and “förbjuden” (forbidden). However, our analysis shows that “skall” (shall) and “ska” (shall) have been used mostly instead of “måste” (must) in ISPs. Considering the culture and the tone that is used in Swedish organizations and the point that these keywords convey strong advice in the Swedish language, the usage of these keywords is understandable.

Nonetheless, we also found a high frequency of “ska” (shall) in sentences classified as other information (OI), where they have not been used correctly. This is a concern, as employees rely on these documents to comprehend instructions about their job duties
<table><caption>**Table 3.** Number of keywords for OI</caption><thead><tr><th>ISP</th><th>Aldrig (never)</th><th>Inte (not)</th><th>Ej (not)</th><th>Förbjuden (forbidden)</th><th>Skall (shall)</th><th>Behöver (need)</th><th>Bör (should)</th><th>Måste (must)</th><th>Ska (shall)</th></tr></thead><tbody><tr><td>ISP 1</td><td>0</td><td>3</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>3</td></tr><tr><td>ISP 2</td><td>0</td><td>15</td><td>3</td><td>0</td><td>8</td><td>0</td><td>0</td><td>0</td><td>8</td></tr><tr><td>ISP 3</td><td>0</td><td>4</td><td>2</td><td>0</td><td>9</td><td>0</td><td>2</td><td>1</td><td>3</td></tr><tr><td>ISP 4</td><td>0</td><td>4</td><td>2</td><td>0</td><td>16</td><td>0</td><td>2</td><td>2</td><td>1</td></tr><tr><td>ISP 5</td><td>0</td><td>3</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0</td><td>1</td><td>19</td></tr><tr><td>ISP 6</td><td>0</td><td>4</td><td>0</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0</td><td>9</td></tr><tr><td>ISP 7</td><td>0</td><td>6</td><td>0</td><td>0</td><td>4</td><td>1</td><td>0</td><td>0</td><td>48</td></tr><tr><td>ISP 8</td><td>2</td><td>7</td><td>0</td><td>0</td><td>0</td><td>3</td><td>2</td><td>14</td><td>111</td></tr><tr><td>ISP 9</td><td>0</td><td>6</td><td>3</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>8</td></tr><tr><td>ISP 10</td><td>0</td><td>11</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>23</td></tr><tr><td>ISP 11</td><td>0</td><td>15</td><td>0</td><td>0</td><td>0</td><td>0</td><td>2</td><td>1</td><td>64</td></tr><tr><td>ISP 12</td><td>0</td><td>3</td><td>0</td><td>0</td><td>0</td><td>0</td><td>1</td><td>3</td><td>64</td></tr><tr><td>ISP 13</td><td>0</td><td>6</td><td>0</td><td>0</td><td>2</td><td>1</td><td>0</td><td>0</td><td>7</td></tr><tr><td>ISP 14</td><td>0</td><td>2</td><td>0</td><td>2</td><td>0</td><td>1</td><td>0</td><td>1</td><td>10</td></tr><tr><td>ISP 15</td><td>0</td><td>2</td><td>0</td><td>0</td><td>0</td><td>1</td><td>0</td><td>2</td><td>26</td></tr><tr><td><strong>Sum</strong></td><td><strong>2</strong></td><td><strong>91</strong></td><td><strong>10</strong></td><td><strong>2</strong></td><td><strong>41</strong></td><td><strong>9</strong></td><td><strong>10</strong></td><td><strong>27</strong></td><td><strong>404</strong></td></tr></tbody></table>

but may become further confused. Furthermore, incorporating a variety of words such as “ska” (shall), “bör” (should), “behöver” (need) and “måste” (must) in a single ISP can contribute to ambiguity and uncertainty.

In conclusion, this research offers insights that can inform how to improve ISPs and enhance their efficacy in promoting desirable employee behavior. Based on our findings we suggest that ISP designers should be mindful of their word choices, particularly when crafting AA containing obligation-conveying words such as “must”. To ensure that the advice is actionable, ISP designers should ensure that employees can act upon it without the need of any interpretation. Furthermore, consistency in word usage within the ISP is paramount. To maintain consistency and hence clarity, first, it is advisable to reserve certain terminology for AA and refrain from using this terminology in OI. Second, it is advisable to avoid the use of different synonyms or similar words when the level of obligation remains the same. In other words, if multiple sentences convey the same level of obligation, it is preferable to use the same terminology in all of them to avoid ambiguity and confusion.

As with any research, our study has limitations that should be taken into consideration in future research. One of the limitations of this research is the exclusion of sentences containing phrases such as ‘be careful’ and ‘keep in mind’. The inclusion of such phrases could provide a more comprehensive understanding of how pieces of AA are constructed, and future studies may wish to explore this further. Additionally, our analysis was limited
to Swedish-language ISPs and the Swedish organizational context. Thus, the results may vary when applied to ISPs written in other languages. Therefore, further research could investigate the extent to which different keywords are utilized in AA across various languages.

## References

Alshaikh, M., Maynard, S.B., Ahmad, A., Chang, S.: Information security policy: a management practice perspective. In: Australasian Conference on Information Systems (2015)

Assarroudi, A., Heshmati Nabavi, F., Armat, M.R., Ebadi, A., Vaismoradi, M.: Directed qualitative content analysis: the description and elaboration of its underpinning methods and data analysis process. J. Res. Nurs. 23(1), 42–55 (2018)

Bulgurcu, B., Cavusoglu, H., Benbasat, I.: Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness. MIS Q. 34(3), 523–548 (2010)

Chowdhury, N.H., Adam, M.T., Skinner, G.: The impact of time pressure on cybersecurity behaviour: a systematic literature review. Behav. Inf. Technol. 38(12), 1290–1308 (2019)

Demsar, J., et al.: Orange: data mining toolbox in python. J. Mach. Learn. Res. 14 2349–2353 (2013). https://jmlr.org/papers/volume14/demsar13a/demsar13a.pdf

Diver, S.: Information Security Policy - A Development Guide for Large and Small Companies. SANS Institute (2021)

Goel, S., Chengalur-Smith, I.N.: Metrics for characterizing the form of security policies. J. Strateg. Inf. Syst. 19(4), 281–295 (2010)

Höne, K., Eloff, J.H.P.: What makes an effective information security policy? Netw. Secur. 2002(6), 14–16 (2002b)

Hsieh, H.-F., Shannon, S.E.: Three approaches to qualitative content analysis. Qual. Health Res. 15(9), 1277–1288 (2005)

Karlsson, F., Hedström, K., Goldkuhl, G.: Practice-based discourse analysis of information security policies. Comput. Secur. 67, 267–279 (2017). https://doi.org/10.1016/j.cose.2016.12.012

Kör, B., Metin, B.: Understanding human aspects for an effective information security management implementation. Int. J. Appl. Decis. Sci. 14(2), 105–122 (2021)

Loch, K.D., Carr, H.H., Warkentin, M.E.: Threats to information systems: today’s reality, yesterday’s understanding. MIS Q. 16, 173–186 (1992)

Ponemon Institute LLC. Cost of Insider Threats: Global Report (2020). https://www.ibm.com/downloads/cas/LQZ4RONE

PWC. The Information Security Breaches Survey - Technical Report. Department for Business, Innovation and Skills (BIS), London, UK (2014).

Rostami, E.: Tailoring information security policies–a computerized tool and a design theory Örebro universitet] (2023)

Rostami, E., Karlsson, F., Gao, S.: Requirements for computerized tools to design information security policies. Comput. Secur. 99, 102063 (2020)

Rostami, E., Karlsson, F., Gao, S.: Policy components–a conceptual model for modularizing and tailoring of information security policies. Inf. Comput. Secur. 31, 331–352 (2023)

SFS. 2009:400 Offentlighets- och sekretesslag. Justitiedepartementet, Stockholm (2009)

Stahl, B.C., Doherty, N.F., Shaw, M.: Information security policies in the UK healthcare sector: a critical evaluation. Inf. Syst. J. 22, 77–94 (2012)

Sundt, C.: Information security and the law. Inf. Secur. Tech. Rep. 11(1), 2–9 (2006)

Whitman, M.: Security policy: from design to maintenance. In: Straub, D.W., Goodman, S.E., Baskerville, R. (eds.) Information security: Policy, processes, and practices, pp. 123–151. M. E. Sharpe, New York (2008)
Willison, R., Warkentin, M.: Beyond deterrence: an expanded view of employee computer abuse.
MIS Q. 37, 1–20 (2013)