Security Scandinavian Style

This thesis presents the findings of an empirical study into the evaluation, formation and implementation of information security management systems aiming to protect organisational information assets. An action research oriented strategy and a research method informed mainly by grounded theory, are employed. The main elements of this thesis are 1) a blueprint process for information security management, 2) an information security evaluation method, 3) sucess factors for creating balanced information security management systems, and 4) a discussion on problems related to measuring the effects of information security education in an organisational context.