This thesis deals with how information is treated in the municipalities and the priority local management makes based on their perception of risk and the strategic importance placed on their information systems. The starting point is a report from the Agency for Civil Contingencies, which shows that there are major gaps in planning to run their operations further from failure. Municipalities must function even if there is a disturbance in the form of an interruption in their information systems. It is therefore important to identify which activities in the municipality that is completely necessary to avoid unacceptable consequences for the citizens. In addition, the municipalities have difficulty in maintaining continuity in their planning. The study found that information security is not high priorities for the council leadership much because of the contextual factors within and outside the municipality. This affected the strategic and operational action by the municipality to take.