1213141516171815 of 20
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Beyond Levels: Supporting Information Classification
Luleå University of Technology, Department of Computer Science, Electrical and Space Engineering, Digital Services and Systems.ORCID iD: 0000-0002-4057-9454
2026 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

Information is a critical asset for organisations, enabling business processes and planning at strategic, tactical, and operational levels. Given its importance, information must be protected against risk, typically through information security risk management. Effective protection, however, requires an understanding of what information is valuable and why. Information classification provides this foundation by assessing the value of information assets and determining their organisational importance. Although classification is addressed in standards and academic literature, it has received limited empirical attention. Existing guidance explains what classification aims to achieve but offers little insight into how it is conducted in practice or how organisational conditions influence the process across strategic, tactical, and operational levels. As a result, key aspects of classification work remain underexplored.

Against this background, the purpose of this thesis is to create knowledge about the relevance of information classification within the strategic, tactical, and operational levels of an organisational context. To fulfil this purpose, the thesis identifies organisational prerequisites that enable meaningful classification, challenges that hinder it, and ways to support the practice and documentation of classification. These prerequisites, challenges, and support categories are analysed using a multi-level planning framework.

The research is based on five peer-reviewed studies, four of which were conducted in Swedish public sector organisations and one of which was conducted in the air traffic management domain. The empirical material includes semi-structured interviews, document analysis, tool demonstrations, and expert validation.

The findings demonstrate that information classification should not be understood merely as an isolated operational workshop activity. Instead, it is a multi-level organisational process shaped by strategic direction, tactical preparation, and operational execution. By adapting and applying a multi-level planning framework to information classification, the thesis shows that challenges and prerequisites identified during classification often originate from insufficient strategic framing and limited tactical support. Furthermore, classification is shown to be inherently interpretive. Subjective judgment plays a central role in assessing the value of information assets. In contrast to prior research, which often frames subjectivity as a weakness to be minimised, this thesis reconceptualises subjectivity as a necessary and unavoidable component of meaningful classification decisions. Finally, two main avenues for supporting classification are identified: automation and assistance. Automation refers to automating mainly administrative parts of classification, while assistance refers to providing support to carry out the process. Building on the assistance perspective, the thesis addresses an underdeveloped aspect of existing methods by developing structured documentation support that enables workshop participants to capture contextual knowledge and decision rationale. 

Abstract [sv]

Information är en kritisk tillgång för organisationer som möjliggör verksamhetsprocesser samt planering på strategisk, taktisk och operativ nivå. Med hänsyn till dess betydelse måste information skyddas mot risk, vanligtvis genom informationssäkerhetsriskhantering. Ett effektivt skydd förutsätter dock en förståelse för vilken information som är värdefull och varför. Informationsklassning utgör denna grund genom att bedöma värdet av informationstillgångar och fastställa deras organisatoriska betydelse. Även om informationsklassning behandlas i såväl standarder som akademisk litteratur har området fått begränsad empirisk uppmärksamhet. Nuvarande vägledning beskriver vad informationsklassning syftar till att uppnå men ger begränsad insikt i hur det genomförs i praktiken eller hur organisatoriska förutsättningar påverkar processen på strategisk, taktisk och operativ nivå. Detta har lett till att viktiga aspekter av klassningsarbetet är otillräckligt utforskade.

Mot denna bakgrund är syftet med avhandlingen att skapa kunskap om informationsklassningens relevans inom strategiska, taktiska och operativa nivåer i en organisatorisk kontext. För att uppfylla detta syfte identifierar avhandlingen organisatoriska förutsättningar som möjliggör meningsfull informationsklassning, utmaningar som försvårar den samt stöd för genomförandet och dokumentationen av klassning. Dessa förutsättningar, utmaningar och stödformer analyseras med hjälp av ett flernivåbaserat planeringsramverk. 

Avhandlingen baseras på fem sakkunniggranskade och publicerade studier, varav fyra har genomförts i svensk offentlig sektor och en i flygtrafikledningsområdet. Det empiriska materialet består av semistrukturerade intervjuer, dokumentanalys, verktygsdemonstrationer och expertvalidering.

Resultaten visar att informationsklassning inte bör ses som en enbart operativ workshopaktivitet. I stället framställs den som en organisatorisk process som påverkas av flera organisatoriska nivåer, formad av strategisk inriktning, taktiska förberedelser och operativt genomförande. Genom att anpassa och tillämpa ett flernivåbaserat planeringsramverk på informationsklassning visar avhandlingen att de utmaningar och förutsättningar som identifieras under klassningsprocessen ofta har sitt ursprung i bristande strategisk inramning och otillräckligt taktiskt stöd. Vidare visas att klassning är en i grunden tolkande process, där subjektiva bedömningar har en viktig roll i värderingen av informationstillgångar. I kontrast till tidigare forskning, som ofta framställer subjektivitet som en svaghet som bör minimeras, omkonceptualiserar avhandlingen subjektivitet som en nödvändig komponent i meningsfulla klassningsbeslut.

Avslutningsvis identifieras två huvudsakliga vägar för att stödja klassning: automatisering och assistans. Med automatisering menas automatiseringen av främst administrativa delar av klassningen. Assistans hänvisar istället till att stödja utförandet av processens olika delar. Med utgångspunkt i ett assistansperspektiv bidrar avhandlingen till en underutvecklad del av befintliga klassningsmetoder genom att utveckla ett strukturerat dokumentationsstöd som möjliggör för deltagare i klassningsworkshops att fånga upp och dokumentera både kontextuell kunskap och beslutsmotivering. 

Place, publisher, year, edition, pages
Luleå: Luleå University of Technology, 2026.
Series
Doctoral thesis / Luleå University of Technology, ISSN 1402-1544
Keywords [en]
Information Security, Information Security Risk Management, Information Classification, Organisational Practice, Multi-level planning
National Category
Information Systems
Research subject
Information Systems
Identifiers
URN: urn:nbn:se:ltu:diva-116736ISBN: 978-91-8142-008-1 (print)ISBN: 978-91-8142-009-8 (print)OAI: oai:DiVA.org:ltu-116736DiVA, id: diva2:2047026
Public defence
2026-06-05, E632, Luleå University of Technology, Luleå, 09:00 (English)
Opponent
Supervisors
Available from: 2026-03-19 Created: 2026-03-18 Last updated: 2026-03-19Bibliographically approved
List of papers
1. Problems in information classification: insights from practice
Open this publication in new window or tab >>Problems in information classification: insights from practice
2023 (English)In: Information and Computer Security, E-ISSN 2056-4961, Vol. 31, no 4, p. 449-462Article in journal (Refereed) Published
Abstract [en]

Purpose

This study aims to identify problems connected to information classification in theory and to put those problems into the context of experiences from practice.

Design/methodology/approach

Five themes describing problems are discussed in an empirical study, having informants represented from both a public and a private sector organization.

Findings

The reasons for problems to occur in information classification are exemplified by the informants’ experiences. The study concludes with directions for future research.

Originality/value

Information classification sustains the basics of security measures. The human–organizational challenges are evident in the activities but have received little attention in research.

Place, publisher, year, edition, pages
Emerald Group Publishing Limited, 2023
Keywords
Information classification, Risk assessment, Information security
National Category
Information Systems
Research subject
Information Systems
Identifiers
urn:nbn:se:ltu:diva-96595 (URN)10.1108/ics-10-2022-0163 (DOI)000964077800001 ()2-s2.0-85152044380 (Scopus ID)
Projects
ISSUES
Note

Validerad;2023;Nivå 2;2023-11-08 (hanlid);

Funder: Interreg Aurora;

Licens full text: CC BY

Available from: 2023-04-14 Created: 2023-04-14 Last updated: 2026-03-18Bibliographically approved
2. To Risk Analyse, or Not to Risk Analyse: That’s the Question
Open this publication in new window or tab >>To Risk Analyse, or Not to Risk Analyse: That’s the Question
2024 (English)In: Human Aspects of Information Securityand Assurance: 18th IFIP WG 11.12 International Symposium, HAISA 2024, Skövde, Sweden, July 9–11, 2024, Proceedings, Part I / [ed] Nathan Clarke, Steven Furnell, Springer Nature , 2024, p. 107-119Conference paper, Published paper (Refereed)
Abstract [en]

Risk analysis is a key activity for organisations that are looking to protect their valuable information assets against threats, such as malicious actors. It is one of the essential parts of risk management and is used to justify and prioritise what assets require the attention of which potential security controls. Risk management, and more specifically, risk analysis, is an activity that should be performed continuously. However, recent studies indicate that this is not always the case. As such, this paper investigates risk analysis as it is performed in practice in different Swedish public sector organisations. The results are based on semi-structured interviews with 17 senior security experts, an analysis of standards, and a national method support aiming to fill the gap between standard and practice. The results are presented in three themes: how, when and why risk analysis is performed. Of note, we identify that there is an issue of overlooking specific assets or systems when establishing an organisational-wide risk profile and a general recognition of the necessity for risk analysis, albeit not always in alignment with a classic risk analysis.

Place, publisher, year, edition, pages
Springer Nature, 2024
Series
IFIP Advances in Information and Communication Technology, ISSN 1868-4238, E-ISSN 1868-422X ; 721
Keywords
Risk Analysis, Information Security, Cybersecurity
National Category
Information Systems
Research subject
Information Systems
Identifiers
urn:nbn:se:ltu:diva-110456 (URN)10.1007/978-3-031-72559-3_8 (DOI)001561042000008 ()2-s2.0-85211361560 (Scopus ID)
Conference
18th IFIP International Symposium on Human Aspects of Information Security & Assurance (HAISA 2024), Skävde, Sweden, July 9-11, 2024
Note

ISBN for host publication: 978-3-031-72558-6, 978-3-031-72559-3, 978-3-031-72561-6

Available from: 2024-10-21 Created: 2024-10-21 Last updated: 2026-03-18Bibliographically approved
3. Information security risk management tools in the air traffic management domain: what are practitioners’ needs?
Open this publication in new window or tab >>Information security risk management tools in the air traffic management domain: what are practitioners’ needs?
Show others...
2025 (English)In: Information Security Journal, ISSN 1939-3555, E-ISSN 1939-3547, Vol. 34, no 6, p. 561-578Article in journal (Refereed) Published
Abstract [en]

Information Security Risk Management (ISRM) activities are essential for organizations seeking to control and monitor risk. However, it is well known that doing so is difficult, and the different ISRM activities provide different challenges. To provide support, ISRM tools can be used. Such tools can come in the form of spreadsheets, document templates, or dedicated software to support either part of or the full ISRM work. Few studies have been conducted investigating the use of such tools and their necessary properties. Through semi-structured interviews with 17 security practitioners in the Air Traffic Management (ATM) domain and five validation sessions with 34 experts, this study examines the needs of security practitioners using ISRM tools. The ATM domain was chosen as the study context since they use a method built on the ISO/IEC 27005 standard, which, unlike other ISRM frameworks, does not provide tool support. The findings contain a collection of properties needed in ISRM tools. Notably, the ability to get a holistic view of risks in and toward the organization, tool flexibility, and the ability to get assistance with documentation and information exchange. We also identify that current ISRM tools do not provide enough support and suggest ways to address this. 

Place, publisher, year, edition, pages
Taylor & Francis, 2025
Keywords
Air traffic management, aviation, cybersecurity, information security risk management, security practitioner
National Category
Information Systems, Social aspects
Research subject
Information Systems
Identifiers
urn:nbn:se:ltu:diva-112600 (URN)10.1080/19393555.2025.2498472 (DOI)001482570800001 ()2-s2.0-105004473907 (Scopus ID)
Note

Validerad;2025;Nivå 1;2025-11-05 (u2);

Full text: CC BY license;

Funder: Swedish Civil Contingencies Agency (MSB), project VISKA (MSB 2021-14650); SESAR JU under the EU H2020 research and innovation program (grant agreement 731765); Interreg [20357977];

Available from: 2025-05-07 Created: 2025-05-07 Last updated: 2026-03-18Bibliographically approved
4. The importance of records in information classification – “if you have not documented it, you have not done it”
Open this publication in new window or tab >>The importance of records in information classification – “if you have not documented it, you have not done it”
2026 (English)In: Information and Computer Security, ISSN 2056-4961Article in journal (Refereed) Epub ahead of print
Abstract [en]

Purpose: This paper aims to examine what contextual knowledge should be documented during the information classification process and how such knowledge can be structured to support information security risk management. Although many tools support documentation of basic classification outputs, they often lack functionality for capturing decision rationales or supporting classification discussions to be kept in a record.

Design/methodology/approach: The study used a qualitative approach. Data were collected through 16 semi-structured interviews with information security professionals and observations of 14 tool demonstrations. A thematic analysis was conducted and guided by an existing classification method based on ISO/IEC 27002.

Findings: The study identifies a range of contextual knowledge that practitioners consider important to document, including the classification level, decision rationale and responsible roles. Furthermore, it proposes a structured approach consisting of recommended contextual knowledge to include in a classification record, which may serve as a starting point for organisations conducting information classification. Finally, the study contributes procedural knowledge by clarifying how classification decisions are documented and what information should be retained.

Originality/value: This study addresses an identified gap in both research and practice by specifying what contextual knowledge should be documented during information classification. It provides practical guidance for improving documentation practices and highlights opportunities for tool development in information classification.

Place, publisher, year, edition, pages
Emerald Group Publishing Limited, 2026
Keywords
Information Classification, Information Security Risk Management, Information Security, Documentation, Records
National Category
Information Systems
Research subject
Information Systems
Identifiers
urn:nbn:se:ltu:diva-116528 (URN)10.1108/ics-04-2025-0124 (DOI)001694612700001 ()
Note

Full text license: CC BY 4.0;

Available from: 2026-02-23 Created: 2026-02-23 Last updated: 2026-04-08

Open Access in DiVA

No full text in DiVA

Authority records

Andersson, Simon

Search in DiVA

By author/editor
Andersson, Simon
By organisation
Digital Services and Systems
Information Systems

Search outside of DiVA

GoogleGoogle Scholar

isbn
urn-nbn

Altmetric score

isbn
urn-nbn
Total: 22073 hits
1213141516171815 of 20
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf