A Qualitative Insight into how Well-prepared Essential and Important Entities are for the Implementation of NIS2: A Danish Context

Abstract

The complexity of the cyber world is calling for a general change in how to defend against malicious software such as ransomware campaigns targeted European organisations and essential infrastructure. This dissertation contains a holistic description of how private organisations can use NIS2 to protect against cybercriminals. The primary focus is on how well-prepared Danish organisations are for NIS2 and increasing cyber resilience across the European Union. The data comes from semi-structured interviews with relevant Danish citizens from private entities and public figures to answer the problem formulation. The methodology chapter describes how the world is socially constructed by individuals and changes with experience, and the dissertation follows a constructivist view of the world. The analysis will use strategy theory from Mintzberg and John Kotter to research how well-prepared Danish organisations are for implementing NIS2 based on data obtained from 5 interviews. The discussion goes in-depth with how legislation can protect Danish organisations from cyber-attacks and three core elements of NIS2 that are difficult to implement in Denmark. The dissertation will conclude that Danish organisations, mainly SMEs are not well-prepared for NIS2. The main reasons are the lack of information about who is in scope, the general cyber security culture, and the lack of IT professionals specialising in cyber defence and legislation.