The public sector cloud service procurement in Sweden

Abstract

This paper investigates the use of cloud services in the public sector and management of information security challenges in the procurement of such services. The findings are based on an exploratory approach that included a systematic literature review and a survey among the public agencies and municipalities in Sweden. The literature review is used to derive a conceptual framework that structures our empirical results into the three groups: a) contractual and legal, b) operational and c) managerial competency. The survey explored all these three groups. Our findings show that the information security challenges are mostly related to the potential breaching of national security and laws applicable to cross-border cloud services. Most of the cloud contracts of public organizations are found to be supplier driven. In this case, lack of knowledge and awareness in managing procurement are mostly raised compared to technical risks.