This thesis investigates how Swedish municipalities are implementing the 2025 national cybersecurity strategy, with a focus on identifying organizational and resource-related barriers. A qualitative research approach was adopted, five semi-structured interviews with cybersecurity staff were conducted.

The study reveals that while municipalities recognize their essential role in Sweden’s overall cybersecurity landscape, their ability to fulfil this role is hindered by fragmented governance structure, resource constraints and insufficient national support.

The findings were analyzed in relation to the strategy’s three pillars: systematic cybersecurity work (Pillar A), competence development (Pillar B), and incident management (Pillar C).

The study concludes that effective local implementation requires more than strategic intent, it demands tailored national support and governance models that reflect the diverse capacities of municipalities. These insights contribute to the understanding of implementation gaps in public sector cybersecurity and highlight the need for scalable, actionable support mechanisms to bridge national goals with local realities.