Adopting digital product passports (DPPs) poses technical and organisational challenges. This paper outlines a research agenda co-developed with seven industry partners, three manufacturers and four digital/consultancy companies in the construction sector, as part of a 3.5-year project investigating how DPPs can support circular economy practices in real industrial settings. Drawing on a scoping literature review, interviews, and participatory goal- and problem-modelling workshops, the paper outlines current practices and emerging needs related to DPP adoption. The research agenda highlights three focus areas. First, it emphasises the importance of the product use and end-of-life phase, where real-time data can provide valuable insights into product performance, usage patterns, and environmental impact. These insights can inform decisions related to maintenance, reuse, and recycling. Second, it addresses the need for a cybersecurity-centred enterprise architecture and infrastructures that enable trusted and secure sharing of lifecycle data across organisational boundaries. Third, the agenda explores how DPP data can be used proactively to support sustainable product realisation. Taking a sociotechnical perspective, the initial findings reveal both challenges and emerging needs with respect to the DPPs adoption.

This book constitutes the refereed proceedings of the 20th International Conference on Critical Information Infrastructures Security, CRITIS 2025, held in Jönköping, Sweden, during October 21–23, 2025.

The 22 full papers presented in this volume were carefully reviewed and selected from 38 submissions. They were grouped into the following topics: Methods & Practice; Power Grids; Security and Safety Large and Small; Vehicles; Methods; Knowledge, Skills and Education; AI and Critical Infrastructures; Security Frameworks.

Raising cybersecurity awareness (CSA) of employees is crucial for all modern organisations. To meet the organisational need for CSA, activities aimed at increasing CSA have been the focus of both industry and research in the past. There are, subsequently, a plethora of CSA activities for organisations to choose from. Nevertheless, research consistently reports that organisations struggle to raise CSA to an appropriate level, and a core issue lies in their ability to select CSA activities and effectively adopt them. This paper used semi-structured interviews with practitioners working on CSA adoption in public-sector organisations to identify what practitioners perceive as success factors. The interviews were analysed through a socio-technical lens and resulted in a taxonomy that groups success factors for CSA adoption in the three socio-technical dimensions: organisational, user-centric, and technical. The taxonomy outlines ten success factors and demonstrates how the participants see success of CSA activities as not only dependent on technical factors but also, and perhaps even more important, user-adaptability and organisational readiness. The results were validated in a workshop with CSA experts across Europe, who highlighted the practical usefulness of the taxonomy as both a map of potential challenges and a teaching tool for educating new CSA practitioners.

Denna rapport kartlägger och analyserar folkbildande cybersäkerhetsinitiativ i Sverige på uppdrag av Cybercampus Sverige. Under studien identifierades 40 initiativ som kartlades utifrån olika indikatorer och målgrupper. Som en delstudie genomfördes även en enkätundersökning där den svenska allmänhetens åsikter, vanor och beteenden inom cybersäkerhet analyserades. Även en tidslinjeutvecklades under studien.

Kartläggningen utfördes som en avgränsningsöversikt och använde PRISMA-ScR [28] som generell vägledning. En systematisk datainsamling genomfördes där folkbildande cybersäkerhetsinitiativ identifierades utifrån grå litteratur (t.ex. myndighetsrapporter, utredningar och tekniska rapporter). Därefter identifierades indikatorer samt målgrupper. Datainsamlingen för enkätundersökningen i studien utfördes med hjälp av ett datainsamlingsföretag. Därefter utvecklades även en tidslinje över de identifierade initiativen. Studien visar att en stor andel av dagens aktiva initiativ kan spåra sitt ursprung till tidigt 2020-tal.

Kartläggning och analys av initiativens målgrupper visar att de identifierade målgrupperna har bred tillgång till anpassat material, men med vissa undantag. Personer med begränsade svenskkunskaper, invandrare samt personer med funktionsvariationer har en begränsad täckning. Dessa målgrupper identifierades även som sårbara. Initiativen bedrivs ofta på nationell skala och erbjuder omfattande material med en mer grundläggande inriktning. Materialet bedöms ha goda förutsättningar att nå en stor del av befolkningen. Trots detta visar enkätundersökningen att få personer känner till de identifierade initiativen, samt att de har bristande kännedom om olika informationskällor de kan vända sig till. Resultaten indikerar att den största barriären för att stärka allmänhetens cyberkunskaper inte är den befintliga tillgängligheten av folkbildande material. Utmaningen ligger snarare i att nå ut till folket, hålla sig kvar i deras medvetande och få dem att använda befintligt material. Enkätundersökningen visar, i linje med tidigare forskning, att detta är ett särskilt stort problem för grupper med lägre kunskapsnivå.

Rapporten drar slutsatsen att vissa sårbara målgrupper behöver ett större utbud av anpassat material medan övriga målgrupper har en godtagbar täckning. Studien bedömer att ett ökat fokus på att nå allmänheten med befintligt material är ett effektivare sätt att öka allmänhetens kunskap om cybersäkerhet än att utveckla ytterligare material.

Cybersecurity awareness (CSA) is widely recognized as a critical component of digital resilience, complementing technical safeguards by influencing users’ knowledge, behavior, and decision-making. Despite substantial investment in awareness initiatives, their effectiveness remains inconsistent, prompting increased interest in how individual factors shape engagement with and uptake of cybersecurity information. Among these factors, gender has been discussed in prior research, yet findings remain mixed and often lack attention to learning and delivery preferences. This study investigates whether and to what extent gender differences exist in cybersecurity awareness preferences within a national, Swedish, context. A large-scale survey was conducted with 2,149 respondents in Sweden using a stratified sampling approach to ensure representativeness across age and gender. The survey examined preferences related to CSA delivery methods, timing, sources of information, time willingness, and desired characteristics of awareness content. Statistical analyses compared responses from men and women using significance testing and effect size measures, with additional analyses excluding IT professionals to control for occupational bias. The results indicate that while many gender-based differences are statistically significant, the observed effect sizes are consistently small. Both men and women express similar overall preferences, particularly favoring flexible and on-demand access to cybersecurity information, such as email-based communicationand digital lectures. Notable but limited differences include women showing stronger preferences for information from governmental sources and email delivery, while men more frequently favor IT companies and on demand materials. Across both groups, interest in engaging with CSA is generally high.

Purpose

This paper aims to examine what contextual knowledge should be documented during the information classification process and how such knowledge can be structured to support information security risk management. Although many tools support documentation of basic classification outputs, they often lack functionality for capturing decision rationales or supporting classification discussions to be kept in a record.

Design/methodology/approach

The study used a qualitative approach. Data were collected through 16 semi-structured interviews with information security professionals and observations of 14 tool demonstrations. A thematic analysis was conducted and guided by an existing classification method based on ISO/IEC 27002.

Findings

The study identifies a range of contextual knowledge that practitioners consider important to document, including the classification level, decision rationale and responsible roles. Furthermore, it proposes a structured approach consisting of recommended contextual knowledge to include in a classification record, which may serve as a starting point for organisations conducting information classification. Finally, the study contributes procedural knowledge by clarifying how classification decisions are documented and what information should be retained.

Originality/value

This study addresses an identified gap in both research and practice by specifying what contextual knowledge should be documented during information classification. It provides practical guidance for improving documentation practices and highlights opportunities for tool development in information classification.

With the continuous digitalization of all societies, the skills to securely access and use digital systems are crucial for everyone. This is recognized in both research and practice where researchers search for efficient ways to raise cybersecurity awareness (CSA), and both organizations and states are launching initiatives to build aware and skilled populations. An emerging theme in recent research is that of target group adaption and it is suggested that CSA initiatives need to be tailored to the needs and preferences of different groups of recipients. Nevertheless, target group adaption is an underdeveloped aspect of CSA and research indicates that current initiatives fail to address the diverse needs of different populations. This research investigates how national-level CSA initiatives within the European Union are adapted to various target groups through an analysis of member state national cybersecurity strategies. The results show that EU member states acknowledge the need for target group adaption and that a focus on vulnerable groups such as children and seniors is common. However, how to adapt to those groups remains unresolved in both the strategies and related research.

In an increasingly socially connected society, the question of how social media data should be managed after death has become both a practical and ethical concern. This study investigated the preferences and trust of Swedish citizens regarding the post-mortem data management of their social media accounts, which was carried out through a quantitative survey of 174 respondents. The study identified trust levels towards users, social media providers, and analysed how demographic factors influenced trust. The study’s findings revealed that most participants wished to convert their accounts into memorialised profiles or delete them entirely, with a large majority placing their trust in family members rather than friends or social media platforms to carry out the deceased’s wishes. Demographic factors such as age and whether they have children were found to affect trust levels. The study highlights a lack of awareness regarding the possibility of digital wills, pointing out the need for better user education and clearer legacy tools from social media providers. The study concludes by presenting recommendations for users, social media providers, and policymakers to address the legal, ethical, and emotional issues of post-mortem social media management.

Information Security Risk Management (ISRM) activities are essential for organizations seeking to control and monitor risk. However, it is well known that doing so is difficult, and the different ISRM activities provide different challenges. To provide support, ISRM tools can be used. Such tools can come in the form of spreadsheets, document templates, or dedicated software to support either part of or the full ISRM work. Few studies have been conducted investigating the use of such tools and their necessary properties. Through semi-structured interviews with 17 security practitioners in the Air Traffic Management (ATM) domain and five validation sessions with 34 experts, this study examines the needs of security practitioners using ISRM tools. The ATM domain was chosen as the study context since they use a method built on the ISO/IEC 27005 standard, which, unlike other ISRM frameworks, does not provide tool support. The findings contain a collection of properties needed in ISRM tools. Notably, the ability to get a holistic view of risks in and toward the organization, tool flexibility, and the ability to get assistance with documentation and information exchange. We also identify that current ISRM tools do not provide enough support and suggest ways to address this.

Risk analysis is a key activity for organisations that are looking to protect their valuable information assets against threats, such as malicious actors. It is one of the essential parts of risk management and is used to justify and prioritise what assets require the attention of which potential security controls. Risk management, and more specifically, risk analysis, is an activity that should be performed continuously. However, recent studies indicate that this is not always the case. As such, this paper investigates risk analysis as it is performed in practice in different Swedish public sector organisations. The results are based on semi-structured interviews with 17 senior security experts, an analysis of standards, and a national method support aiming to fill the gap between standard and practice. The results are presented in three themes: how, when and why risk analysis is performed. Of note, we identify that there is an issue of overlooking specific assets or systems when establishing an organisational-wide risk profile and a general recognition of the necessity for risk analysis, albeit not always in alignment with a classic risk analysis.