Cybersecurity is important to hospitals and patients alike and is becoming more important as healthcare is experiencing more cybercrime over time. It is the result of complex interactions between actors and their environment during procurement, but research has not yet studied the combination of cybersecurity, healthcare and procurement together. The main research question is: What is the role of cybersecurity in hospital procurement processes and how can that role be analysed across the sector? Nine semi-structured interviews were conducted with hospital cybersecurity experts. Using a combination of a purchase process model and complex decision-making framework and using semi-grounded theory techniques for analysis, five key factors and their interrelations were identified: supplier-hospital relationship, knowledge exchange and retention, alternative purchase processes, cloud transition and conflicting priorities. These factors influence the decision power of hospitals and their internal departments before and after signing off on a purchase. Based on the results, a complementary survey was developed to scale this research across Dutch hospitals. This survey serves as a stepping stonet for future research efforts.

More effective and efficient risk communication in the cybersecurity field needs to be designed to improve risk awareness among people and to increase resiliency. The field of cyber risk communication is relatively new, which limits the current knowledge on how to design risk communication. In this study the risk perception of eleven laypeople and eight experts is researched using a mental model approach and semi-structured interviews combined with a three part scenario-based drawing task. The data is analyzed using the grounded theory method and a substantive theory is formed on the similarities and differences between the mental models of experts and laypeople of VPN in a professional services firm in the Netherlands. The accuracy of the perceptions in the theory are evaluated by a comparison with a real-world representation of VPN organization. Further research can use the results of this study to determine the completeness of the mental models described. Additionally, the study design can be repeated in other settings to determine the generalizability of the identified beliefs. Furthermore, the prevalence of the identified beliefs among similar or different populations can be researched. And finally, the mental models can already be used to design risk communication in a more effective and efficient manner by considering the identified beliefs.

In the coming decades, more frequent and more extensive climate disasters such as coastal and river floods, droughts, extreme weather, and wildfires can be expected worldwide. Innovations will be required to face this grand challenge. The BRIGAID project developed a methodology consisting of a Test- and Implementation Framework and a set of practical tools. BRIGAIDs tools are offered to support efficient development and market introduction of promising innovations. The methodology in its present state still requires an extension to cover cybersecurity issues. It should be assessed what components are key in innovation projects and where and whether cybersecurity is relevant within the TIF. The proposed research will establish an assessment for the cybersecurity readiness of BRIGAID’s innovation projects. The goal here is to give the innovation projects an indication on their level of security and cybersecurity readiness. We selected GM4W and QoAir as representative innovation projects for a case study consisting of a cyber risk assessment. We find that key cyber components for innovation projects benefit the identification and mitigation of cyber threats. When assessing an innovation, the cyber components serve as a starting point of the assessment. We used SecRAM as the risk assessment method in this study and aimed to test whether the method applies to the risk assessment of innovation projects. We conclude that the SecRAM method serves its purpose and applies to the innovation projects in the context of this study. The risk assessments applied to different cases with contrasting structures and enabled us to identify and mitigate cyber threats effectively. The use of SecRAM also applied to the design of the TIF cybersecurity extension. The tool consists of questions that score the innovation projects based on confidentiality, integrity, and availability to raise concerns on the cybersecurity readiness. The acceptance and perceived usefulness of the tool need validation among innovators. Future research should extend the involvement of innovators and experts to the entire risk assessment phase.

Cyber security is getting more attention in the last decades. Unfortunately, the 100% cyber security protection is impractical and impossible, and therefore, we need to consider other cyber risk management strategies. One of them is cyber insurance, but its adoption has been slow in Europe and even more among SMEs. This thesis presents a qualitative study based on empirical data collection about the SMEs’ decision-making process to adopt cyber insurance. PMT is used as an underlying theory to build the interview questionnaire. The results show the different elements that make a company select this product or reject it. To the best of knowledge of the researcher, this is the first decision-making model for cyber insurance adoption focused on SMEs that has been done.
The model is unique in the way that it probes real behavior by SMEs when they are considering adopting cyber insurance and allows a dynamic use of it by showing the main stages as companies do not have the will to focus in the whole process but prefer to give a more significant weight to specific elements. Finally, the questionnaire used in this research could be used to gather additional data, which means, performing more interviews.