Background: This study evaluates how Swedish government authorities, regions, andmunicipalities respond to cyber-attacks and how they work to prevent further exploitation by maliciousactors.

Objectives: The scope of this study is to investigate how government organizations act during acyber-attack and how their work mitigates future cyber-attacks. Are the prevention methods based onthe Swedish Civil Contingencies Agency’s recommendations or current practices? Have these recommendations been overlooked? Will there be an improvement after a cyber-attack?

Methods: A mixed-method approach was employed, combining interviews and surveys to collectempirical research data. An invitation was sent to government organizations requesting their participatein this study. The scope of this paper will focus exclusively on cybercrimes in regard to the breach of IT-systems, excluding factors such as human error and system failures. Given the rapid evolution of cybersecurity and cyber-attacks, this research paper will mainly focus on recent research publishedbefore 2022 on countermeasures and preventions. These papers must be peer-reviewed to ensure thequality and up to date preventions on cyber-attacks.

Results: Out of 22 participants, 50% based their countermeasures on the Swedish Civil Contingencies Agency recommendations, 14% based on recent research, 9% were relying on third-partyservices, and 27% decided to not apply any countermeasures. The ransomware is the most commoncyber-attack, followed by DDoS, spear phishing and phishing, and privilege escalation. The results alsonoticed a trend that all types of phishing are the primary attack vector and are involved in over half ofcyber-attacks. This highlights a need for future education in cyber-hygiene and security awareness thatwill improve state prevention methods, considering human error is the main entry for ransomware,privilege escalation, and phishing.

Conclusions: 64% of the 22 participants are constantly improving their countermeasures against cyber-attacks and base their responses on either recent research or the contingencies Swedish Civilcontingency Agency. Only 27% didn’t take any action after cyber-attacks which overlooks thepossibility on improving their overall security.

Keywords: Countermeasure, Prevention, Cybersecurity, the Swedish Civil Contingencies Agency.