Background: Bringing a deeper understanding of the research gap defined by the practical implication in the literature streams on standard and internal control particularly on the process of ISO/IEC 27001 implementation.

Aim: Investigating how the preventive innovation is being applied and controlled by IT and data organizations in Sweden in practice.

Methodology: A secondary desk study has been conducted which has been followed by a qualitative study with two top managers from companies in the IT security and Data management sector operating in Sweden. Qualitative study serves the purpose of identifying two different approaches in implementation of ISO/IEC 27001 standard from internal control perspective.

Findings: Standards, particularly ISO/IEC 27001 is not being applied in the same way in every organization. While for some companies namely private one it is important to be business-oriented, for governmental agencies it is administrative. Moreover, while discovering the role of human factor in Earhart AB where sustaining IT security and implementing ISO/IEC 27001 is coming from knowledge and awareness of employees it has also been identified that in GovSec Sweden AB it is more following rules and strengthening technical control in compared to Earhart AB.