Sweden, Swedish society and Swedish administration are undergoing a digital transformation. It started some thirty years ago and is still accelerating. The development towards a digital society brings both innovations and opportunities as well as vulnerabilities and risks. In order to respond to these vulnerabilities and risks, Swedish society needs good cyber security work, especially in the authorities. This report explores the distribution of responsibility for, and control of, Swedish public authorities' cyber security work in the digital society, how the distribution came to be, and what problems arise out of that distribution. The report takes its starting point in a review of research literature, investigations and other public law documents. The literature review is supplemented by interviews with five central players in Swedish cyber security. This study identifies three consistent themes, which influence the cyber security work of Swedish authorities. The first the unclear division of responsibilities and governance. The second theme is ambiguities in the definitions of the discourse and the third theme is a lack of feedback. The study identifies that there are problems with the current governance of cyber security work within the state administration, but also finds a careful optimism regarding future EU harmonisation in the area. The report's results reflect current social science research in its illumination of problems surrounding responsibility for, and governance of, cyber security in the state administration. The report concludes with a list of suggestions for future research. These proposals emanate out of the problems this report describes.