Cyber Resilience Self-Assessment Tool (CR-SAT) for SMEs

Abstract

On the current environment, companies face risks and threats to the systems they need to operate often known as cyber threats. Most of these companies are small and medium-sized enterprises (SMEs) and they are exposed to these cyber threats. To mitigate the risks and be able to thrive with as little disruption as possible, SMEs require cyber resilience capabilities. However, due to their limited resources, SMEs usually have no dedicated personnel for cyber resilience operationalization and thus lack the experience this discipline requires to implement. To aid SMEs in their cyber resilience operationalization, the current literature offers several kinds of solutions, but these solutions are usually targeted for companies with more resources than SMEs and do not aid in the complete process of assessing their current cyber resilience, deciding actions to improve it and prioritizing these actions. To aid companies in this systematic process to operationalize or implement cyber resilience, this article develops and tests an operational webbased tool in which companies can follow the complete process described before. To achieve this, a cyber resilience framework with the essential policies for SMEs, descriptions of their natural progressions in a progression model and a prioritization of these policies have been developed. In this article, this framework, progression model and prioritization are later transformed into one cyber resilience self-assessment tool (CR-SAT) and are tested in three case studies to qualitatively evaluate the tool by trying to ascertain its usefulness and completeness as well as improving it with the feedback from the end-users.

Cyber Security Maturity Assessment Framework for Technology Startups: A Systematic Literature Review

“…Fundamentally, control domains are necessary as key controls for risk assessment. Table 4 presents the extracted shared control domains among the CSMA frameworks reported in seven research articles [20,25,28,32,33,35,39]. Based on the obtained results, common control domains that can be streamlined and evaluated in the risk assessment stage were found evident.…”

“…Considering that SMEs and start-ups are similar in terms of size [5], seven other research articles that focused on CSMA frameworks for SMEs were also identified: 1) Cybersecurity Risk Management in Small and Medium-Sized Enterprises: A Systematic Review of Recent Evidence [9] 2) The framework of Effective Risk Management in Small and Medium Enterprises (SMEs): A Literature Review [19] 3) A Dynamic Simulation Approach to Support the Evaluation of Cyber Risks and Security Investments in SMEs [22] 4) A Novel Cybersecurity Framework for Countermeasure of SMEs in Saudi Arabia [26] 5) Calculated Risk? A Cybersecurity Evaluation Tool for SMEs [30] 6) Cyber Resilience Self-Assessment Tool (CR-SAT) for SMEs [32] 7) Reference Framework "HOGO" for Cybersecurity in SMEs based on ISO27002 and 27032 [39] Overall, this study identified 37 CSMA frameworks from 24 research articles. Adding to that, only seven frameworks were reported to be specifically targeted for SMEs, whereas only one framework for start-ups was identified.…”

“…National Initiative for Cybersecurity Education Capability Maturity Model (NICE) [28], [31], [32], [34],…”

A cyber resilience analysis case study of an industrial operational technology environment

“…This supports early ndings (Haque, et al, 2018) which states that "although many of the frameworks provide some subjective guidance of resilience study, they all lack clear explanation on the quantitative resilience metrics formulation". Recent research attempts to resolve such challenges (Carías, et al, 2021) produced a Cyber Resilience Assessment tool to aid Small and Medium Enterprises (SMEs) in their CR operationalisation. Three case studies formed the basis for this study with reported success.…”

Risk-Management Framework and Information-Security Systems for Small and Medium Enterprises (SMEs): A Meta-Analysis Approach

“…Hence, there is an urgent need for adaptable, cost-effective risk-management solutions that navigate the evolving technological landscape [13][14][15]. Despite several recent studies on IT risk management, the literature reveals a significant gap, with most studies focusing on specific contexts such as cloud computing, SMEs, or ISO/IEC 27001 and failing to provide a broad overview of the efficacy of existing IT risk-management frameworks [1][2][3]6,[16][17][18][19]. This lack of systematic analysis creates a compelling research problem, to which this paper responds.…”