Defining a New Composite Cybersecurity Rating Scheme for SMEs in the U.K.

Abstract

The 5.7 million small to medium enterprises (SMEs) in the U.K. play a vital role in the national economy, contributing 51% of the private sector. However, the cyber threats for SMEs are increasing with four in ten of businesses experiencing a cyber attack in the last twelve months. One significant treatment of this growing concern is in the implementation of long-established information security standards and bestpractices. Yet, most SMEs are not undergoing the certication process, even though the current threats are now widely published by the government. In this paper, we look at the disconnect of cyber threats faced by SMEs considering their current security postures and perceptions. We also identify the influencing factors needed to improve security behaviours and engagements with information security best-practices. We then propose a new foundational composite cybersecurity rating scheme aimed at SMEs. The focus of our scheme is to ascertain and measure the security behaviours, perceptions and risk propensity of each SME, as well as their technical systems. To that end, we define our 5x5 matrices based scheme by combining the measurements ascertained from the behavioural as well as technical audits. The preliminary evaluation results demonstrate that this approach provides a higher level of insight, engagement and accuracy as to an SME's individual security posture.

Cyber risk assessment in small and medium‐sized enterprises: A multilevel decision‐making approach for small e‐tailors

“…Contrasting to the contribution of SMEs, a recent study also notes that four in ten SMEs have experienced cyberattacks in the 12 months (Rae & Patel, 2019) and only 14% of microenterprises are actively involved in Information and Communication Technology (ICT) risk assessments (Office for National Statistics, 2019). Given the contribution of SMEs and the lack of risk assessment techniques in their context, there is a need to address this.…”

Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal

“…The authors focus on cyber liability insurance, which provides the basis for a cost-effective solution to encourage good information assurance across the SMEs supply chain, by protecting their own data and the data that they share with the supply chain partners. A different case study in UK from Rae et al [37] addresses the increasing amount of cyberattacks and threats for SMEs and identifies the influencing factors that are needed to improve security behaviours and engagements with information security best practices. The authors propose a cybersecurity rating scheme for SMEs in the UK, with the potential to scale internationally.…”