Like most companies, small and medium-sized enterprises (SMEs) have become reliant on digital technology for their day-to-day business operations. However, while valuable, this comes with challenges; one of which is the increase in cybercrime. In terms of their cybersecurity resilience and risk, SMEs are among the most vulnerable and least mature. This paper addresses a gap in the literature that has neglected cybersecurity readiness in SMEs. The study proposes a CyberSecurity Readiness Model (CSRM) based on a Socio-Technical view of organizations. The model was used in a multiple case study on three Italian SMEs and has the potential to be used to evaluate SMEs cybersecurity readiness and further understand the environment and strategies that could be adopted to prevent cyber-attacks.
Advances in interconnectivity, devices, and digital technologies have benefitted organizations in
numerous ways, including reduced operating costs, increased speed of communication, efficiency, and
system accessibility. Nevertheless, organizations undergoing digital transformation, accelerated by the
Covid-19 pandemic, continue to face the risk of cyber-attacks and threats [
It used to be a common thought that large companies are more vulnerable to cyber-attacks than small
and medium sized enterprises (SMEs) [
Italy is shaped by a large number of SMEs. Recently, it has been one of Europe’s top targets for cyber-attacks. The number of cases, and the severity of these incidents, have increased in the past few years. For example, according to the Digital Attacks Observatory (OAD) 2020, the number of attacks reported by SMEs went up from 0% in 2019 to 22.2% at the beginning of 2020. It is argued that if cybersecurity readiness is absent or low, it will be challenging for businesses to acquire the necessary resources to achieve an appropriate level of cybersecurity to protect its digital assets.
Unlike large-size organizations, SMEs typically suffer owing to a lack of knowledge, skills, and
resources [
Despite the significance of cybersecurity readiness, and given the fact that SMEs play a significant
role in the Italian economy (e.g. viewed as vehicles for job development and employment), current
research focusing on SMEs is scarce [
Cybersecurity has always been an important issue. Being a complex reality that evolves in symbiosis
with digitization, every year consultancy firms, researchers and analysts take action to propose advice
and models useful for managing the world of computer security [
The current literature already appears to trace the profile of SMEs affected by cyber-attacks.
Following a survey involving 310 companies from different sectors, it was possible to note that the
companies that received a larger volume of attacks are those of services and manufacturing [
The biggest consultancy firms worldwide (Deloitte, PwC, EY and McKinsey), have developed models to help organizations assess their exposure to the risk of cyberattacks. Such models consist of structured sets of questions that deal with the issues that are perceived as more relevant and pertinent. Our analysis shows that - although the structures of these models are slightly different - the main concepts and issues explored remain the same: they all focus on the following fundamental questions: • "Have you developed an IT System Layer or an application map that allows you to view all the applications involved?"; • "Does your organization periodically conduct penetration tests?"; • "How does the organization act in the face of phishing attacks?". 2.2 Cybersecurity readiness models for SMEs in the academic literature
Reviewing the scholarly literature reveals three main readiness models for SMEs: Cyber Security
Canvas [
Firstly, the Cyber Security Canvas [
Secondly, SMECRA [
Finally, Listemann’s model [
According to Bostrom & Heinen [
Confronted with this framework, all the models reviewed in sections 2.1 and 2.2 show a prevalent focus on the technical component, despite their claims of placing human resources at the center of the attention.
In particular, the models proposed by the consultancy firms simply do not address the social subsystem component, because they do not include the assessment of the implications on cybersecurity of the characteristics of the people and the structure of the organization.
Regarding the models available in the scholarly literature, they have limitations that can be explained
through the socio-technical model too. For example, the limitations of the Cybersecurity Canvas
become evident since it has been created starting from the most well-known computer security
standards, such as NIST, ISO 27001, etc. These are indeed very strict standards, which therefore limit
the dynamism of the model [
The SMECRA model is a model purely oriented to the estimation of an economic nature, thus already proposing a final result, namely the investment, without considering the growth and awareness component of the company. This allows us to observe how the model is linked to the "social" part of the model, in particular the ‘Structure’. However, it is clear that the model does not guarantee interdependence with the variable linked to people. Furthermore, the model still presents a notable component of technicality, making the technical part of the socio-technical model prevail.
The presence of technical models, in particular, could prove to be a problem especially if models proposed by the leading consultancy firms and the scholarly literature are to be made available to SMEs. Indeed, faced with too technical questions, SMEs could answer in a negative way, the negativity of which, however, could be synonymous with a notional gap and not with the actual absence of the element reported in the question. This makes it clear that the proposed models may therefore not be suitable for all SMEs.
Despite this, there are still difficulties in finding a convergence between the different sources. In particular, this paper takes into consideration two categories of resources: non-academic and academic. Reviewing these have revealed that the former are less affordable in terms of conclusions but more reliable in terms of the instant in time considered, they are more up-to-date; the latter, on the other hand, are more affordable in terms of the thesis they offer, but less reliable in terms of updating information.
This conclusion allows us to affirm again that it is important to be able to find the right trade-off between the social part and the technical part that are characteristic of the socio-technical model. In particular, faced with the presence of these gaps observed in the discussion above could potentially cause damage to SMEs. Indeed, if SMEs used the models described above, they will certainly be able to bridge the gaps from a technical point of view, but the whole part linked to the organization and people would remain fragile. However, according to the socio-technical model, all the characteristic variables of the model are interdependent and precisely because of this interdependence they influence each other. Therefore the fragility of the variables linked to the social part weakens the strength of the technical part.
Based on the discussion presented above, this study addresses the following research question: what are the variables that help estimating cybersecurity readiness in a small-medium size organization?
In the attempt to answer this research question, this study aims on the one hand, at overcoming the limitations of the previous technology-centric models available in the literature, and - on the other – at taking into account the cybersecurity issues arisen in recent times, during the pandemic. In fact, SMEs have experienced a significant evolution towards digitization following the advent of Covid-19, and this acceleration, paired with the limited resources and competences of SMEs, has increased the risk of effective cyberattacks.
In order to come up to an answer to the research question, we identified a set of relevant (in the
above-mentioned context) variables that we applied as part of a data collection protocol in a multiple
case study. The overall set of these variables, represent in fact a possible model for assessing the
readiness of SME to face cybersecurity. In this section we explain the logic we followed in designing
this methodological approach.
A qualitative research approach was deemed most appropriate as researchers are able to “understand
those being studied from their perspective” [21, p.23], and hence understand the phenomenon from the
perspective of the SME. Indeed, they are “designed to help researchers understand people and the social
and cultural contexts within which they live” [
This study uses semi-structured interviews with companies belonging to the manufacturing sector,
in which questions are prepared ahead of time but not strictly followed during the interview [
As to the methodology for the empirical investigation, this study makes use of the multiple case study approach, following the principle that “the case study method explores a real-life, contemporary bounded system (a case) or multiple bounded systems (cases) over time, through detailed, in-depth data collection involving multiple sources of information… and reports a case description and case themes” [26, p.97]. The purpose of adopting a case study approach is the ability to explore a specific phenomenon in a bounded system, i.e. multiple bounded systems over time, “within its real-life context” [27, p.13] and seek an in-depth understanding.
According to Stake [
The data collection protocol was designed on the basis of the existing cybersecurity readiness models and on the attempt to overcome their limitations, as discussed in section 2. The variables that constitute such models have been partially included in the data collection protocol, and a few other variables have been added, as suggested by the literature review. The resulting set of variables represents a model to assess the ability of an SME to prevent cyber-attacks: the Cyber Security Readiness Model for SMEs (CSRM).
CSRM consists of eight variables (shown in Table 1) that can be assessed through a set of questions (detailed in Table 2).
different economic and resource availability
face of cyber security issues, and therefore the more suitable the leader in this sense, the greater the company's awareness of the importance of computer protection
company, and therefore depending on the presence of specialized human resources or not, it will be able or not to exploit the IT resources currently supplied and organize the company accordingly
computer systems, rather than intangible ones
systems, it is possible to define the reference objectives
Teufel, et al., 2020 Tam, 2020 Tam, 2020
The questions were derived partly from the academic models and partly from the models proposed by consultancy firms.
The choice of the variables to be included in the model (i.e., in the empirical investigation) followed the principle of the socio-technical perspective: to take into account both the social and the technical components of the organization that can have an impact on cybersecurity systems and practices. Moreover, the formulation of the questions have been adapted to the context of an SME, with the assumption that SMEs managers may not have a deep knowledge in the field of cybersecurity, and in digital technology in general.
Table 2 shows the detailed list of the questions corresponding to each of the variables. The identification of the questions took place according to the following process. Firstly, we searched in the consultancy models the questions that were compliant with the variables we had identified (listed in Table 1), and we rephrased them in order to increase their clarity in the context of application of an SME, e.g. removing technical and (or consultancy) jargon.
In Table 2 these questions can be identified by the name of the consulting firm whose cybersecurity
readiness model they belong to. All the other questions, on the contrary, were found in the academic
literature. In the following paragraphs we mention the source of each question, and we explain the
reason why it has been included in the model.
• “Have cyber risks and responses been separately incorporated into your crisis management
program?”: Consistent with some scholars [e.g. 29], it is important to question SMEs regarding
their ability to prevent cyber-attacks in line with their crisis management plan/ practices.
• “It is proven through the verification of the successful training on cybersecurity issues every year /
at each new entry (direct verification in company documents)”: This question is very important
because, in the face of the COVID-19 pandemic, the gaps related to training for those people who
deal with cybersecurity have emerged even more. Indeed, due to the dearth of existing studies,
many companies find it difficult to manage cyber-attacks and to train employees on how to prevent
them. So, usually, there is a negative relationship between security trainings and the occurrence of
cybersecurity incidents [
Low 1 (Absent)
1 (Absent)
1 (Absent)
1 (Absent)
1 (Absent)
Bad (creates discomfort)
Scarce
1 (No training) Intangible
Low Low
No (0 outsourcer)
On site
No Has your organization conducted a recent third-party cyber risk assessment and/or joint venture? [EY]
1 (Never conducted) Current availability of protection systems Have you ever suffered attacks? Does your cybersecurity feature support cloud migration initiatives? [PwC] Is cybersecurity and privacy a feature of your products and services? [PwC] Has your organization conducted a recent enterprise-wide cyber risk assessment? [EY] Legal Environment AND Compliance Does your organization handle requests for data subject rights from the customer for data disclosure or deletion? [PwC]
Low 1 (=0) 1 (Nope)
1 (Nope)
1 (Nope)
1 (Nope)
Not in accordance with
Middle 2 (Present but with gaps)
2 (Present but not suitable)
2 (Present but not very effective)
2 (incorporated but unsuitable)
2 (Present but lacking)
Mediocre Mediocre
2 (One-time or incomplete training)
2 (Yes, but not updated every year)
Media
2 (>=2 per year)
2 (Depends)
2 (Only some products/services)
2 (Yes, but not updated/Scheduled)
2 (Sometimes)
Middle Media
Yes
Yes
Entrusted to third parties Compliant but with gaps
To standard
The perimeter of the project includes three different SMEs operating in the manufacturing sector. More precisely, these are three companies characterized by three different dimensions, three different approaches to security and consequently three different types of awareness related to the latter. Especially:
The first company (Company A) deals purely with designing and producing technical articles in rubber and silicone; The second company (Company B), on the other hand, is used in the design and construction of a complete range of machinery for the paper industry, bookbinding and box factories; The last company (Company C) deals with the processing of marble.
Following the interviews conducted using the CSRM model, it was possible to obtain a series of interesting data. The interviews aimed at the three companies in question saw the involvement of
High 3(Present)
3 (Present)
3 (Present and effective)
3 (Present)
3 (Present)
Good Good
3 (Formation present) Tangible
High Loud
3 (Yes and updated every year) Loud 3 (<2) 3 (Yes)
3 (Yes)
3 (Yes)
3 (Always) subjects belonging to different business functions, thus also allowing to detect the gap between the staff directly in contact in the IT field and those who are far from it (but may indirectly be affected).
Referring to the variables identified for the development of the model, the three companies interviewed were analyzed starting from the identification of the number of employees. From this, it was revealed that the three companies were of different sizes: the first company was very small, the second small-medium-sized and the third medium-sized. Secondly, it was necessary to understand whether companies had a business oriented more towards tangible or intangible products, and whether these were enriched by the presence of services or not.
In total, 4 interviews were conducted: for the first company the general manager presented himself, for the second company the managing director and the IT administrator of the IT service provider, the third company was the production manager. Based on the responses obtained, it was possible to understand the degree of responsibility of the three companies: company A appeared superficial to the phenomenon of cyber-attacks as it believed it was too small to be of interest to malicious people, company B on the contrary while presenting gaps proved to be sure of its IT security as it was entrusted to third parties, while company C proved to be better prepared in terms of IT security. These three different profiles were born in the face of a different due diligence, ownership, effective management of IT risk, training of employees in terms of IT security and the presence or absence of an internal leader.
Following the interviews conducted, it was possible to observe whether the stereotypes of SMEs defined by the research are also found. As shown in the previous section, the three companies outlined three different stereotypes (or profiles) of SMEs. The generation of the latter constitutes reference models for all those SMEs that want to understand their status in terms of cybersecurity, thus wanting to act to prevent cyber-attacks. Identifying with certain stereotypes will therefore make it easier to understand which strategy to implement.
Company A is characterized by a total unawareness of cyber-risk. In addition to not presenting IT security tools, the company identifies itself as ‘too small’ to be a target of cybercrime. The company constitutes the stereotype of what we propose to name a dangerously unconscious organization.
Company B, on the other hand, is confident in its potential in terms of computer security as it relies entirely on a third-party organization to fulfil this aspect. The model illustrates that the company does not actually possess any solidity and internal awareness. In addition, the company's trust in the third party is such that it does not lead the client company to carry out checks on the IT security of the supplier itself. The stereotype generated by this company can be called cybersecurity–dependent on third parties.
Finally, Company C, despite its medium size and its manufacturing nature, proved to be prepared for cyber-attacks. Indeed, the company has proven to be in line with the criteria defined by the CSRM model. However, it cannot be considered exempt from cybersecurity risks, having achieved only a medium level in the “availability of protection systems”. The profile generated for this type of company can be termed as realist.
The interviews revealed that the stereotype of SME emerging by the available literature is too simplistic to provide a correct picture of the cybersecurity related issues that SMEs face. The cases investigated in our study suggest that it is essential - in the first place - to differentiate small businesses from medium-sized enterprises, as well as to consider a set of variables whose values lead to delineate at least the three different profiles described above. Figure 2 portraits a graphical representation of both the three identified stereotypes and the profile of SME emerging by the literature.
The graphical representations of the Literature’s stereotype shows that the academic literature considers as “standard” those company that have a profile with intermediate characteristics with respect to the profiles of the companies interviewed during our study.
The analysis of the graphs makes it possible to deduce other considerations. In particular, it is possible to note how the profile of the company ‘dangerously unconscious', that of the company 'Cybersecurity – dependent on third parties' and that of the company 'realist', appear as an initial type that can evolve into another. This suggests that if a company initially identified itself as 'dangerously unconscious', taking as a reference the 'Realist' business reality it could improve to become the latter. It is therefore possible to say that the error of the search lies not so much in the identification of the variables, but more in their use.
It is important to underline that, considering the variables of the CSRM model: 'Tangible or intangible product', 'Third-party dependence' and 'Degree of servitization', these cannot be varied over time in the case of cybersecurity as characteristics of the business of each company. Indeed, a manufacturing company will hardly be able to evolve towards a business model focused on the development of intangible products. In other words, improving a company's cybersecurity does not imply the evolution of the business model from a tangible product to an intangible product. The same reasoning applies to 'Dependence on third parties': the fact that a company transfers the management of its data to a third party, this does not necessarily imply an improvement in the IT security of the company itself. Even for the 'Degree of servitization', if the company has a low degree of servitization, for example, not necessarily increasing the latter the expected result is the improvement of computer security. All three variables, therefore, as they tend to be stable and intrinsic in the company profile, can be considered the useful pivot for identifying the correct business strategy. By way of example, it is possible to consider the case in which a company presents an intangible product, accompanied by a high degree of servitization and an absence of dependence on third parties. In this case, the advice that could be given to the aforementioned company would be to invest more in the degree of responsibility, in technical skills, in the availability of protection services and in legal aspects. This advice stems from the fact that the management of IT systems, essential elements for the delivery of business output, will be completely internal. It will therefore be essential that staff possess the necessary? skills, a high degree of responsibility, a high availability of protection systems and the legal part in accordance with the law. The recommendations will therefore vary depending on these variables that are more related to the business world.
Cybersecurity is a threat to a business’ reputation, operations, and finance. COVID-19 has accelerated the adoption of digital technology, providing hackers greater opportunity to launch cyberattacks. This paper addresses a gap in the literature that has neglected cybersecurity readiness in SMEs. The research findings have both practical and theoretical implications. Based on the shortcomings of the scholarly literature and the main consultancy firms analyzed, we propose a model (CSRM) that can be used to evaluate the readiness of SMEs in the context of cybersecurity. This can be used by companies wanting to further understand their contextual environment along with strategies they could adopt to potentially prevent cyber-attacks. Theoretically, we add support to SMEs for the presence of standard company profiles that allow interested companies to raise their awareness regarding the strategies that could be adopted to become more robust in terms of preventing cyber-attacks. In particular, by taking into consideration the socio-technical model, this robustness is due to the guaranteed balance between the social and technical parts.
The present paper focuses on analyzing three companies belonging to the manufacturing sector via the CSRM developed in this study. The preliminary findings are based on four interviews, which will be extended upon to further explore and validate the emerging themes through additional semistructured interviews with key participants.
It is important to note that the three cases in question do not in any way summarize all the possible business realities. In addition, the focus on the manufacturing world leads to underline that, if other sectors were taken into account (for example agriculture, metalworking, etc.), the conclusions that would be drawn could be different. It is important to highlight that the present project takes a snapshot in a precise moment in time. Thus, if a longitudinal analysis was conducted (e.g. pre- and post), it would be possible to observe changes overtime. 7. References