Cyber Risk Awareness in Small and Medium Enterprises

Abstract

Cyber security is an emerging topic, as headlines on data breaches in major global firms are increasing alarmingly. However, not only large corperations are vulnerable to cybercrime; attacks on Small and Medium Enterprises (SMEs) are now considered a common occurence worldwide. Reasons for the high susceptibility of SMEs range from a general lack of resources to a low awareness of possible threats. Raising cyber risk awareness on all levels in an organisation is considered the best security return on invested capital. Different intervention approaches to increase cyber risk awareness among employees were studied and various methods to measure the respective effectiveness can be found in literature. This study investigated cyber risk awareness in SMEs in Switzerland. A design science research approach was followed to develop a framework to guide SMEs through the process of raising cyber risk awareness among employees. The framework was developed based on five principles adapted from ISACA’s “Six Principles for a Governance System”.The Cyber Risk Awareness framework, introduced in this research, is inspired by the Deming cycle and aims at continous improvement. A single case study, an interview with a cyber security expert plus an interview with a governance body formed the three-stage evaluation process, which supports the validity and practical usability of the framework.