Title: Towards adequate cybersecurity risk management in SMEs
Authors: Christopher A. Moturi; Nabihah R. Abdulrahim; Daniel O. Orwa
Addresses: School of Computing and Informatics, University of Nairobi, Nairobi, Kenya ' School of Computing and Informatics, University of Nairobi, Nairobi, Kenya ' School of Computing and Informatics, University of Nairobi, Nairobi, Kenya
Abstract: Small and medium-sized enterprises (SMEs) are core to the growth of the African economy. Their continued dependency on technology is driving them deeper into risks. SMEs that are developing technology-based solutions need an effective way to manage cyber risks. This study sought to determine the key cybersecurity risks faced by SMEs in Kenya that develop technology-based solutions. Using a case study approach and based on the National Institute of Standards and Technology (NIST) cybersecurity framework, an in-depth evaluation of the cybersecurity risk management practices within a selected SME was undertaken. The paper reports on the components identified as critical in the management of cyber risks within SMEs. An implementation strategy has been developed to provide a roadmap to assist in the management of cyber risks as part of their business risks. Insights provided will assist the government and regulatory bodies assess the adequacy of current cybersecurity legislations and guidelines. This study has practical implications for SME managers in fostering a cybersecurity culture in this growing sector.
Keywords: cybercrime; cyber risk; cybersecurity; National Institute of Standards and Technology; NIST; risk management; small and medium-sized enterprise; SME.
International Journal of Business Continuity and Risk Management, 2021 Vol.11 No.4, pp.343 - 366
Received: 25 Nov 2019
Accepted: 01 May 2020
Published online: 04 Jan 2022 *