Title: Towards adequate cybersecurity risk management in SMEs

Authors: Christopher A. Moturi; Nabihah R. Abdulrahim; Daniel O. Orwa

Addresses: School of Computing and Informatics, University of Nairobi, Nairobi, Kenya ' School of Computing and Informatics, University of Nairobi, Nairobi, Kenya ' School of Computing and Informatics, University of Nairobi, Nairobi, Kenya

Abstract: Small and medium-sized enterprises (SMEs) are core to the growth of the African economy. Their continued dependency on technology is driving them deeper into risks. SMEs that are developing technology-based solutions need an effective way to manage cyber risks. This study sought to determine the key cybersecurity risks faced by SMEs in Kenya that develop technology-based solutions. Using a case study approach and based on the National Institute of Standards and Technology (NIST) cybersecurity framework, an in-depth evaluation of the cybersecurity risk management practices within a selected SME was undertaken. The paper reports on the components identified as critical in the management of cyber risks within SMEs. An implementation strategy has been developed to provide a roadmap to assist in the management of cyber risks as part of their business risks. Insights provided will assist the government and regulatory bodies assess the adequacy of current cybersecurity legislations and guidelines. This study has practical implications for SME managers in fostering a cybersecurity culture in this growing sector.

Keywords: cybercrime; cyber risk; cybersecurity; National Institute of Standards and Technology; NIST; risk management; small and medium-sized enterprise; SME.

DOI: 10.1504/IJBCRM.2021.119943

International Journal of Business Continuity and Risk Management, 2021 Vol.11 No.4, pp.343 - 366

Received: 25 Nov 2019
Accepted: 01 May 2020
Published online: 04 Jan 2022 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article