Cascading information on best practice: Cyber security risk management in UK micro and small businesses and the role of IT companies

Abstract

Micro and small businesses are increasingly reliant on digital and online technology. They have, though, very limited resources and expertise to devote to cyber security. There is, thus, a pressing economic and social challenge of how to improve cyber security in small businesses. We look at the potential role of IT companies as a conduit through which to cascade information on best practice, focusing on the United Kingdom. We first present an analysis of the UK’s Cyber Security Breaches Survey (2018–2021) distinguishing different channels through which micro and small businesses access information on cyber security. We find that the main channel, by far, is through IT companies. Very few businesses directly access information from the government or law enforcement. To further explore the role of IT companies we conducted a series of focus groups and interviews with experts in IT and cyber security for small businesses in the UK. One theme to emerge is that IT companies, while they can be part of the solution, can also be part of the problem and so a number of interventions are needed if IT companies are to effectively disseminate best practice. These include advice and guidance for micro and small businesses on how to distinguish ‘good’ IT companies, as well as appropriate support for IT companies, who themselves are typically micro and small businesses that lack expertise on cyber security.