Towards adequate cybersecurity risk management in SMEs

Abstract

Small and medium-sized enterprises (SMEs) are core to the growth of the African economy. Their continued dependency on technology is driving them deeper into risks. SMEs that are developing technology-based solutions need an effective way to manage cyber risks. This study sought to determine the key cybersecurity risks faced by SMEs in Kenya that develop technology-based solutions. Using a case study approach and based on the National Institute of Standards and Technology (NIST) cybersecurity framework, an in-depth evaluation of the cybersecurity risk management practices within a selected SME was undertaken. The paper reports on the components identified as critical in the management of cyber risks within SMEs. An implementation strategy has been developed to provide a roadmap to assist in the management of cyber risks as part of their business risks. Insights provided will assist the government and regulatory bodies assess the adequacy of current cybersecurity legislations and guidelines. This study has practical implications for SME managers in fostering a cybersecurity culture in this growing sector.