Assessing Cyber Security Support for Small and Medium-Sized Enterprises

Small and Medium-Sized Enterprises (SMEs) share many of the same cyber security needs and challenges as larger organisations, but often have significantly less knowledge and capability to deal with them. One of the fundamental issues can be where to find information in the first instance, to explain the nature of cyber threats and the subsequent actions that SMEs should be taking. In many cases, the natural route for interested or concerned SMEs is to seek and refer to related guidance that can be found online. However, this in itself can be a challenge considering the volume and variety of sources that can be located as a consequence. This paper investigates and analyses the situation, based upon a sample of over 30 UK-based guidance sources, and an assessment of their coverage, completeness and clarity. The results reveal that there is indeed a significant diversity in the materials that SMEs may be presented with, and this in turn could lead to inconsistent and potentially ill-informed decision-making. Additionally, in many cases, there will be a limit to how far the online support will take them, with the potential that questions remain unresolved, and SMEs could be more confused as a result of their efforts.