Cybersecurity Awareness for Small and Medium-Sized Enterprises (SMEs): Availability and Scope of Free and Inexpensive Awareness Resources

Abstract

Small and medium-sized enterprises (SMEs) are considered the backbone of Europe’s economy. However, SMEs are often bounded by resource constraints that also limit their cybersecurity posture. In such circumstances, SMEs could potentially benefit from the free and inexpensive cybersecurity awareness (CSA) resources produced and distributed by various public and private entities. SMEs can utilize these affordable resources to elevate the knowledge and skills of employees and transform their cybersecurity attitudes and behavior. The security-conscious employees can serve as the organization’s first line of defense against cyber-attacks and -crimes. However, prior to employing such awareness resources, it would require answering the question “how abundance and well-suited are the (affordable) awareness resources for SMEs?” To address this concern, we used an exploratory approach and examined the awareness resources from 71 sources chosen after the review of 938 potential sources. Since the primary audience of the study was European SMEs, most of the sources analyzed come from European organizations. Based on our findings, while these affordable awareness resources could benefit SMEs, they do require some adjustment to better meet the requirements and situations of SMEs. Furthermore, the awareness resources exclusively targeting SMEs and the diverse business areas SMEs serve, are insufficient. As a result, all involved entities, at the national and European levels, are encouraged to produce and distribute more localized awareness resources that are affordable and best match the demands and business areas of SMEs. Finally, the awareness resources should also include appropriate features for interested users to submit their feedback.

Appendix

S.N.	Sources
	European Agencies and Organizations (refer to [19] to get the list of European agencies and organizations)
1	European Union Agency for Cybersecurity (ENISA)
2	European Union Agency for Law Enforcement Cooperation (EUROPOL)
3	European Maritime Safety Agency (EMSA)
4	European Cybersecurity Organization (ECSO)
5	European Digital SME Alliance
	EU-Funded and National Projects (refer to [20] to get the list of EU-funded and national projects)
6	Cyberwatching.eu
7	Cyberwiser.eu
8	SMESEC Project
9	GEIGER Project
10	Cyber-MAR Project
11	SecureHospitals Project
12	DOGANA Project
13	FORTIKA Project
14	CyberSec4Europe Project
15	PUZZLE Project
	National Organizations (refer to [21] to get the list of national organizations working in cybersecurity)
16	Cyber Security Austria
17	Cyber Security Coalition - Belgium
18	Centre for Cyber security Belgium
19	Safeonweb - Belgium
20	Computer Emergency Response Team Bulgaria
21	CARNet’s National Computer Emergency Response Team - Croatia
22	Cyprus Cybercrime Centre of Excellence
23	National Cyber and Information Security Agency - Czech Republic
24	The National Computer Security Incident Response Team of the Czech Republic
25	Danish Centre for Cyber Security
26	Republic of Estonia Information System Authority
27	Finnish Transport and Communication Agency National Cyber Security Centre
28	The National Cybersecurity Agency of France
29	Federal Office for Information Security - Germany
30	Hellenic Computer Security Incident Response Team
31	Gov Computer Emergency Response Team Hungary
32	Computer Emergency Response Team-Iceland
33	Irish Reporting and Information Security Service
34	Computer Security Incident Response Team-Italia
35	Information Technology Security Incident Response Institution, Republic of Latvia
36	National Cyber Security Centre of Lithuania
37	Computer Emergency Response Team, Luxembourg
38	Cyber Security Malta
39	National Cyber Security Centrum - Netherlands
40	Norwegian National Security Authority
41	The Norwegian Centre for Information Security
42	Computer Emergency Response Team Polska
43	Centro Nacional de Cibersegurança - Portugal
44	Cyber Security Research Centre - Romania
45	Centrul Național de Răspuns la Incidente de Securitate Cibernetică - Romania
46	Computer Security Incident Response Team Slovakia
47	Slovenian Computer Emergency Response Team
48	The Spanish National Cybersecurity Institute - Computer Emergency Response Team
49	Centro Criptológico Nacional Computer Emergency Response Team - Spain
50	Computer Emergency Response Team Sweden
51	SWITCH’s Computer Emergency Response Team
52	The National Cyber Security Centre - UK
	European Trade Associations and Federations (refer to [22] and [23] to get the list of European trade associations and federations)
53	Federation of Small Businesses - UK
54	The Software Alliance
55	The Association of the Swedish Engineering Industries
56	Investment Company Institute Global
57	Europe’s Distribution System Operators
58	The Luxembourg Banker’s Association
59	Association of Mutual Insurers and Insurance Cooperatives in Europe
60	GSMA Europe
61	Confederation of British Industry
62	Insurance Europe
63	European Banking Federation
	Private Organizations
64	SANS Institute
65	InfoSec Institute
66	Cyber Safe Work
67	STOP.THINK. CONNECT
68	Proofpoint
69	CybeReady
70	KnowBe4
71	Global Knowledge