Cybersecurity and resilient structures within SMEs

This research investigates SMEs’ decision–making processes for investing in cybersecurity and cyber resilience within the context of the UK governance and policy landscape. It examines the role of government policies in promoting cybersecurity uptake and best practices for UK SMEs. By exploring the structural, cultural, industry, and institutional drawbacks that contribute to poor cybersecurity uptake among SMEs, this research triangulates systemic issues, practical considerations, and the economic conditions in which SMEs operate to determine their approach to cybersecurity and resilience. This is a policy research grounded in a mixed-method methodology and utilises tools and techniques associated with mixed-method research. Data gathering methods applied in this research include interviews, survey questionnaire, focus groups, and observational methods to highlight challenges and opportunities to improve cybersecurity for UK SMEs. The findings emphasise the need to create the SeM model: a decision–making framework that gives SMEs autonomy on pathways to cybersecurity investment. The research also highlights the need to create adequate policies that provide practical industry benefits to SMEs and establish regulatory regimes that strengthen the UK’s overall SMEs’ cybersecurity. Additional ethical approval was obtained to conduct an impact assessment to test and validate the outputs of this research. This research makes three key contributions: 1) Produces a systematic literature review of UK SMEs’ cybersecurity policy. 2) Creates a decision–making framework for SMEs’ cybersecurity investment and uptake. 3) Makes practical and policy recommendations to benefit SMEs resilience.