Week 15

The socio-technical perspective on cyber security emphasizes the mutual control among people,  process, technology and context for achieving effective security outcomes. This is because cyber security is not just a technical matter, but also people’s behaviors and organizations’ structures that contribute to its performance.

Practice of Frameworks

A way to describe it can be implemented based on its socio-technical philosophy that implies that effective development of cyber security is possible because of the collective effort of the organizational culture, the design of the process, and the human aspect (Ahmad & Teo, 2024). The results of such models have kept providing significant empirical data in terms of the strong impact of cyber security uptake in the SME sector.

Integrating the ISO 31000 standard and the NIST Cyber security Framework, SMEs can work on a unified and well-organized method of identification, assessment, and mitigation against possible cyber threats (Sabidi & Zolkipli, 2024). This procedural strategy turns cyber security into a reactive, one-time fix, but instead it is a living system that is seamlessly integrated with the entire goals of the organization and meets the legal requirements as a matter of fact. Consolidation of these frameworks will help the SMEs to take cyber security as a continuous process so that they can be active in dealing with any threats that come by and not just waiting to respond to an incident after it is already an occurrence.

Kianpour and Raza (2024) also indicate that formalizing the cyber security practices would also reduce the possibility of SME experiencing high-impact security incidents. Furthermore, integrating these practices within the fundamental work of the organization not just improves cyber security, but also makes organizations consistent with larger business objectives so that security arrangements would enhance the success and stability of the organization in the long term.

The model outlines the potential manner in which the cyber security concepts might be incorporated into a risk management system, within the small and medium-sized enterprises (SMEs) and the significance of human factor in the effort. The synthesis of these frameworks also fills the gap between technical solutions and organizational culture since it concerns the possibility to use the tools successfully in SMEs, which is not only possible through the implementation of tools but also through the correspondence of the tools to the organizational values and practices (Georgiadou et al., 2022).

This method will allow studying the ways of preventing the appearance of cyber security threats in SMEs more thoroughly and subtly, as it focuses on both the socio-cultural and technical aspects of the matter. According to Sikder (2023), such a dynamic acts as a self-synchronizing assimilation of technology, human behavior, and organizational functioning, which are drivers of cyber security as an ongoing process, as opposed to a reactionary response? With these intersections, the strategy would make cyber security become a part and parcel of the organization, and not a one-time solution to a problem.

Generally speaking, such an approach provides a great strength to the study, as it provides a theoretical frame beyond the technical sphere of cyber security. It introduces the significance of a holistic and active way of ensuring successful cyber security outcomes by identifying the most essential roles of organizational commitment and organizational culture. This perception brings out the reality that the holistic approach to cyber security is not absolutely dependent on application of technology, but rather the culture of security within the company. With organizational commitment and organizational culture in line with the goal of cyber security, the organization becomes more apt to prevent and manage cyber threats and cyber security remains an on-going and component aspect of the business process.

The advantage of the chosen theoretical frameworks is that they contribute to the explanation of the significance of implementing cyber security decision-making in the larger context of Enterprise Risk Management (ERM). The integration of cyber security into the ERM strategy enables the SMEs to deal with cyber threats as a subset of their entire risk management process instead of viewing them as a single challenge. Not only does this combined strategy make cyber security objectives consistent with business objectives, but it also increases the performance of the organization to prevent, foresee, and react to cyber threats successfully.

The theoretical assumptions offer a strong ground to evidencing the hypothesis that the existence of the solutions related to cyber security within the framework of ERM results in the increased rates of resilience and the ability to manage risks in the small and medium-sized enterprises (SMEs).

Identifying Key Variables

To manage the cyber security threats successfully, the SMEs should consider various variables that define the cyber security activities success. These include the risk treatment, risk monitoring, employee engagement, organizational culture and resource distribution. These key variables are summarized in the table below and how they can be applied to cyber security framework application within SMEs.

Table 1: Key Variables in Cyber security Risk Management for SMEs

The following table presents the most important variables, which include risk treatment, employee engagement, and resource allocation, that are essential in the successful approach to cyber security risk management in SMEs, and their applicability to SMEs is indicated in the last column. A risk treatment and risk monitoring are also key variables highlighted according to the Enterprise Risk Management (ERM) model where the systematic identification, assessment and management of risks in an organization are put into the limelight. The model follows a proactive and structured method of managing risks, thus risks are always assessed and addressed with time. By contrast, the socio-technical model emphasizes the human and organizational elements of the integration of cyber security and says that organizational culture and employee engagement are the most significant areas in ensuring the success of cyber security.

Such socio-technical factors are critical to the success of cyber security processes since they build a work environment within which all stakeholders in the organization take active interest in system and data protection activities. The ERM and the socio-technical framework can be as well combined to serve as a comprehensive framework to comprehend how the technical and social aspects lead to the use of effective cyber security practices. Such a combination will enable the study to offer the comprehensive view of how the organization can successfully deal with cyber risks by harmonizing the organizational culture and processes with technological solutions (Jean-Jules & Vicente, 2021).

Cyber security Risk Management Theory provides a framework for understanding how organizations assess, mitigate, and manage cyber security risks (Melaku, 2023). The theory combines major principles of the risk assessment, organizational culture and cyber security controls. According to this theory, achieving effective cyber security management is a balance between both technical (e.g. firewalls, antivirus software) and organizational (e.g. culture, employee training, strategic alignment) factors.

The assumptions of the theory are as follows:

Risk Assessment: Risk management is successful only in case the potential cyber security threats are recognized and evaluated (Bokan & Santos, 2021). It involves evaluating the external risks (e.g., cyber-attacks) and internal risks (e.g., negligence of the employees).

Cyber security Policies and Controls: When risks have been evaluated, the organizations establish policies and technical controls to reduce risks (Parsola, 2023). These measures should be successful because they should be part of the overall business strategy of the organization.

Organization Culture: Organizational culture is very important in the practice of cyber security. An organization culture that is security conscious is the key to ensuring that cyberspace security becomes a collective responsibility of the organization and not the IT department only.

The interactions of these components in the framework are shown in the diagram below:

The model indicates that the cyber security strategy of an organization should not be considered separately but as a component of its overall risk management (Victor-Mgbachi, 2024).

Research Design

The qualitative multiple- case research design was especially well suited for the present study because it allowed a comprehensive investigation of how cyber security can be used as a risk management tool in the environment of SMEs that operate in various sectors of economy such as healthcare, retail and manufacturing.

Collection and Formulation of Variables

The Cyber Security Practices, Organizational Culture, and Cyber Security Breach and Employee Engagement are the most significant ranking variable of high value to the current study. These are the definitions of these measures:

Overview of Research Design

The main aim of this study was to examine the adoption of cyber security towards small and medium-sized organizations (SMEs) ERM system, as well as how resilient companies become after applying them with cyber security. The study seeks to answer the research question: How can cyber security be included in the enterprise risk management (ERM) process of SMEs and how does including the cyber security in ERM affect the resilience of a firm. What I understand as the motivation of this question is that this will make all those different mechanisms which have been built up

Qualitative Multi-Case Analysis

The approach of the Qualitative Multi-Case Analysis has been chosen in order to address the research questions in a preliminary manner and provide some understanding for how cyber security is adopted by SMEs. This approach was rather well suited for particularly complex and applied problems which are closer to reality;  see e.g. cyber security, where a deep knowledge of organizational procedures as well as industry processes is a must. It enabled an overall view of the treatment to the implementation of practicing cyber security practices in different cases that could be a useful source of information for the problem and approaches to SMEs in.

According to Creswell (2009), a case study design also enables the investigation of the phenomenon in the natural environment and, thus, a more profound examination of how cyber security is incorporated into the system of the overall risk management. In addition, the fact that the study has selected a few cases within the different industries (healthcare, retail, and manufacturing) enabled the researcher to compare and contrast how the SMEs that have different resource constraints and industry-related risk take up the issue.

The case study methodology has been instrumental in the discovery of the numerous applications that cyber security may have in SMEs, and how they can be integrated in risk management plans (Go vender et al., 2025).

Sampling and Participant Selection

The purposive sampling method was applied to select the sample (between six and eight SMEs) with the aim of developing a sample of SMEs in healthcare, retail and manufacturing industry. Chidukwani et al. (2022) indicate that purposive sampling assists the researcher in concentrating on certain instances that are likely to provide useful and pertinent information. The criteria that the SMEs had to satisfy were their participation into the risk management process, the existence of the developed cyber security system and interest in the research.

All the selected organizations to be studied have already adopted some degree of cyber security in their operations, which means that the research could analyze the effectiveness of the integrations as components of their general risk management plans (Enaifoghe, 2023). In addition, the respondents were both the leaders of the organizations, the IT/security managers, and the frontline employees. The interviews with the leaders and managers were received to acquire information on strategic decision making on cyber security and frontline employees to give a good understanding of how these cyber security measures are implemented in day to day lives. This was a multi-level selection technique that gave an overview of how cyber security was being practiced and understood at different levels of organizations (Thummala & Bindewari, 2024).

This paper was designed into three various stages during the data collection process to ensure that a broad range of information would be obtained. These measures were aimed to receive not only objective data in the organizational literature, but emotional subjective elements in the interviews, which would give a fuller picture of the way cyber security is actualized in the systems of ERM.

The first step of data collection involved gathering of organizational documents such as security policies, incident records and cyber security audits. Through the analysis of these documents, the study could evaluate the score of cyber security integration in the ERM framework of every organization as well as detect areas that might have overlooked cyber security or failed to respond to it adequately. Documents also became the foundation of comprehending the written policies and procedures in place which could later be compared with the actual practices found out during interviews (Benjamin et al., 2024).

It was especially helpful when working with documents to determine any irregularities between formal cyber security policies as they existed on paper and how they were applied in real-life operations. They enabled the researcher to determine whether the SMEs had normal methods of cyber security, or rather these were small scale and informal, as it is common with smaller organizations that have fewer resources (Olagbemide, 2024).

The second phase was the semi-structured interviews with the organizational leaders, IT/security managers, and the frontline employees. Both interviews took 45 to 60 minutes and addressed the perspective of the participants regarding the inclusion of cyber security in the ERM framework, the role played by the organizational culture in cyber security practices, and the perceived obstacles and facilitators of successful integration. The semi-structured format was flexible in questioning which provided the researcher with the opportunity to investigate particular issues deeper but at the same time covered the main points within the sphere of relevance of the research questions (Thummala & Bindewari, 2024).

The study sought to gain the subjective insights of the people directly engaged with cyber security practices through interviews and this gave them an idea of the challenges that SMEs are likely to encounter in mapping cyber security to larger organizational risk management. Also, interviews enabled exploring the role of organizational culture as a determinant of the engagement of the employees with cyber security practices. There was a need to find out how the leadership commitment to cyber security affected the general organizational thinking and whether employees were encouraged to practice security beyond the compulsory compliance.

The third step was that the researcher made reflexive notes at the end of every interview. Such notes were meant to document any individual thoughts, bias and other insights that emerge in the process of data collection. One of the major methods to preserve the objectivity and prevent any bias in the interpretation of the information by the researcher is reflexive journaling (Benjamin et al., 2024).

One of the ways this practice assisted was in making the data collection process transparent and also in identifying any possible bias in the data collection process and addressing them during the analysis process. By making personal reflections, the researcher would be able to constantly determine how his/her experiences or expectations would influence the data interpretation.

The key variables would have required operationalization so that the research questions would be adequately covered in the study. The most important variables as investigated in the research included cyber security practices, organizational culture, cyber security breaches, and employee engagement. All the variables were defined and measured meticulously by referring to the data obtained by way of organizational documents, interviews, and reflexive notes.

The processes, tools, and measures that the SMEs put in place to safeguard their information systems against cyber-attacks can be termed as cyber security practices. The security policies and cyber security audits were used to evaluate these practices. The researcher evaluated the fact that these practices were in line with industry standards, as well as that they were effective in eliminating the risks that the organization was exposed to.

Also, when speaking with the IT/security personnel, the researcher obtained information about the particular tools and controls of cyber security employed (firewalls, anti-virus software, encryption systems, and access control measures). The researcher also enquired of how cyber security has been incorporated in the general risk management system and whether they were applied systematically through the organization. This operationalization enabled the researcher to determine whether the SMEs had organized, holistic cyber security operationalizations or they were disjointed and in-vivo (Franco et al., 2022).

Culture organization was measured on the leadership attitude, employee awareness, and how cyber security is incorporated in day-to-day operations. The researcher measured leader commitment in cyber security through interviewing managers regarding their perceptions in cyber security as a strategy priority. The researcher also examined the extent of communicating and highlighting cyber security by the organization leadership. The awareness of cyber security practices among employees was determined in the interviews of the employees. They questioned employees concerning their levels of awareness of cyber security risks, the perception of whether they were interested in security practices, and the frequency of their security training on cyber security matters. The intensity of integration of cyber security in regular operations was investigated by assessing the extent of adherence of the employees to security measures and the perception towards cyber security as routine work.

This method of assessing the organizational culture served to identify whether the organization had a strong and security-conscious culture or cyber security was regarded as a secondary element to other business focus areas.

The variable of cyber security breaches was measured through reviewing the incident reports and interviewing the IT/security personnel and employees in terms of discussing the breaches. The researcher checked the number of reported breaches, severity of these breaches, and the effect of such breaches. Frequency was determined as an incidence in the number of reported incidents in a period of time. The severity was measured in terms of the level of breach including the possibility of causing system downtime, loss of customer data or financial losses. The results of such violations to the business were discussed in the interviews with an emphasis on the operational interferences, reputational losses, and the costs incurred in recovering the business. These tests assisted the researcher to understand the effectiveness of the cyber security practices in preventing breaches and the effectiveness in how the organizations reacted to challenges in cyber security (Thamrongthanakit, 2023).

Engagement of the employees on cyber security was measured by looking at training attendance, reporting behaviors and adherence of security measures. The researcher measured the frequency at which the employees attended a cyber security training program and the ability to adhere to security procedures in their routine work. The measurement of reporting behaviors was done by querying the employees on whether they knew how to report any security incidents or suspicious activities. Adherence was measured through evaluating the employee responses to questions regarding their compliance with security practices; including following password protocol or using secure net. This operationalization enabled the researcher to gauge how active employees were in their pursuit of cyber security practices and whether they knew their contribution to the keeping of the security posture of the organization (Ejaz & Matthew, 2024).

The design has limitations. The sample size is small making it hard to generalize to all SMEs studied and results can be affected because this is a self-reported sample. Healthcare, retail and manufacturing sectorial focus might not capture insights on other sectors. There is also the risk of researcher bias which overcomes by using triangulation, reflexive notes and systematic coding. In spite of these limitations, transparency and defensibility are ensured by the explicit step by step design (Creswell, 2009).

The findings in this section are based on six SMEs in healthcare, retail and manufacturing industries. The findings are grouped together in a thematic way on the topics of cyber security practices, organizational culture, cyber security incidents, and employee engagement. Findings are then analyzed based on the research questions, theoretical framework (Enterprise Risk Management and socio-technical integration) and on the available literature.

The six SMEs also reported that they had some technical defenses; the most advanced being antivirus software, firewall, and frequent updates of the system. Nevertheless, the use was very fragmented, and there was no organization that implements a single framework, like ISO 27001 or NIST, on a full basis (Chidukwani et al., 2022). Three of the SMEs depended on outsourced IT vendors to a large extent, thus establishing disproportionate accountability of cyber risks. The adoption of a structured ERM approach was only partly evident in one healthcare SME, as the threat of cyber threats was reflected in its risk register.

In the cases, cyber security had also been perceived as a technical task as opposed to taking a strategic priority. The interviews with the leaders showed lack of commitment and prioritization to budgets as compared to operational risks. There was little to no reinforcement of cyber security training as employees received very little or a single instance of training. This result shows that literature concurs that often SMEs do not have a security-conscious culture (Fagbule, 2023).

Four respondents out of six SMEs had encountered at least one major breach in the last 3 years. Financial losses, downtime and reputational damage were reported. Retail SMEs were especially prone to point-of-sale attack and phishing, whereas manufacturing SMEs noted ransom ware attacks. The violations in both instances revealed loopholes in any given governance and slowed recovery, as expected based on the results of Benjamin et al. (2024).

Moreover, the information indicated that the training programs were not ongoing, but occasional. Training was provided to employees at ad hoc intervals thus causing uneven knowledge and negative compliance to security practices. This is an absence of continuing education that brings out a major shortcoming of the human resource systems at SMEs- a shortcoming that curtails their capacities to build long term security resilience. These results support earlier claims that SMEs do not tend to invest in regular and multifaceted training that is essential in building a security-aware workforce (Ejaz & Matthew, 2024).

The results indicate that there is a marked disparity in the technical interventions taken on board by SMEs and integration of cyber security with larger risk management tools. SMEs know about essential threats, but they approach them informally and in a reactive manner, which makes them extremely vulnerable. The reported violations support the assumption that operational and financial risk is more common in the absence of integration.

The lack of connection between cyber security and Enterprise Risk Management (ERM) presents a very severe problem: cyber security is not regarded as a core issue of the organizational strategy of risk management, but rather as an additional topic. Consequently, it will be talked about as an incidental matter, instead of being properly incorporated into the overall organizational risk strategy. Such non-integration can be very detrimental to organizations as they will be unprepared to mitigate cyber risks.

Unless cyber security is accorded the due attention in the ERM system, organizations might find it hard to formulate strong measures to counter cyber threats by preventing, identifying, and addressing them. According to Franco et al. (2022), this negligence weakens the organization in managing the cyber security issues efficiently and, thus, their reaction to the cyber risks is less efficient and can leave the organization at a higher risk. Lack of addressing cyber security as a fundamental risk management consideration can expose organizations to enormous losses in protection of their online resources and business continuity against cyber attackers.

Enablers and Barriers (RQ1b):

Several obstacles were mentioned in relation to the facilitation and barriers of cyber security integration. Financial limitations were the largest obstacle because most SMEs lacked the resources to invest in general cyber security.

Variations Particular to Industry (RQ1c)

The premise of the hypothesis was that different industries had significantly varied approaches to implementing cyber security. Contract on supervisory necessities in the context of cyber security were better among Healthcare SMEs, this was chiefly due to the fact that there is a strong need to follow strict regulations in the industry as regards to patient data protection. This heightened awareness, though, did not necessarily result in comprehensive deployment of cyber security as a component of their ERM.

On the contrary, the retail SMEs was more prone to risks of customer-data security like data breach and payment fraud because of the sensitivity of the information that they handled (customer). These agencies were observed to be more interested in the safeguarding of customer information, but in this case, little connection existed with the general risk management policies. On the one hand, the manufacturing SMEs were very vulnerable to the ransom ware threats, thus presenting high operation risks, including disruption of production and losses.

The various types of cyber menaces that these sectors are exposed to highlight the success of industry-specific pressure in the form that the industry affects the prioritization of and the integration of cyber security into the risk management practices of SMEs. These variations in sectors contribute to the significance of applying industry-specific approaches to cyber security because of the benefits of taking risks, as well as the problems of each sector, into account (Arroyabe et al., 2024).

The findings of the study are quite consistent with the socio-technical approach, which postulates that effective cyber security integration should provide balance and harmonization of people, practices, and technology (Chidukwani et al., 2022). Within the framework of this method, the affordability of the right technical controls is not sufficient to assist in cyber security resilience. Most of the SMEs employed various technical control interventions such as firewalls and antivirus packages to control the cyber risks, but they failed mostly because of their weak organizational culture and their systems of governance.

In particular, SMEs were struggling to effectively integrate the concept of cyber security in their business due to lack of leadership dedication and lack of formalism that would have allowed them to align cyber security with their business strategy. Good leadership and coordinated processes are the keys to achieving cyber security but without it SMEs are unable to easily formulate a flexible and effective security stance.

On the same note, SMEs have had a low success in integrating cyber risks as part of the wider Enterprise Risk Management (ERM) model. In most situations, cyber security has been either separated or disregarded in ERM integration across various departments. This fragmentation shows that SMEs also find it difficult to consider cyber security as a component of their overall risk management strategy.

The results here highlight the challenge encountered by SMEs in attaining a comprehensive approach to cyber security. As it is presented in accordance with Ahmad and Teo (2024), the study reveals that SMEs in many cases are unable to develop a single, strategically-oriented approach to cyber security because of the limitations in the resources and organizational issues. These restrictions do not allow them to develop the systems and mechanisms of governance required to be able to fully integrate cyber security, which subsequently affects their overall capacity to achieve successful management of cyber threats.

Such frameworks would assist smaller businesses to learn how to effectively manage cyber security issues on a smaller budget. Besides, studies are also needed on how these simplified ERM-to-cyber security hybrids can be structured to minimize costs and at the same time, ensure that all necessary cyber security provisions are undertaken. Through modification of existing frameworks, the researchers can assist SMEs to adopt more realistic and affordable cyber security measures that do not affect the resilience offering direct and practical advice to these organizations.

Comparative Research between large and SMEs across industries and between large enterprises and SMEs

Through investigating different industries: healthcare, retail, manufacturing, and finance, researchers are able to learn more about how industry-specific risks affect the integration of cyber security and whether SMEs in some of the spheres are in a better position to overcome them than others. Such comparative study would be of great use to policymakers, leaders in the industry, and researchers to adjust their cyber security approaches to better fit the SMEs in various industries.

Longitudinal Effects Studies of incremental adoption of Standards

Lastly, the article recommends that longitudinal research may be of special importance in identifying whether incremental adoption of cyber security standards, including ISO 27001, is more resiliency-enhancing, over time. Although most SMEs might not be able to implement complex and holistic standards immediately because of the lack of resources, a step-by-step adoption of the standards can greatly lead to the sustainability of the changes in cyber security behaviors.

Further studies might provide over time perspectives of the consequences of implementing these standards gradually and whether SMEs are gradually becoming more resilient and capable of handling risk and responding to incidents, continuing to move in line with best practices. The other areas that such research can look at are the effectiveness of incremental adoption to superior models of governance to help the SMEs in the establishment of effective security base at an acceptable price.

The longitudinal research would be quite valuable and would provide the necessary data regarding the possibilities of the gradual implementation of such standards and would be implemented to establish the scalable and affordable governance structures capable of evolving alongside the advancement of SMEs and the escalation of their cyber security-related issues.

According to the study findings, it is true that although SMEs are fully aware of the cyber security risks that they face, they have not been integrating cyber security in their enterprise risk management (ERM) models fully/consistently. Although a significant number of SMEs recognize the need to be concerned with cyber security, they still tend to address it in a disjointed way as an independent problem instead of evaluating it as an essential part of their overall risk management plan. This absence of integration exposes SMEs to high risks of cyber security attacks and makes them less resistant as a company.

The inability to incorporate cyber security into the ERM structure implies that these firms are not well equipped to manage the dynamic and changing character of cyber-attacks. This increased vulnerability to attacks explains why cyber security has to be approached more strategically and systematically in SMEs.

Connecting these results to theoretical models, the paper proves that the integration of cyber security sustainability is impossible to be fulfilled by technical mechanisms only. Although adequate technical controls are important it is pointed out that it is only a combination of governance, organizational culture and sector adaptation that cause actual resilience. It also demands that it has some good governance structures to enforce policies and procedures to streamline cyber security with the broader organizational strategy and culture that facilitates employee involvement and compliance.

Moreover, the specific changes to the industry are crucial since different industries possess distinct cyber security issues, and those require certain resolutions. The study shows that technical solutions are unable to achieve the achievement of sustainable cyber security integration in the SMEs since it must be incorporated in both the culture and the strategy.

References

Al-Dosari, N., & Fetais, N. (2023). Cybersecurity challenges and governance in SMEs: A comparative analysis. Journal of Information Security, 12(2), 55–72.

Arroyabe, M. F., Arranz, N., & de Arroyabe, J. C. F. (2024). Cybersecurity and SMEs: Sector-specific influences on resilience strategies. International Journal of Business Research, 19(1), 88–104.