# Towards Roles and Responsibilities in a Cyber Security Awareness Framework for South African Small, Medium, and Micro Enterprises (SMMEs)

Tebogo Kesetse Lejaka, Adéle Da Veiga, Marianne Loock

► To cite this version:

Tebogo Kesetse Lejaka, Adéle Da Veiga, Marianne Loock. Towards Roles and Responsibilities in a Cyber Security Awareness Framework for South African Small, Medium, and Micro Enterprises (SMMEs). 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.211-224, 10.1007/978-3-031-38530-8_17. hal-05462103

HAL Id: hal-05462103

https://inria.hal.science/hal-05462103v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
<figure><img src="image_3.png" /></figure>

# Towards Roles and Responsibilities in a Cyber Security Awareness Framework for South African Small, Medium, and Micro Enterprises (SMMEs)

Tebogo Kesetse Lejaka(✉) ID, Adéle da Veiga(✉) ID, and Marianne Loock(✉) ID

School of Computing, College of Science, Engineering and Technology, University of South Africa (UNISA), Florida Campus, Johannesburg, South Africa
tklejaka@gmail.com, dveiga@unisa.ac.za,
prof.loock.marianne@gmail.com

**Abstract.** Internet users including Small, Medium and Micro Enterprises (SMMEs) can access a variety of global opportunities through cyberspace however SMMEs are also targets of cyber-attacks, although they do not have adequate information technology (IT) skills and financial support to prevent prevalent cyber threats. The main aim of this research study is to identify and propose roles and responsibilities for the cyber security awareness framework for SMMEs. A scoping literature review was conducted to collect and analyse existing studies within the research domain of cyber security awareness towards SMMEs in developing countries. These studies were analysed to identify roles and responsibilities which contributes towards improving the culture of cyber security awareness in South Africa, specifically within SMMEs. These roles and responsibilities are important for the successful implementation of the cyber security awareness framework within SMMEs. The proposed roles also enable collaboration towards the development and rollout strategy of the cyber security awareness within SMMEs.

**Keywords:** Cyber security awareness framework · roles and responsibilities · SMMEs · SMEs · small businesses · South Africa · RSA

## 1 Introduction

Cyberspace can be defined as a way to communicate, access and interact on social networking sites, to make financial transactions, search for information and access entertainment platforms [1]. Internet users including Small, Medium and Micro Enterprises (SMMEs) can access a variety of global opportunities through cyberspace. However, cyberspace is considered an unregulated and dangerous platform [2], as there are numerous risks associated with it. Countless internet users are not aware of the dangers associated with the cyberspace [2, 3, 4, 5, 6, 7, 8, 9]. Cyber security has emerged to be a global concern for all countries because both developing and developed countries are in the
formation to establish or enhance methods which can be utilised in dealing with cyber
issues [10]. Countries must set up cyber security systems to deal with cyber issues that are
spread globally. Numerous cyber-attacks such as WannaCry and Petya ransom affected
computing devices and systems in companies globally. In addition, global companies
such as Meta (formerly known as Facebook) also experienced data breaches whereby
confidential information was leaked or used without users' permission [11, 12]. This
signifies that cyber security is a global concern, affecting individuals, companies and
countries regardless of nationality.

Developing countries such as the Republic of South Africa (RSA) are increasingly
attacked by cyber criminals [13]. RSA also experienced an immense data breach when
approximately 60 million personal data, including unique identity numbers of living,
deceased and immigrated citizens were leaked [14]. TransUnion experienced a data
breach, and hackers managed to access 54 million personal records of customers in RSA
[15]. The Department of Justice also experienced security breach which collapsed the
court systems across the RSA [16]. A credit bureau Experian has suffered a massive
data breach that exposed information of 24 million individual in RSA and 800 000
businesses [17]. The massive data leak included confidential information such as personal
information, contact information and employment details. In these incidents, ransom was
demanded by hackers to restore the victims' system.

Cyber-attacks have emerged to be a vigorous threat to businesses regardless of size
and industry [18]. SMMEs are also targets of cyber-attacks, although they do not have
adequate information technology (IT) skills and financial support to prevent prevalent
cyber threats [19]. There is a need for SMMEs to prioritise cyber security by providing
necessary tools and knowledge to employees which can be applied to protect people,
processes, technologies, and other resources within the organisation [8]. SMMEs in
developing countries are unique, as compared with larger organisations, they have min-
imal access to dedicated cyber security resources [7]. It is important for organisations
to invest in cyber security awareness (CSA), strategies, policies, and tools to protect
the networks, computers, programs and other assets owned by users and organisations
against cyber-attacks [20]. CSA plays a significant role in enhancing the level of aware-
ness of cyber security and provides support for users to be conscious of and dedicated
to organisations' cyber security policies regardless of job designation [21].

## 2 Problem Statement and Research Question

SMMEs in RSA are not effectively prepared to combat against cyber-attacks. They do
not have adequate financial support to afford IT departments [6, 22]. They frequently
struggle to implement and maintain cyber security [8, 23]. To aid in addressing these
challenges the researchers previously developed a Csa4Smmes {RSA} framework for
SMMEs [24] to support SMMEs in developing countries such as RSA, to enhance
CSA within their organisations. To further address the research problem, the researcher
intends to identify roles and responsibilities for the previously developed Csa4Smmes
{RSA} framework, thereby expanding the framework. By defining roles and respon-
sibilities stakeholders can be identified in order to collaborate towards the successful
implementation of the CSA in SMMEs. This collaboration is important to ensure that
roles and responsibilities of individuals within the framework are clear, which improves communication, accountability, operational efficiency, and expectations of delivering CSA in SMMEs. The research question therefore relates to, “What roles and responsibilities should be added to the Csa4Smmes {RSA} framework to aid in the successful implementation of the framework?”.

## 3 Background

SMMEs can be defined differently based on characteristics and perspective of a country. These types of organisations are usually referred as small businesses that are dependent on certain characteristics such as being self-sufficiently owned, managed, funded and operated by one or very few people [25]. SMMEs, regardless of country of origin, display unique attributes as compared to larger organisations [26]. These attributes include the size, location, organigram, commodities’ structure, finances, and managerial approach [27]. In RSA, small businesses are known as SMMEs which can be defined as discrete and diverse enterprises that are managed by an individual or more owner(s). They primarily operate in various sectors of the national economy [28]. In Europe, SMMEs are defined based on the three unique characteristics which includes the number of employees, level of turnover, and size of the balance sheet [29]. SMMEs in developed and developing countries face different challenges, however they share certain attributes [26].

The National Small Business Act defines SMMEs based on the number of employees, size of the business determined by the turnover levels and gross asset value [28]. SMMEs are businesses that operates with less than 200 employees and generates turnover per annum that is less than R64 million, and gross assets value that is less than R23 million [26]. In RSA, SMMEs are categorised into different categories, namely, survivalist, micro, very small, small and medium. The term SME (European) which is a short term for small and medium enterprises, is used interchangeably with SMMEs (RSA). The National Small Enterprise Act No. 102 of 1996 categorises SMMEs into five different categories [30]: Survivalist enterprises have an individual owner with minimal training and asset investment [31]; Micro-enterprises usually have less than five compensated workers; Very small enterprises are stable and usually consists of less than ten paid employees [31]; Small enterprises have the capacity to appoint approximately 100 employees and can run with minimal guidance from the owner [31]; and Medium-sized enterprises have the capacity to recruit approximately 200 employees. RSA is considered a developing country [32] and its SMMEs are found to be less innovative as compared to SMMEs in developed countries [33].

IRMSA identified lack of innovation as one of the top industrial risks in RSA [34]. One of the challenges of doing business in RSA is insufficient capacity to innovate [32]. Hence, CSA for SMMEs should be uniquely tailored to their needs. These SMMEs do not have adequate access to the latest technologies as compared to SMMEs in developed countries [32]. They might also be incompetent in utilising the latest cyber security technological tools to mitigate cyber threats.
## 3.1 Cyber Security Awareness

There is a significant intersection between cyber security and information security, these two concepts are not completely equivalent [35]. Information security can be defined as a security process that is designed by organisations to counter the undesirable effects of evading data loss and the unauthorised use of information [36]. Cyber security goes beyond the limitations of traditional information security, it does not only focus on protecting information resources, but it also protects other assets, including people [35]. Cyber security can also be defined as a collection of technologies, procedures and developments put in place to protect networks, computers, programs and data from outbreaks, damage or unauthorised access [37]. Conclusively, cyber security is the protection of cyberspace, digital data, ICT technologies and users of cyberspace [35].

The aim of CSA is to improve the understanding of users towards the implications of their actions from a security perspective [38]. When conducting CSA, it is essential to assist all internet users (including internal and external stakeholders) within the organisation to have the same basic understanding towards CSA, policies, and procedures [39]. CSA enables internet users to be equipped enough to comply with the cyber security policy in their workplaces [40]. This awareness helps top management and security professionals with an opportunity to successfully communicate with employees regarding: the importance of cyber security; the organisational security policy; and other important cyber security related information [41].

CSA can be used as an effective method of addressing cyber security because this initiative helps to minimise costs of security incidents [42]. It also increases employees' understanding relating to their responsibilities and penalties linked with such faults [42]. Therefore, it is important to provide up-to-date CSA to keep cyber security existing in the minds of internet users in organisations. However, to obtain effective awareness results, CSA should distinguish between clusters of users in order to deliver relevant and customised information to the specific audience [42].

## 3.2 SMMEs Cyber Security Needs

SMMEs, regardless of size, are dependent on IT for growth and sustainability of the business. These SMMEs have inadequate resources to mitigate cyber security related risks [22]. Organisations regardless of size, share certain characteristics, although SMMEs have a distinctive set of attributes as compared to large organisations [43, 44]. SMMEs are regularly adopting the usage of IT for the process of storing confidential and valuable information (personal and financial records of clients) within their systems [22]. Such information, if not stored securely, can pose a risk towards individuals and organisations. Consequently, an opportunity for hackers might arise to target larger organisations [22]. In both developing and developed countries, SMMEs play a critical role towards the economy [45]. They must be provided with a tailored CSA based on company size, field of operation, in-house skills and resources.

These type of organisations are regarded as contributors to the economic growth and they assist in reducing poverty by creating employment [46, 47]. They also operate more closely with communities and customers which provides employment for people with limited or no skills and training [26, 48]. SMMEs enhance the economy of countries. In
RSA, there is a significant rise in the number of SMMEs [37]. It is important for SMMEs to be up-to-date with modern technology in order to be relevant within the market and also to retain customers [44]. However, SMMEs are not prepared to effectively deal with cyber security problems [18], mainly due to limited financial resources and inadequate internal cyber security experts [23].

## 3.3 Cyber Security Awareness Requirements Framework for SMMEs

The CSA requirements for SMMEs towards existing frameworks are discussed based on the Csa4Smmes {RSA} framework which was developed in a prior phase of this study [49] to support the RSA government's responsibility to promote CSA in the country [24]. The framework was constructed through findings from the systematic literature study [24]. The framework integrates four high-level stages of the National Institute of Standards and Technology (NIST) framework which provides guidance to develop CSA programmes. These stages include designing an awareness programme, developing awareness materials, implementing awareness programme, and post-implementation of the programme [50]. The framework adopted is divided into five layers: the strategic, tactical, preparation, delivery and monitoring [24, 51]. These layers are in alignment with the planning, doing, checking, and acting (PDCA) cycle and the continuous process of planning, designing, implementation and evaluation (PDIE) [52].

The framework also incorporated components of a CSA framework for SMMEs [49]. These components include clearly articulated goals and objectives; appoint a dedicated team; identify current training needs; obtain support in the form of partnerships; identify target audiences; define topics to cover and their delivery methods; establish a cyber security policy; develop a strategy for implementation; design an awareness and training strategy; and define evaluation methods. The Csa4Smmes {RSA} framework contributes in improving the culture of CSA in RSA, specifically within SMMEs.

# 4 Research Methodology

In this study, a scoping literature review was conducted to collect and analyse existing studies within the research domain of CSA towards SMMEs in developing countries. This process was followed to enable the researcher to be aware and understand the latest research studies conducted within the field prior conducting new research [53]. The scoping literature review intends to connect the existing literature in a particular research topic in terms of the volume, nature, and characteristics of the primary research [54]. A comprehensive search was conducted to discover related studies in electronic databases such as Google Scholar, IEEE Explore, ACM Digital Library, Scopus, Emerald Insight, Science Direct, and SABINET. The search terms ("cybersecurity awareness" OR "cyber security awareness" AND "roles" AND "responsibilities" AND "framework" AND "Africa") were used to search for literature. The inclusion criteria were studies published in the English language between the year 2017 and 2023, which focused on CSA among SMMEs in developing countries such as RSA.

The review excluded studies that did not meet the inclusion criteria, duplicates, and those not accessible in full text. During the search, 526 studies were identified
and screened based on title and abstract. These studies were excluded based on their
study focus which is not aligned with research question. Therefore, only 29 studies
met the inclusion criteria for the review. These studies highlighted various roles and
responsibilities that can be incorporated in the framework for SMMEs. These roles and
responsibilities varied based on the business' size, industry, and the nature of the data
processed. The extracted roles and responsibilities were consolidated in a holistic list and
categorised according to the five levels of the Csa4Smmes {RSA} framework applying
the criteria of where the role predominantly needs to take accountability, responsibility
for either the strategic, tactical, preparation, delivery and/or monitoring functions.

## 5 Roles and Responsibilities within the Csa4Smmes {RSA} Framework for SMMEs

SMMEs in developing countries have a crucial role in ensuring that CSA is implemented because it enables individuals within SMMEs to understand the risks they face, identify vulnerabilities, and take steps to protect their data and systems. There is a need for personnel who can assist SMMEs in conducting CSA. It is important for the Csa4Smmes {RSA} framework to address a range of roles and responsibilities that need to be in place within SMMEs, because the framework contributes towards improving the CSA culture in RSA SMMEs [24]. This framework as shown in Fig. 1 introduces the elaTlhoko (which is Setswana word meaning “be careful, wise up or watch out”) campaign which can help RSA SMMEs and government in distributing a tailored CSA within SMMEs across the country. The framework consolidates the roles and responsibilities and incorporates the concept of Ubuntu where there is a culture of peer-to-peer education and mutual support between employees. The concept of Ubuntu is isiZulu word referring to humanity and states that a person is a person based on others [55]. The roles and responsibilities are discussed based on the layers of the framework.

### 5.1 Strategic Layer

This layer reflects on government's general vision regarding CSA since the RSA gov-
ernment primarily aims to promote cyber security in the private sector to establish a
support structure that promotes and builds capacity in cyber security [56]. The RSA
government aims to create an environment where organisations including SMMEs can
share responsibilities and contribute towards the investigating and reporting of cyber-
crimes within the country. For this layer, the following components are required: the
organisational cyber security policy which is based on the National Cyber Security Pol-
icy Framework (NCPF) [12], cyber security legislations, procedures, laws and standards
[15]; the responsible unit such as SMMEs agencies, government departments, delegated
organisations and other related entities; and lastly the strategic plan [57].

In this layer, the roles and responsibilities that were incorporated for the strategic
layer are: government departments [51], SMMEs and SMMEs agencies [24], traditional
leaders [24], and delegated organisations [51, 58, 59]. In this layer, government depart-
ments are responsible for developing and maintaining the NCPF which can be used
<figure><img src="image_4.png" /><figcaption>Fig. 1. The Csa4Smmes {RSA} framework [24]</figcaption></figure>

by SMMEs when developing their organisational cyber security policy [12]. This component also influences the cyber security legislation and laws. The government is also responsible for developing and maintaining cyber security legislation and laws which are in alignment with the NCPF [60]. In RSA, there are communities that operates under traditional leadership where permission is required to penetrate the community with activities [24]. The delegated organisations, SMMEs and SMME agencies are responsible (individually or in collaboration) for developing the cyber security policy, procedures, and standards (which are based on cyber security legislation, laws and the NCPF) for a particular SMME [24]. The responsible units can collaborate with one another for developing, supporting, promoting, and evaluating CSA in SMMEs because cyber security is a shared responsibility [60]. In addition, they are also responsible for developing a cyber security strategic plan for SMMEs [57].

CEOs and senior managements within SMMEs are responsible for recommending and actively supporting the cyber security related policies, procedures, and guidelines to ensure the organisation is protected against cyber threats [26]. They are responsible for ensuring that there is adequate support in terms of access to cyber security related resources, training tools, and support system for employees so that they can understand their roles and responsibilities in protecting the organisation's data. This process can also be actioned during the on-boarding of new employees within the organization. Cyber security specialists (as part of the responsible units) are responsible for developing, implementing, and periodically reviewing cyber security related policies [61]. In
addition, they are required either on a permanent or temporary basis to conduct period-
ical risk assessment and monitor networks within SMMEs. However, technology alone
might not result into an ultimate security solution to respond to security problems [62].

## 5.2 Tactical Layer

The tactical layer suggests activities in the form of campaigns that are required to be applied to drive CSA within SMMEs in RSA. The main goal of CSA is to reduce cyber-attacks that are caused by errors due to human factors [42]. The name for a CSA campaign that accommodates SMMEs is *elaTlhoko* campaign. In this layer, partnerships must be established to enable SMMEs and government to collaborate in improving CSA levels within the country. These partnerships will be established with both the public and private sectors [24, 51, 59], academic institutions [51], research institutions [24], and international collaborators [51]. In addition, these partnerships can assist with the development and deployment of the *elaTlhoko* campaigns to SMMEs across RSA. Individuals within SMMEs are required to ensure that the *elaTlhoko* campaign is implemented successfully. This improves the culture of CSA by providing regular awareness and training sessions for employees on the basics of cyber security concepts such as password management, identifying phishing, multi-factor authentication, back up procedure, data protection, safe browsing on the internet, and reporting suspicious activities.

The responsible units – the government, the delegated organisation, SMMEs and SMME agencies are responsible for providing assistance in coordinating certain sections of the *elaTlhoko* campaign’s action plan [63]. Partnership with academic institutes can assist with distributing CSA for SMMEs through community engagement and training initiatives (including short courses) [60]. The involvement of research institutions can assist with conducting cyber security related research and development to raise awareness, identify and protect people, processes, and technologies against cyber threats. These units are set in place to be responsible for establishing collaborations with international entities from other countries [57]. In addition, they are also responsible for initiating, maintaining, evaluating, and promoting *elaTlhoko* campaigns.

## 5.3 Preparation Layer

The preparation layer enables organisations to be able to prepare the content for the *elaTlhoko* campaign based on the tactical layer. CSA efforts are intended to change behaviour or strengthen good cyber security practices [64]. The purpose of awareness presentations is to use attractive techniques to focus attention on cyber security to assist users in identifying cyber security concerns and react accordingly [44]. This layer is made up of four components, namely: awareness scope; awareness topics; awareness content and delivery methods; and medium and tools [24]. The roles and responsibilities that were incorporated for this layer are: government departments, delegated organisations (public and private), SMMEs, and SMMEs agencies. For this layer, these roles and responsibilities are not reflecting in the figure because the layer emphasises activities to be performed. These responsible units can individually or collaboratively assist developing a tailored awareness scope which is aligned to the cyber security vision and mission within SMMEs [59]. It is significant for the awareness scope to be aligned with content
and topics which can also be generic to accommodate multiple target audience with similar settings [24]. The responsible units can assist with identifying CSA topics for a particular SMME including the formulation of other topics which are generic. These awareness topics must be aligned with the selected delivery methods and delivered to target audience using their native language. These units are also responsible for developing and maintaining CSA content for SMMEs. The content must also be aligned with the selected delivery methods. These units can also assist with identifying tools to be used when conducting CSA in SMMEs. Therefore, the tools are also aligned with CSA topic, content and medium.

## 5.4 Delivery Layer

This layer helps with the delivery of CSA in terms of defining the target audience based on the preparation layer. The delivery layer is divided into facilitators (educators) and participants (learners). Educators are responsible for carefully monitoring learners, attending to their questions, comments and inspirations, and provide a variety of opportunities related to their inspiration [65], while learners are responsible for listening and paying attention during sessions [65]. The roles and responsibilities that were incorporated for this layer are: delegated organisations (public and private), non-profit organisations, SMMEs agencies, SMMEs (employers and employees), and shareholders. The responsible units can assist by providing CSA for employers, employees and stakeholders within SMMEs. However, SMMEs can also play the educator role for providing CSA for employers, employees and stakeholders within SMMEs [24]. Individuals within SMMEs are also responsible for complying with cyber security related policies and acquiring knowledge by continuously studying, practising, and conducting assessments as part of CSA. In addition, SMMEs also have the responsibility to ensure that appropriate security measures are in place and to conduct due diligence when selecting external vendors.

## 5.5 Monitoring Layer

The monitoring layer helps with the process of examining progress made by elaTlhoko initiatives regarding the organisational and national vision for CSA. The elaTlhoko campaign must be monitored and evaluated for effectiveness [24]. The roles and responsibilities that were incorporated for this layer are: government departments, delegated organisations (public and private), SMMEs, and SMMEs agencies. For this layer, these roles and responsibilities are not reflecting in the figure because the layer emphasises activities to be performed. The responsible units can assist with stating and declaring benchmarks regarding projected targets and standards [57]. The units can be responsible for monitoring and evaluating the CSA campaign and the Csa4Smmes {RSA} framework. In addition, they can assist with generating periodical status reports to keep track of the progress of the CSA campaign and the framework. These processes are executed to evaluate the effectiveness of the CSA campaign and the framework. The responsible units are also responsible for developing a cyber security strategic plan for SMMEs and to assist in providing the necessary resources [24]. Cyber security forums established through the collaboration of the responsible units, can assist with the promotion,
approval, reviewing, monitoring, and evaluation of the organisational cyber security policy [26]. In addition, the responsible units can also ensure that the process of planning, doing, monitoring, and implementing works effectively and aligned with all the components of the strategic layer.

In answering the research question, roles and responsibilities were added to the Csa4Smmes {RSA} framework for each of the five layers. These roles and responsibilities are important towards the successful implementation of the framework. This enables individuals within SMMEs regardless of position to acknowledge and understand their roles and responsibilities towards cyber security.

# 6 Limitations and Future Work

The research study is limited to RSA in terms of identifying suitable roles and responsibilities in cyber security awareness framework. The identified roles and responsibilities were extracted from the literature review and the Csa4Smmes {RSA} framework. Future research will focus on the implementation of the Csa4Smmes {RSA} framework as part of the case study to help SMMEs in RSA to attain an improved CSA level.

# 7 Conclusion

The roles and responsibilities of the Csa4Smmes {RSA} framework were identified to provide an insight towards the success of attaining a comprehensive CSA for SMMEs in RSA. Based on components of the Csa4Smmes {RSA} framework, roles and responsibilities were proposed and discussed to enhance the CSA level within SMMEs, to assist in promoting and distributing a tailored CSA and to aid to identify stakeholders to collaborate towards the successful implementation of the CSA within SMMEs. By defining roles and responsibilities in the Csa4Smmes {RSA} framework, improves communication, accountability, operational efficiency, and expectations towards delivering CSA in SMMEs. It also creates awareness for leadership and management in SMMEs to comprehend what roles they need and which stakeholders are required to aid in address the cyber risk in SMMEs. In addition, the framework incorporates the concept of Ubuntu where there is a culture of peer-to-peer education and mutual support between employees.

# References

1. Gheorghica, D., Croitoru, V.: A new framework for enhanced measurable cybersecurity in computer networks (2016). https://doi.org/10.1109/ICComm.2016.7528209

2. Kritzinger, E., Bada, M., Nurse, J.R.C.: A study into the cybersecurity awareness initiatives for school learners in South Africa and the UK. In: Bishop, M., Futcher, L., Miloslavskaya, N., Theocharidou, M. (eds.) Information Security Education for a Global Digital Society, WISE 2017, vol. 503, pp. 110–120. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-58553-6_10

3. Adelola, T., Dawson, R., & Batmaz, F. (2015, December). The urgent need for an enforced awareness programme to create internet security awareness in Nigeria. In Proceedings of the 17th International Conference on Information Integration and Web-based Applications & Services-iiWAS 2015 (2015). https://doi.org/10.1145/2837185.2837237
4. LeFebvre, R.: The human element in cyber security: a study on student motivation to act. In: Proceedings of the 2012 Information Security Curriculum Development Conference, InfoSec CD 2012, pp. 1–8 (2012). https://doi.org/10.1145/2390317.2390318

5. Sarathchandra, D., Haltinner, K., Lichtenberg, N.: College students’ cybersecurity risk perceptions, awareness, and practices. Cybersecurity Symp. (CYBERSEC) **2016**, 68–73 (2016)

6. Pieterse, H.: The cyber threat landscape in South Africa: a 10-year review. Afr. J. Inf. Commun. **28**, 1–21 (2021). https://doi.org/10.23962/10539/32213

7. Santam: Cyber security becoming more important for small businesses. Busi- nesstech (2022). https://businesstech.co.za/news/industry-news/598286/cyber-security-bec oming-more-important-for-small-businesses/. Accessed 30 May 2023

8. Ncubukezi, T., Mwansa, L., Rocaries, F.: A review of the current cyber hygiene in small and medium-sized businesses. In: 2020 15th International Conference for Internet Technology and Secured Transactions (ICITST), pp. 1–6 (2020). https://doi.org/10.23919/ICITST51030. 2020.9351339

9. Mzekandaba, S.: Cyber crime’s annual impact on SA estimated at R2.2bn. ITWeb (2023). https://www.itweb.co.za/content/JN1gPvOAxY3MjL6m. Accessed 31 May 2023

10. Iguer, H., Medromi, H., Sayouti, A., Elhasnaoui, S., Faris, S.: The impact of cyber security issues on businesses and governments: a framework for implementing a cyber security plan (2014). https://doi.org/10.1109/FiCloud.2014.56

11. Sherr, I.: WannaCry ransomware: Everything you need to know. CNET (2019). https://www. cnet.com/news/privacy/wannacry-wannacrypt-uiwix-ransomware-everything-you-need-to- know/. Accessed 04 May 2022

12. Solon, O., Hern, A.: Petya' ransomware attack: What is it and how can it be stopped?. The Guardian (2017). https://www.theguardian.com/technology/2017/jun/27/petya-ransomware- cyber-attack-who-what-why-how. Accessed 10 Jun 2022

13. Otieno, D.: Cyber security challenges: The Case of Developing Countries (2020)

14. Venktess, K.: SA to see a massive cyberattack in 2017, expert (2017). https://www.news24. com/fin24/tech/cyber-security/sa-to-see-a-massive-cyber-attack-in-2017-expert-20170328. Accessed 11 Mar 2022

15. Businesstech: TransUnion cyber attack – hackers demand R225 million ransom (2022). https://businesstech.co.za/news/cloud-hosting/569658/transunion-cyber-attack-hac kers-demand-r225-million-ransom/. Accessed 15 Jul 2019

16. Makhafola, G.: Department of Justice says it’s recovering from cyber hack causing court case delays. News24 (2021). https://www.news24.com/news24/southafrica/news/department-of- justice-says-its-recovering-from-cyber-hack-causing-court-case-delays-20211010. Accessed 18 Mar 2022

17. Enca: Police probe Experian data breach (2020). https://www.enca.com/news/police-probe- experian-data-breach. Accessed 20 Aug 2022

18. PwC: Economic crime: When the boardroom becomes the battlefield. Global Economic Crime and Fraud Survey 2020. 7th South African Edition (2020). https://www.pwc.co.za/en/assets/ pdf/global-economic-crime-survey-2020.pdf

19. Symantec: Internet Security Threat Report, vol. 21. Network Security (2016). http://linkin ghub.elsevier.com/retrieve/pii/S1353485805001947

20. Dlamini, Z., Modise, M.: Cyber security awareness initiatives in South Africa: a synergy approach. In: 7th International Conference on Information Warfare and Security, ICIW 2012, pp. 98–107 (2012)

21. Siponen, M.T.: A conceptual foundation for organizational information security awareness. Inf. Manag. Comput. Secur. **8**(1), 31–41 (2000). https://doi.org/10.1108/09685220010371394

22. Von Solms, B.: Improving South Africa's Cyber Security by cyber securing its small companies (2015). https://doi.org/10.1109/ISTAFRICA.2015.7190538
23. Upfold, C.T., Sewry, D.A.: An Investigation of Information Security In Small And Medium Enterprises (SME's) in the Eastern Cape (2005). http://icsa.cs.up.ac.za/issa/2005/Proceedings/Research/082_Article.pdf

24. Lejaka, T.: A framework for cyber security awareness in small, medium and micro enterprises (SMMEs) in South Africa. University of South Africa (2021)

25. Nieman, G., Nieuwenhuizen, C.: Entrepreneurship: A South African perspective, 2nd ed. Van Schaik, Pretoria (2014)

26. Coertze, J.: A Framework for Information Security Governance in SMMEs (2012)

27. Devos, J., Landeghem, H., Deschoolmeester, D.: Rethinking IT governance for SMEs. Ind. Manag. Data Syst. 112(2), 206–223 (2012)

28. South African Government: National Small Business Amendment Act 29 of 2004 (2004). http://www.info.gov.co.za/documents/acts. Accessed 12 Jan 2018

29. European Commission: Annual report on European SMEs 2020/2021 (2021). https://www.ggb.gr/sites/default/files/basic-page-files/SME. Annual Report - 2021

30. Lewis, V.L., Churchill, N.C.: The Five Stages of Small Business Growth (1983)

31. Fani, N., von Solms, R., Gerber, M.: A framework towards governing ‘Bring Your Own Device in SMMEs’ (2016). https://doi.org/10.1109/ISSA.2016.7802922

32. World Economic Forum: The African competitiveness report 2017 (2017). http://www3.wef.org.org/docs/WEF_ACR_2017.pdf

33. Bureau for Economic Research: The Small, Medium and Micro Enterprise Sector of South Africa Commissioned by Seda (2016). http://www.seda.org.za/Publications/Publications/. Small, Medium and Micro Enterprise Sector of South Africa Commissioned by Seda.pdf

34. IRMSA: IRMSA Risk Report South Africa risks 2017 Third Edition (2017)

35. Von Solms, R., Van Niekerk, J.: From information security to cyber security. Comput. Secur. (2013). https://doi.org/10.1016/j.cose.2013.04.004

36. Ahlan, A.R., Lubis, M., Lubis, A.R.: Information security awareness at the knowledge-based institution: its antecedents and measures. Procedia Comput. Sci. 72, 361–373 (2015)

37. Kent, C., Tanner, M., Kabanda, S.: How South African SMEs address cyber security: the case of web server logs and intrusion detection. In: IEEE International Conference on Emerging Technologies and Innovative Business Practices for the Transformation of Societies (EmergiTech), pp. 100–105 (2016)

38. Tariq, M.A., Brynelsson, J., Artman, H.: The security awareness paradox: a case study. In: ASONAM 2014 - Proceedings of the 2014 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, pp. 704–711 (2014). https://doi.org/10.1109/ASONAM.2014.6921663

39. Dominguez, C.M.F., Ramaswamy, M., Martinez, E.M., Cleal, M.: A framework for information security awareness programs. Issues Inf. Syst. 11(1), 402–409 (2010)

40. Kruger, H.A., Drevin, L., Steyn, T.: A framework for evaluating ICT security awareness. In: ISSA, pp. 1–11 (2006). https://www.researchgate.net/publication/220803311

41. Abawajy, J., Thatcher, K., Kim, T.H.: Investigation of stakeholders commitment to information security awareness programs. In: Proceedings of the 2nd International Conference on Information Security and Assurance, ISA 2008, pp. 472–476 (2008). https://doi.org/10.1109/ISA.2008.25

42. Al Awawdeh, S., Tubaishat, A.: An information security awareness program to address common security concerns in IT unit. In: ITNG 2014 - Proceedings of the 11th International Conference on Information Technology: New Generations, pp. 273–278 (2014). https://doi.org/10.1109/ITNG.2014.67

43. Stokes, D., Wilson, N.: Small Business Management and Entrepreneurship, 5th edn. Cengage Learning, EMEA (2010)
44. Sami, W.: Exploring the strategising practices of small business managers in selected small businesses in the accommodation sector in Tshwane metropolitan area. University of South Africa (2016)

45. Sánchez, L.E., Ruiz, C., Fernández-Medina, E., Piattini, M.: Managing the asset risk of SMEs. In: 2010 International Conference on Availability, Reliability and Security, vol. 60, pp. 422–429 (2010). https://doi.org/10.1109/ARES.2010.52

46. Abor, J., Quartey, P.: Issues in SME development in Ghana and South Africa. J. Financ. Econ. **39**, 218–228 (2010)

47. Dhillon, G., Stahl, B.C., Baskerville, R.: Creativity and intelligence in small and medium sized enterprises: the role of information systems. In: Dhillon, G., Stahl, B.C., Baskerville, R. (eds.) IS&O 2009. IAICT, vol. 301, pp. 1–9. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02388-0_1

48. Megginson, L., Byrd, M., Megginson, W.: Small Business Management: An Entrepreneur's Guidebook, 5th edn. McGraw- Hill/Irwin, New York (2006)

49. Lejaka, T.K., Da Veiga, A., Loock, M.: Cyber security awareness for small, medium and micro enterprises (SMMEs) in South Africa (2019). https://doi.org/10.1109/ICTAS.2019.8703609

50. Labuschagne, W.A., Veerasamy, N., Leenen, L., Mujinga, M.: Damp internet café users in rural design of a cyber security awareness campaign for internet café users in rural areas. In: Proceedings of Southern African Cyber Security Awareness Workshop, pp. 42–58 (2011)

51. Kortjan, N., Von Solms, R.: A conceptual framework for cyber-security awareness and education in SA. South Afr. Comput. J. **52**(1), 29–41 (2014). https://doi.org/10.18489/sacj.v52i0.201

52. Dlamini, I.Z., Taute, B., Radebe, J.: Framework for an African policy towards creating cyber security awareness. In: Proceedings of Southern African Cyber Security Awareness Workshop (SACSAW), pp. 15–31 (2011)

53. Ramdhani, A., Ramdhani, M., Amin, A.: Writing a literature review research paper: a step-by-step approach. Int. J. Basic Appl. Sci. **3**, 47–56 (2014)

54. Arksey, H., O'Malley, L.: Scoping studies: towards a methodological framework. Int. J. Soc. Res. Methodol. **8**(1), 19–32 (2005). https://doi.org/10.1080/1364557032000119616

55. Gundu, T., Modiba, N.: Building competitive advantage from Ubuntu: an African information security awareness model. In: Proceedings of the 6th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, pp. 569–576 (2020). https://doi.org/10.5220/0008983305690576

56. Department of Justice and Constitutional Development, Cybercrimes and Cybersecurity Bill (2017)

57. Osborn, E., Simpson, A.: Small-scale cyber security. In: Proceedings - 2nd IEEE International Conference on Cyber Security and Cloud Computing, CSCloud 2015 - IEEE International Symposium of Smart Cloud, IEEE SSC 2015, pp. 247–252 (2016). https://doi.org/10.1109/CSCloud.2015.12

58. Walaza, M., Loock, M., Kritzinger, E.: A framework to integrate ICT security awareness into the South African schooling system. In: ACM International Conference Proceeding Series, vol. 28, pp. 11–18 (2014). https://doi.org/10.1145/2664591.2664596

59. Bada, M., Nurse, J.R.C.: Developing cybersecurity education and awareness programmes for small- and medium-sized enterprises (SMEs). Inf. Comput. Secur. (2019). https://doi.org/10.1108/ICS-07-2018-0080

60. Malatji, M., Marnewick, A.L., von Solms, S.: Cybersecurity policy and the legislative context of the water and wastewater sector in South Africa. Sustainability **13**(1), 291 (2020)

61. Trim, P.R., Lee, Y.I.: The Global cyber security model: counteracting cyber attacks through a resilient partnership arrangement. Big Data Cogn. Comput. **5**(3), 32 (2021)

62. Bedi, D.S.: Information security in hospitality SMMES in the Cape metropole area: policies and measures in the online environment. Cape Peninsula University of Technology (2013)
63. Moise, L.L., Khoase, R., Ndayizigamiye, P.: The influence of government support interventions on the growth of African foreign- owned SMMEs in South Africa. The Influence of Government Support Interventions on the Growth of Foreign-Owned SMMEs, pp. 104–124 (2019)

64. Hassanzadeh, M., Jahangiri, N., Brewster, B.: A conceptual framework for information security awareness, assessment, and training. In: Emerging Trends in ICT Security, Elsevier Inc., pp. 99–110 (2013)

65. Fry, H., Ketteridge, S., Marshall, S.: A Handbook for Teaching and Learning in Higher Education: Enhancing. Routledge, Milton Park (2008)