# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 1 Introduction  
Enterprises have increased their level of consciousness regarding cybersecurity and information security management, as it has been assumed that these are relevant issues regarding competitiveness and survival in global markets [1, 2]. The importance that has been gained by information security and cybersecurity management in enterprises worldwide has been enormous. On one hand, management boards are becoming aware about the need to protect data and information [3] and, on the other hand, cyberattacks are booming, as documented by worldwide cybersecurity institutions [4], and the level of consciousness about the need to implement countermeasures have comprehensively increased [3]. The COVID-19 pandemic has also had a detrimental impact in cybersecurity world wide, as more collaborators are working from home, which led to accelerate digital transformation in enterprises [5, 6]. Small and Medium-sized Enterprises (SMEs) play a key-role in economy, as they represent a large band of the wealth produced worldwide [7, 8]. However, their intrinsic characteristics, namely their small dimension, the fact that they are grounded on traditional and familiar structures, and their financial resources typology [9], put them in a second plan in what information security and cybersecurity awareness concerns. The difficulties in accessing funded projects for cybersecurity, the collaborators' level of cyberawareness, andthe eventual lack of resident Information Technology (IT) staff are also important issues regarding the implementation of best practices in cybersecurity [10; 11; 12]. This paper presents the results that were obtained with the implementation of an information security and cybersecurity management project, funded by IAPMEI though an European funding for regional development, and promoted by NERLEI ([[https://www.nerlei.pt/en/home](https://www.nerlei.pt/en/home)]([https://www.nerlei.pt/en/home](https://www.nerlei.pt/en/home)), accessed on 7 April 2021), a business association located in Leira that has about two thousands affiliated SMEs and micro enterprises. The project, named \"Log In Innovation\" ([[https://www.logininnovation.pt/projeto](https://www.logininnovation.pt/projeto)]([https://www.logininnovation.pt/projeto](https://www.logininnovation.pt/projeto)), accessed on 7 April 2021), aims to implement a digital transformation process in SMEs that may boost their competitiveness in global markets. Besides information security and cybersecurity, the project has four additional core axes: lean manufacturing, balanced scoreboard, digital marketing, and quality management. The total amount of the project is around 1,304,000.00 \(\epsilon\) and it plans to cover a total of 80 eligible SMEs operating in the following Portuguese regions: North, Center, and Alentejo. Regarding information security and cybersecurity, fifty SMEs, mainly from the center of Portugal, and operating in several activity areas, benefitting from the interventions realised. The project was implemented in the period between 2018-2020 and it embodied the following entities: NERLEI, Polytechnic of Leira ([[https://www.ipleira.pt/home/](https://www.ipleira.pt/home/)]([https://www.ipleira.pt/home/](https://www.ipleira.pt/home/)), accessed on 7 April 2021), a consulting company, and the SMEs. Regarding information security, the overall results achieved by the project are two-fold. Firstly, to give the the companies the opportunity to increase their level of cyberawareness and competitiveness, and to help mitigate some of their organisational, IT, and human resources flaws, by applying the funding available for cybersecurity management. Secondly, at a regional level and involving solely local partners and SMEs, to strength the cooperation between a business association, academia, and a consulting team working together, to foster cybersecurity in SMEs and mitigate their information security flaws. The paper is organised, as follows.