# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 2 Literature Review
### Case Studies and Related Work  
IT infrastructure has become a very critical asset in SMEs operations as a whole. The increasing of cyberthreats in SMEs has raised the management boards' consciousness about the need and importance of dealing with the risk that is involved with the overall dependencies of business on information systems. A comprehensive set of related case studies regarding information security and cybersecurity management in SMEs is described below. [PERSON] et al. [28] point out the fact that the standards available are scarce and usually focused on large companies, who have a well-structured business process to some extent. The authors proceed to point out that the available standards are too generic or too specific to some specific business domains. Therefore, they proposed an approach on how to apply risk management in information systems on SMEs, by analysing the available standards and their integration with various risk management frameworks. [PERSON] et al. [29] evaluate the extent of the impact of measures (controls) applied to cybersecurity threats as a preventive control in SMEs. The focus was on identifying ISMSs to provide a systematic approach to manage sensitive data in terms of maintaining its confidentiality, integrity, and authentication. The outcomes have allowed the SMEs to determine which ISO-27001:2013 practices are more suitable to use. [PERSON] [30] analysed the ISO-27001:2013 standard and a toolkit was proposed to help SMEs implement the requirements of the standard. The aim of this toolkit was to guide SMEs to implement and evaluate the ISO-27001:2013 controls. Several works addressing cybersecurity threats and information security have been published [31]. They explore three distinct goals: to raise awareness on information security; to evaluate how ISO-27001:2013 standard may be used to improve the assets protection and, at same time, to identify the risk they are exposed to; to guide SMEs on the adoption of ISO-27001:2013 standard; and, to improve information security and cybersecurity. Having in mind the increasing cybersecurity risks and their impact to SMEs, in [32], the authors propose an approach for SMEs to assess and improve their cybersecurity capabilities, by integrating key elements from existing industry standards. The results were obtained by defining an assessment questionnaire; however, validation and monitoring of its applicability in real-world implementations is required. [PERSON] et al. [33] try to develop a cybersecurity label for SMEs supported and accredited by third party cybersecurity risk experts. The defined goals were to raise the awareness of SMEs to the risks that they are facing in European countries. In [34], the same authors present a case study that is focused on the evolution of a Belgian program that is related to good practices of self-assessment to a lightweight certification scheme fitting the needs and capabilities of SMEs. Furthermore, a case study in the UK [35, 36] investigates the possible reasons for SMEs apparent lack of interest in securing data, or developing information security management systems. The authors focus on cyber liability insurance, which provides the basis for a cost-effective solution to encourage good information assurance across the SMEs supply chain, by protecting their own data and the data that they share with the supply chain partners. A different case study in UK from [PERSON] et al. [37] addresses the increasing amount of cyberattacks and threats for SMEs and identifies the influencing factors that are needed to improve security behaviours and engagements with information security best practices. The authors propose a cybersecurity rating scheme for SMEs in the UK, with the potential to scale internationally. Overall, the increasing of cyberattacks towards SMEs brings to light specific information security and cybersecurity standards and guidelines that are grounded on well-known best practices that are being developed.