# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
###### Abstract  
Cybersecurity threats are on the rise, and small- and medium-sized enterprises (SMEs) struggle to cope with these developments. To combat threats, SMEs must first be willing and able to assess their cybersecurity posture. Cybersecurity risk assessment, generally performed with the help of metrics, provides the basis for an adequate defense. Significant challenges remain, however, especially in the complex socio-technical setting of SMEs. Seemingly basic questions, such as how to aggregate metrics and ensure solution adaptability, are still open to debate. Aggregation and adaptability are vital topics to SMEs, as they require the assimilation of metrics into an actionable advice adapted to their situation and needs. To address these issues, we systematically review socio-technical cybersecurity metric research in this paper. We analyse aggregation and adaptability considerations and investigate how current findings apply to the SME situation. To ensure that we provide valuable insights to researchers and practitioners, we integrate our results in a novel socio-technical cybersecurity framework geared towards the needs of SMEs. Our framework allowed us to determine a glaring need for intuitive, threat-based cybersecurity risk assessment approaches for the least digitally mature SMEs. In the future, we hope our framework will help to offer SMEs some deserved despite by guiding the design of suitable cybersecurity assessment solutions. cybersecurity; metrics; socio-technical; SME; systematic review +
Footnote †: journal: Applied  
SMEs can begin to improve their cybersecurity posture, it is vital they first assess their current situation [11]. Assessment of cybersecurity posture is achieved by measuring SME cybersecurity properties, which result in cybersecurity metrics. Regardless of whether measurement results are deemed relevant by the SME, the knowledge gained by those involved in the measurement process is of value [12]. This observation touches once more on the socio-technical nature of the problem, where furthering human knowledge and improving the technical cybersecurity posture of an SME go hand-in-hand. Cybersecurity assessment generally requires the aid of cybersecurity experts--personnel that SMEs typically do not have [9; 10]. A solution to this issue is to automate the cybersecurity assessment process where possible [9]. Although automation is a promising approach, the diverse nature of the SME landscape is often ignored [13; 14], whereas we know from earlier research that it is vital for SMEs to have solutions adapted to their context and needs [15; 16]. Another issue is that cybersecurity assessment approaches aimed at SMEs are still scarce [6], explaining why it is not uncommon to see results from other cybersecurity focus areas being applied to the SME setting [10]. Systematic literature reviews are a logical approach to gather knowledge from one focus area, summarise it, and make it available for use in other focus areas. Systematic reviews that address both the social and technical sides of cybersecurity already exist [17; 18]. These reviews identified a need for adaptable solutions [18], which we have seen are also carved by SMEs. Additionally, these papers stress the need for more clarity on how to aggregate security metrics [17; 18]. Given the lack of resources available at SMEs, aggregating information into understandable insights is a requirement for a usable solution [9]. The issue with these systematic reviews is that they offer adaptability and aggregation as areas for future research, rather than addressing the topics head-on. Additionally, they do not provide actionable insights for SMEs since this is not their target audience. In short, we can conclude that SMEs need (semi-)automated cybersecurity assessment approaches that address their needs for adaptability and aggregation of information. A systematic review offers the potential to gather and summarise such information, providing guidelines for designing usable solutions for SMEs.