# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 4 Results
### Characterization  
The project targeted globally 50 SMEs and micro enterprises, affiliated with NERIEI business association and mostly operating in the center of Portugal. From those 50 SMEs, 30 received a Type 1 auditing and the remaining 20 were intervened with a Type 2 auditing, as depicted in Figure 1A. Regarding the characterisation by the types of enterprise, Figure 1B illustrates the distribution by size, namely between small, medium, and micro enterprises, while Figure 1C depicts the distribution of participating SMEs by geographic region in Portugal.  
Figure 2 depicts the characterisation of the companies by the following dimensions: main activity sector (A), activity sub-sector (B), age of the enterprise (C), number of employees (D), business revenue (E), and export activity (F).  
Figure 1: Characterization of the SMEs participating in the case study—**(A)** Type of auditing (Type 1 and Type 2); **(B)** type of company: small, medium, and micro enterprise; and, **(C)** companies per district.  
By analysing Figure 1, it is possible to observe the following main aspects:  
* Regarding the geographic region, all of the participating SMEs operate in the centre region of Portugal, mostly in the Leiria district (43 out of 50).
* We may observe that 48% are medium-sized enterprises and the smaller slice is related with the micro enterprises with 14%.  
Regarding the six dimensions that are observed in Figure 2, the global analysis incorporated the already existing quartiles used by NERLI to classify its affiliated of SMEs, and can be summarised, as follows:  
* The main activity sector is equally distributed by industry, commerce, and services, with a slight increasing in the industry sector (20 enterprises).
* The most representative sub-activity sectors are wholesales and engineering services, respectively, with 13 and 5 enterprises.
* The age of companies is equally distributes by the four defined groups (\(<=\)17, \(>\)17 and \(<=\)26, \(>\)26 and \(<=\)36, \(>\)36).  
Figure 2: Characterization of the SMEs participating in the case study—**(A)** Main activity sector; **(B)** sub-sectors of activity; **(C)** age of the enterprise; **(D)** number of employees; **(E)** business revenue (scale); and, **(F)** exports as % of business revenue (scale).  
* 70% of the intervened enterprises have more than 20 employees, with 36% having more than 60 employees.
* The business revenue is equally distributed by the four defined scales, namely \(<\)=2 M, \(>\)2 M and \(<\)=5.5 M, \(>\)5.5 M and \(<\)=10 M, 10 M.
* For almost 50% of the intervened enterprises, the investment in exports only represents 2.5% of the business revenue, which reveals their low level of internationalization. The remaining enterprises are distributed by the other three predefined scales: \(>\)2.5% and \(<\)=25%, \(>\)25% and \(<\)=60%, \(>\)60%.  
By observing Figures 1 and 2, it is worth noting that this project targeted a significant range of the businesses in the region. From enterprise age to business revenue, there is a representative spread of enterprises, even when considering the number of dimensions in analysis. This may infer that the findings of this research work may be applicable to a wider scope.