# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 3 Methodology Based on ISO-27001:2013
### Auditing and Intervention Types  
The memorandum of the project considers two types of auditing and intervention, based on the ISO-27001:2013 standard, namely \"Type 1\" ( standard) implementation with thirty controls being evaluated, and \"Type 2\" ( full) implementation composed by the whole 114 controls (see Table 1). The idea behind the use of these two typologies was to define two distinct intervention paths, according to the SMEs' profile. Type 1 auditing was directed towards enterprises whose aim was to obtain an initial diagnosis of the cybersecurity risk, and to correct the identified flaws as much as possible. Type 2 was mainly chosen by SMEs with the aim to audit a vast number of controls and reevaluate the corrective measures applied to have at least 60% of compliance with the standard. The funding available for the enterprises that enrolled in each typology was different, as well as the minimum self-investment that each enterprise had to have. Table 1 (Section 2.2) lists the _a priori_ ISO-27001:2013 categories that were considered in each one of the auditing types. Type 1 auditing encompassed a subset of around 25% of the ISO-27001:2013 categories, which corresponds to 30 controls of the 114 available. The selected 30 controls have a wide range and they can be applied in a multitude of SMEs. It is worth noting that most of the intervened SMEs are going through an information security auditing for the first time and, thus, the selected controls tried to focus on the most fundamental issues of the ISO-27001:2013 standard, not imposing a high level of complexity and procedural maturity that this type of enterprises may not have. More specifically, in Type 1, the categories, and the corresponding controls, were chosen based on the following general presuppositions:  
* No need to acquire infrastructural components, like buildings or specific networking infrastructure components. * SMEs do not have to have a formal corporate and/or human resources structure in the organisation. * The selected controls should be directed towards the evaluation and mitigation of the most common cyberattacks described previously. * There is no need to implement disaster recovery and business continuity procedures, as small businesses and enterprises that chose Type 1 intervention do not have these issues as the main priority. * Because most of the SMEs in the project do not have a strong business process model representation, the controls included in the proposed methodology tried not to impose a mandatory and existing formal organisation inside the SMEs. * For some of the SMEs, the aim of their participation in the project was to allow a preliminary check-up of their organisational and security procedures. Therefore, the controls that were included in the Type 1 audit allow for addressing some of the most basic issues without forcing a pre-existence of a formal business and complex IT infrastructure. For this type of intervention, it was established that no re-evaluation process would be done, and all of the identified flaws were tentatively mitigated during the auditing process. The commitment was to make all of the efforts to have all the controls passed with the highest conformity level, decreasing the risk, and increasing the level of information security. An auditing report was delivered to each SME with the evaluation made, namely the identification of flaws, the countermeasures applied, and a list of recommendations for further interventions. Cyberthreats are agnostic and they may affect the enterprises as a whole. However, SMEs are prone to be more intensively affected by some specific cyberthreats and attacks, in comparison to larger enterprises. The list below itemizes those cyberthreats, according to the literature [4, 8, 45, 46], and how the ISO-27001:2013 framework and the defined methodology can mitigate them:  
* Social engineering attacks, namely phishing, malware, mobile malware, and ransomware. * Policy management threats, namely weak passwords and inadequate authentication mechanisms and access controls.