# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 4 Results
### Results for Type 2 Auditing
\begin{table}
\begin{tabular}{l l r r r} \hline \hline  & **Dimension** & **0\% to 50\%** & **51\% to 75\%** & **76\% to 100\%** \\ \hline \multirow{3}{*}{Classification} & Micro & 0.00\% & 0.00\% & 0.00\% \\  & Small & 18.42\% & 15.66\% & 65.91\% \\  & Medium & 27.13\% & 6.95\% & 65.92\% \\ \hline \multirow{3}{*}{Main Activity Sector} & Retail & 23.39\% & 19.44\% & 57.16\% \\  & Industry & 26.51\% & 5.17\% & 68.32\% \\  & Services & 20.53\% & 7.37\% & 72.11\% \\ \hline \multirow{3}{*}{Number of Employees} & \textless{=10} & 20.18\% & 30.70\% & 49.12\% \\  & \textgreater{}10 \textless{=20} & 0.00\% & 0.00\% & 0.00\% \\  & \textgreater{}20 \textless{=60} & 21.73\% & 12.57\% & 65.69\% \\  & \textgreater{}60 & 26.58\% & 5.61\% & 67.81\% \\ \hline \multirow{9}{*}{Sub-activity Sector} & Ceramics & 0.00\% & 0.00\% & 0.00\% \\  & Construction & 0.00\% & 0.00\% & 0.00\% \\  & Consulting & 0.00\% & 0.00\% & 0.00\% \\  & Electrical & 11.40\% & 17.54\% & 71.05\% \\  & Engineering & 3.51\% & 5.26\% & 91.23\% \\  & Glass & 30.70\% & 0.00\% & 69.30\% \\  & IT & 0.00\% & 0.00\% & 0.00\% \\  & Machinery and Equipment & 31.58\% & 0.00\% & 68.42\% \\  & Maintenance Services & 25.44\% & 0.00\% & 74.56\% \\  & Metalworking & 0.00\% & 0.00\% & 0.00\% \\  & Minerals & 0.00\% & 0.00\% & 0.00\% \\  & Molds & 33.33\% & 1.75\% & 64.91\% \\  & Packaging & 0.00\% & 0.00\% & 0.00\% \\  & Plastics & 16.67\% & 11.84\% & 71.49\% \\  & Primary Sector & 31.58\% & 0.00\% & 68.42\% \\  & Retail & 28.07\% & 29.82\% & 42.11\% \\  & Temporary Work & 0.00\% & 0.00\% & 0.00\% \\  & Tires & 0.00\% & 0.00\% & 0.00\% \\  & Trade Shows and Congresses & 0.00\% & 0.00\% & 0.00\% \\  & Transports & 25.88\% & 0.44\% & 73.68\% \\  & Wholesales & 22.37\% & 19.59\% & 58.04\% \\ \hline \multirow{3}{*}{Company Age} & \textless{=17} & 23.25\% & 12.28\% & 64.47\% \\  & \textgreater{}17 \textless{=26} & 19.74\% & 9.76\% & 70.50\% \\  & \textgreater{}26 \textless{=36} & 22.37\% & 23.90\% & 53.73\% \\  & \textgreater{}36 & 31.29\% & 0.29\% & 68.42\% \\ \hline \multirow{3}{*}{Revenue} & \textless{=2 M} & 16.23\% & 14.47\% & 69.30\% \\  & \textgreater{}2 M \textless{=5.5 M} & 28.07\% & 10.18\% & 61.75\% \\ \cline{1-1}  & \textgreater{}5.5 M \textless{=10 M} & 23.68\% & 7.89\% & 68.42\% \\ \cline{1-1}  & \textgreater{}10 M & 23.83\% & 10.82\% & 65.35\% \\ \hline \multirow{3}{*}{Exports as \% of Revenue} & \textless{=2.5\%} & 23.07\% & 13.68\% & 63.25\% \\ \cline{1-1}  & \textgreater{}2.5\% \textless{=5\%} & 19.74\% & 14.91\% & 65.35\% \\ \cline{1-1}  & \textgreater{}25\% \textless{=60\%} & 29.82\% & 0.29\% & 69.88\% \\ \cline{1-1}  & \textgreater{}60\% & 27.49\% & 0.88\% & 71.64\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Type 2—Second Audit—Acceptance percentage intervals of the controls in the predefined dimensions. By analysing Figures 3 and 5, with the distribution of conformity by predefined groups for Type 1 and Type 2 auditing schemes, it is possible to note the existence of a considerable number of controls with a low level of conformity (below 50%). This is related to the fact that a set of ISO-27001:2013 standard controls are difficult to apply in SMEs. Besides that, while comparing the evolution from the first to the second auditing stages in Type 2 auditing, it is possible to observe an overall positive evolution in the acceptance level higher than 70%, as depicted in the comparison between Figures 6 and 7. Regarding Type 1 auditing, in Table 2 it is visible that most of the selected controls are above 50% and they were evaluated as being in conformity with the standard. This behaviour was observed in the majority of the intervened enterprises. By observing the categories to which the controls belong, cryptographic controls are those that have the worst performance, with a classification below 50%. The remaining controls achieved an evaluation higher than 75%. By observing all of the controls with positive evaluation, the average is 78.06%.