# Information Security and Cybersecurity Management: A Case Study with SMEs in Portugal
## 4 Results
### Results for Type 2 Auditing
\begin{table}
\begin{tabular}{l l r r r} \hline \hline  & **Dimension** & **0\% to 50\%** & **51\% to 75\%** & **76\% to 100\%** \\ \hline \multirow{3}{*}{Classification} & Micro & 0.00\% & 0.00\% & 0.00\% \\  & Small & 70.72\% & 0.94\% & 28.34\% \\  & Medium & 35.21\% & 2.26\% & 62.53\% \\ \hline \multirow{3}{*}{Main Activity Sector} & Retail & 46.20\% & 2.19\% & 51.61\% \\  & Industry & 66.76\% & 1.17\% & 32.07\% \\  & Services & 57.54\% & 0.88\% & 41.58\% \\ \hline \multirow{3}{*}{Number of Employees} & \textless{=}10 & 19.30\% & 2.63\% & 78.07\% \\  & \textgreater{}10 \textless{=}20 & 0.00\% & 0.00\% & 0.00\% \\  & \textgreater{}20 \textless{=}60 & 49.61\% & 1.75\% & 48.64\% \\  & \textgreater{}60 & 70.00\% & 0.96\% & 29.04\% \\ \hline \multirow{9}{*}{Number of Employees} & Ceramics & 0.00\% & 0.00\% & 0.00\% \\  & Construction & 0.00\% & 0.00\% & 0.00\% \\  & Consulting & 0.00\% & 0.00\% & 0.00\% \\  & Electrical & 11.40\% & 3.51\% & 85.09\% \\  & Engineering & 4.39\% & 0.00\% & 95.61\% \\  & Glass & 30.70\% & 0.00\% & 69.30\% \\  & IT & 0.00\% & 0.00\% & 0.00\% \\  & Machinery and Equipment & 93.86\% & 0.88\% & 5.26\% \\  & Maintenance Services & 99.12\% & 0.00\% & 0.88\% \\  & Metalworking & 0.00\% & 0.00\% & 0.00\% \\ Sub-activity Sector & Minerals & 0.00\% & 0.00\% & 0.00\% \\  & Molds & 100.00\% & 0.00\% & 0.00\% \\  & Packaging & 0.00\% & 0.00\% & 0.00\% \\  & Plastics & 53.07\% & 3.07\% & 43.86\% \\  & Primary Sector & 58.77\% & 0.00\% & 41.23\% \\  & Retail & 27.19\% & 2.63\% & 70.18\% \\  & Temporary Work & 0.00\% & 0.00\% & 0.00\% \\  & Tires & 0.00\% & 0.00\% & 0.00\% \\  & Trade Shows and Congresses & 0.00\% & 0.00\% & 0.00\% \\  & Transports & 81.58\% & 0.00\% & 18.42\% \\  & Wholesalesales & 45.18\% & 2.49\% & 52.34\% \\ \hline \multirow{3}{*}{Company Age} & \textless{=}17 & 21.82\% & 4.24\% & 73.94\% \\  & \textgreater{}17 \textless{=}26 & 12.50\% & 2.50\% & 85.00\% \\  & \textgreater{}26 \textless{=}36 & 33.33\% & 5.42\% & 61.25\% \\  & \textgreater{}36 & 10.00\% & 2.86\% & 87.14\% \\ \hline \multirow{3}{*}{Revenue} & \textless{=}2 M & 25.45\% & 6.67\% & 67.88\% \\  & \textgreater{}2 M \textless{=}5.5 M & 26.30\% & 3.70\% & 70.00\% \\ \cline{1-1}  & \textgreater{}5.5 M \textless{=}10 M & 10.00\% & 2.22\% & 87.78\% \\ \cline{1-1}  & \textgreater{}10 M & 11.43\% & 0.95\% & 87.62\% \\ \hline \multirow{3}{*}{Exports as \% of Revenue} & \textless{=}2.5\% & 21.19\% & 5.48\% & 73.33\% \\ \cline{1-1}  & \textgreater{}2.5\% \textless{=}25\% & 19.05\% & 1.43\% & 79.52\% \\ \cline{1-1}  & \textgreater{}25\% \textless{=}60\% & 30.00\% & 6.67\% & 63.33\% \\ \cline{1-1}  & \textgreater{}60\% & 11.67\% & 0.00\% & 88.33\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Type 2—First Audit—Acceptance percentage intervals of the controls in the predefined dimensions. Figures 6 and 7 depict the evolution of conformity for each of the ISO-27001:2013 standard categories and their included controls. The conformity index is classified in three levels, namely [0-50%], [51-75%], and [76-100%]. By analysing the figures, one may note that the green spot widens in all the categories, which is the result of the flaws that were observed in the first auditing and the mitigation measures implemented and re-evaluated in the second auditing. This fact is explanatory of the evolution observed, from the first to the second auditing. The yellow spot, which corresponds to a positive level of conformity