# Despite for SMEs: A Systematic Review of Socio-Technical Cybersecurity Metrics
## 5 Socio-Technical Cybersecurity Framework for SMEs

Table 10: Socio-technical cybersecurity framework for SMEs. Our results relating to the various ADKAR dimensions serve as input for the \"People\" and \"Culture\" aspects. Start-ups and digitally-dependent SMEs should focus on making their employees aware and providing initial cybersecurity knowledge to inspire desire and motivation. This can be achieved through a culture of organisational commitment to cybersecurity [93; 94]. Digitally-based SMEs and digital enablers should progress through the ADKAR phases, with the aid of cybersecurity training, policy, and assessment. Eventually, employees should mutually reinforce each other's cybersecurity abilities [94]. The ideal cybersecurity culture will lead to trust from both the people inside the SME and the environment outside of the SME [92; 94]. Start-ups and digitally-dependent SMEs are often not aware of the existence of cybersecurity standards [14]. These SMEs should first become aware and then begin to formulate basic cybersecurity policies, processes, and procedures [5; 94]. Digitally-based SMEs should have formal processes in place to reinforce the desired cybersecurity behaviour of employees [5]. Digital enabler SMEs should strive towards continuous process improvement [5; 15], which enables business continuity [92]. We mapped the \"Technology\" aspect of STS to the advised cybersecurity assessment approach and tooling for the SME. This is in line with the approach of [PERSON] et al. [5], who incorporated \"cybersecurity tools and resources\" in the \"Technology\" aspect of their socio-technical cybersecurity framework. Start-ups should understand relevant cybersecurity asset types and digitally-dependent SMEs should begin identifying and documenting assets [92]. Without an asset inventory or internal cybersecurity expertise, most risk assessment and maturity model approaches are not suited to these SMEs. Additionally, they are just beginning to cultivate a desire among employees to improve cybersecurity. Incorporating the real-life threat environment [22] is an attractive option to promote motivation. Focusing on the real-life threat environment can increase the feelings of task relevance and significance employees feel, which are key motivators [97]. This is why we advise a threat-based cybersecurity risk assessment approach for start-ups and digitally-dependent SMEs. In the same vein, we advise to not aggregate scores in cybersecurity assessment solutions for start-ups and digitally-dependent SMEs. If aggregation is deemed necessary, injective and idempotent aggregation strategies should be used, such as WLC and WM. Strategies that satisfy injectivity and idempotence can be seen as intuitive. Using these strategies allows for feelings of competence and relatedness among employees, which stimulate motivation [25]. This puts employees in a position to be a part of the solution to SME cybersecurity challenges, rather than being the source of the challenges [98]. The combination of simple aggregation and a threat-based approach offers another benefit: the corresponding assessments do not necessarily require extensive internal expertise and data. Many of the more complex aggregation strategies and comprehensive assessment approaches require cybersecurity experts at the SME to determine parameters and weights. Such resources are limited at SMEs [3], and especially at start-ups and digitally-dependent SMEs. This is why assessment approaches for these SMEs should preferably be largely based on data that can be automatically collected. Threat-based approaches are ideally suited to this requirement, as general incident data are widely available [99], and can be mapped to threats to offer SMEs insight into what is important for them [100]. Digitally-based SMEs and digital enablers can be expected to have a complete inventory of assets [92]. Digital enablers should additionally be aware of internal and external dependencies [92], allowing them to specify their attack surface [101]. For these SME categories, complete risk and maturity assessments are desirable.