## 2 Literature Review  
Numerous studies have highlighted the importance of cybersecurity awareness in SMEs and the broader impact of cybersecurity practices on organizational resilience. For instance, [PERSON] (2023) explored the relationship between cybersecurity training and the reduction of cyber incidents in SMEs, finding a significant decrease in successful attacks following the implementation of targeted training programs [4]. Similarly, a study by [PERSON] (2022) emphasized the role of continuous education and awareness in maintaining a robust cybersecurity posture within small businesses [5]. Complementing these findings, [PERSON], [PERSON], and [PERSON] (2024) examined the effectiveness of government-led cybersecurity initiatives aimed at SMEs, noting that while these programs are beneficial, their reach and impact are often limited by the SMEs' resource constraints and varying levels of engagement [6]. In another relevant study, [PERSON] (2024) investigated the barriers to cybersecurity adoption in SMEs, identifying cost, complexity, and a lack of perceived relevance as the primary obstacles [7]. A survey conducted by the National Cyber Security Alliance (2020) revealed that a significant percentage of SMEs do not prioritize cybersecurity due to a lack of understanding of the risks involved [8]. This aligns with the findings of [PERSON] (2019), who noted that many SME owners underestimate the potential impact of cyber-attacks on their business operations [9]. Building upon research by [PERSON] (2023) [3], which highlighted the need for improved cybersecurity awareness among Welsh SMEs, initiatives like \"The Golden Hub\" offer a promising solution. The theoretical framework of the Golden Hub aims to empower SMEs in Wales to achieve a state of \"Cyber Awareness\" and implement effective cybersecurity measures, as shown in Figure 1.  
Welsh SMEs can participate in a program that assesses their current level of cybersecurity awareness and preparedness. This assessment culminates in a rating on a scale, potentially ranging from \"Cyber Red\" (low awareness and inadequate measures) to \"Cyber Green\" (high awareness and robust security measures). Upon achieving a \"Cyber Green\" rating, SMEs can display a certificate or badge to showcase their commitment to cybersecurity, potentially fostering trust with customers, as shown in Figure 2.  
The Golden Hub, as shown in Figure 2, serves as a central resource for SMEs on their journey towards cybersecurity awareness. They offer guidance, support, and a series of assessments to help SMEs improve their cyber posture theoretically. By achieving a positive rating, SMEs can not only enhance their cyber resilience but also potentially benefit from being included in the Welsh Government's Cyber Action Plan for 2023. The ROHAN model from this research offers a theoretical framework for measuring cyber resilience and serves as an internal guidance system that is documented. The model offers a holistic approach to cyber hygiene and cyber resilience, specifically designed to support Welsh SMEs. By following the step-by-step approach outlined in the ROHAN model, SMEs can proactively prepare their businesses for cyberattacks. The model empowers them to develop internal  
Figure 1: Cybersecurity technical framework. processes for handling such situations, fostering a more secure digital environment as described in Figure 3.  
The ROHAN model offers a step-by-step approach for Welsh SMEs to achieve \"Cyber Aware\" status. In its current state, it encompasses five key aspects:  
* Risk Identification: SMEs learn to identify cyber risks within their business model. This results in a customized risk checklist aligned with governance and compliance policies. This step also helps develop a simplified and cost-effective path to achieve compliance. * Ownership: This step collaborates with SMEs' supply chains to identify \"fit-for-purpose\" and affordable intelligent software solutions, empowering SMEs to take ownership of their cyber risk and technology.