## 6 Future Works  
In order to empower SMEs with cybersecurity resilience, this study recommends an improvement on the existing ROHAN model that builds upon the original concept while addressing the specific needs and challenges faced by SMEs. It prioritizes a risk-based approach and emphasizes affordable solutions and employee education. Figure 19: SME recommendations (Author’s vision). The new ROHAN model uses the following core principles to integrate risk-based approaches focusing on identifying and prioritizing cybersecurity threats relevant to the SME's industry, size, and data sensitivity. This aligns with research highlighting the importance of understanding SME-specific needs. It also highlights an employee-centric that integrates a new framework called the Cyber Guardian Framework (CGF) to cultivate a culture of cybersecurity ownership among employees through engaging and accessible training. This directly incorporates research on effective training strategies for non-technical audiences. The new model also highlights cost-consciousness that prioritizes cost-effective solutions based on identified risks. Activities include utilizing free or low-cost resources like government initiatives and open-source tools, reflecting the resource limitations of SMEs. This holistic approach integrates cybersecurity across all functions (IT, HR, Finance) while considering resource constraints. It encourages the exploration of collaboration with industry partners for knowledge sharing and leveraging affordable tools. The new ROHAN model components will now consist of the following:  
**R--Readiness (Risk-Based):**  
Assess cybersecurity risks through vulnerability scans and risk assessments. Being able to identify critical assets and data requiring protection. Being able to develop a cybersecurity policy outlining acceptable behavior and incident response protocols. **O--Ongoing Awareness (Employee-Centric):**  
Implement a Cyber Guardian-inspired training program for employee education. Being able to conduct regular phishing simulations to test awareness and preparedness. Being able to also foster a culture of cyber vigilance by encouraging employees to report suspicious activities. **H--Holistic Approach:**  
Integrate cybersecurity measures across all business functions. To explore collaboration with industry partners for knowledge sharing. To be able to consider partnering with cybersecurity service providers for ongoing monitoring and support (optional). **A--Affordability (Cost-Conscious):**  
Utilize free or low-cost cybersecurity resources. Being able to prioritize training and implement affordable solutions based on identified risks. Be able to explore cost-sharing options with industry partners or government programs. **N--Network Security (Assessment):**  
Implement basic network security measures like firewalls and strong authentication protocols. Being able to conduct regular software updates and vulnerability assessments/penetration testing. This combines aspects of assessment and network security from the original model, emphasizing ongoing evaluation. By adapting the original ROHAN model and incorporating research on SME cybersecurity awareness, the new ROHAN model offers a more practical and effective framework for SMEs to build robust cybersecurity strategies. It empowers employees, prioritizes affordability, and ensures a holistic approach tailored to the specific needs of smaller organizations. The framework that complements the enhanced ROHAN model is future research in SME cybersecurity awareness training through the exploration of the development and implementation of the CGF. This framework addresses the limitations of existing models by prioritizing accessibility, microlearning, gamification, and actionable steps. Designed for non-technical users, the CGF utilizes clear language, engaging visuals, and bite-sized learning modules to fit busy schedules.