Organizational Characteristics Influencing SME Information Security Maturity

Abstract

In the current business environment, many organizations use popular standards such as the ISO 27000x series, COBIT, and related frameworks to protect themselves against security incidents. However, these standards and frameworks are overly complicated for small to medium-sized enterprises, leaving these organizations with no easy to understand toolkit to address their security needs. This research builds upon the recent Information Security Focus Area Maturity (ISFAM) model for SME information security as a cornerstone in the development of an assessment tool for tailormade, fast, and easy-to-use information security advice for SMEs. By performing an extensive literature review and evaluating the results with security experts, we propose the Characterizing Organizations' Information Security for SMEs (CHOISS) model to relate measurable organizational characteristics in four categories through 47 parameters to help SMEs distinguish and prioritize which risks to mitigate.

An analytics approach to adaptive maturity models using organizational characteristics

“…Broad distributions from the participant responses could be showing that the focus areas in the ISFAM are too broadly scoped. This research, and the investigations by Mijnhardt et al (2014) do not account for this. Another aspect not analyzed in this investigation is the co-influence of organizational characteristics.…”

“…In earlier published work (Mijnhardt et al 2014), organizational characteristics were derived that pertain to SME information security. The research described in this paper follows up on those previous efforts by further evaluating the organizational characteristics and their measurement levels, and how they pertain to the ISFAM maturity matrix through a survey.…”

“…These organizational characteristics provide the possibility to distinguish between a wide variety of different organizations measured in both internal as external factors. Mijnhardt et al (2014) structure the organizational characteristics in themes. These themes are derived from the literature and the interviews, but are not statistical constructs.…”

“…A previous investigation by Mijnhardt et al (2014) researched the organizational characteristics in SME information security. Through a literature study and an evaluation with domain-experts, a coherent list of organizational characteristics is delivered.…”

“…However, (Mijnhardt et al 2014) did not investigate the relation that the identified organizational characteristics have to the ISFAM, or the influence these organizational characteristics have on information security in a quantitative measure. This research attempts to deploy these organizational characteristics on the ISFAM, and understand the influence the organizational characteristics have on focus areas within the ISFAM.…”