How cybersecurity governance frameworks help small and medium enterprises identify, assess, and manage risks, and why the most impacted businesses in Australia are often the ones with the least protection.
Marco Cavani
Cybersecurity Analyst
Governance provides Small-Medium Size enterprises (SMEs) with a framework to establish clear lines of accountability and responsibility for cybersecurity. It also enables SMEs to comply with legal requirements and manage cybersecurity risks.
According to a report by the National Institute of Standards and Technology (NIST), cybersecurity governance frameworks help SMEs identify, assess, and manage cybersecurity risks effectively (NIST, 2018). The structure of a cyber-security framework for an SME can cover different layers of security such as processes and policies that comply with standards, regulations, network security and asset protection (Emer et al., 2021).
According to the Australian Cyber Security Centre (ACSC) and the Australian Signals Directorate (ASD) (2022), the most impacted businesses within Australia during the 2021–22 financial year were medium enterprises who tend to be less vigilant compared to larger corporations.
According to the NIST case study on Small Enterprises (Hotel CEO Finds Unwelcome Guests in Email Account, n.d.), we can determine that small businesses can avoid risks that can potentially cause harm by embracing cybersecurity.
In conclusion, governance is important for medium and small enterprises as it could potentially save businesses from possible disasters, providing guidance on how to protect, mitigate, or recover from cyber attacks.
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
An in-depth analysis of why information security is vital for critical infrastructure operators, covering CIA triad principles, classification frameworks, and the real-world consequences of cyber disruptions.
In critical infrastructure a network breach is not a data problem, it is a physical one. Here is why segmentation is the control that keeps a compromised laptop away from a turbine, and why the VPN meant to protect the network is so often the way in.
A strategic deep-dive into NIST's Computer Security Incident Handling Guide, covering the full IR lifecycle, team structure, detection methods, prioritisation frameworks, and the power of post-incident learning.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
