Our Strategic Vision.

Elevating Global Cyber Maturity via Small and Medium-Sized Business (SMB) Uplift

SCAP

With SMBs making up over 90% of global economies, their cyber maturity is crucial to economic resilience.

With small and medium sized businesses (SMBs) constituting more than 90% of most global economies, the cyber maturity of these businesses determines the resilience of a nation’s economy. Many leading developed nations around the world recognize the criticality of uplifting cybersecurity of small and medium businesses.

This is evidenced in the policy and support efforts of leading developed nations. For example, the US National Institute of Standards and Technology’s Small Business Cybersecurity Corner, Singapore’s ongoing SME Go Digital program that includes cybersecurity solutions, and the European Union Agency for Cybersecurity’s guidance.

This white paper captures Dynamic Standards International (DSI)’s strategy to leverage a government-backed, industry-led whole-of-country solution to the SMB cybersecurity uplift challenge. We studied lessons from existing approaches, and distilled a list of nine elements which will catalyze global uplift of the SMB sector:

1. SMBs can easily implement the guidance.
2. IT providers can support and deliver for their SMB customers.
3. A solution that aligns with common cybersecurity frameworks.
4. A solution comprising of multiple levels to enable progressive maturity uplift.
5. A solution that incorporates essential risk management activities appropriate for SMBs.
6. A solution that can be used for certification so that SMBs can articulate their cyber maturity.
7. A solution that is cost affordable for SMBs.
8. A solution that requires director involvement e.g. director attestation.
9. A solution which is regularly updated to the latest cyber threat landscape.

When these nine elements are addressed, DSI’s hypothesis is that a nation will uplift SMB cyber maturity at scale, at minimal cost to the government and the SMBs. DSI’s five-level SMB1001 ‘Multi-tiered cybersecurity certification standard for small and medium-sized businesses’ (SMB1001) serves as the taxonomy for SMBs, governments and large enterprises to communicate at a common easy-to-understand language. Through examples and use cases, the document also explains how DSI’s approach leverages procurement processes to facilitate natural widespread adoption and incentivization of SMB cyber investment, without needing to legislate director responsibilities.

DSI’s approach leverages the natural flow of day-to-day economics. For example, with SMB1001’s levels clearly defined and refreshed annually by industry experts, buyer organizations will now be able to request for non-sensitive suppliers to be at SMB1001 Level 1 while their sensitive suppliers are requested to be certified against Level 3 and above. Since Level 1 certification only starts at USD95, suppliers to these buyer organizations will be able to kickstart their cyber maturity journey. When this is executed at scale across supply chains, the possibility of uplifting the cyber resilience of economies is definitely achievable.

Table of Contents

1. Introduction

In the wake of increasing cybersecurity challenges and threats, we recognize the pivotal role of small and medium-sized businesses (SMBs) as the backbone and powerhouse for global cyber maturity, we propose a pragmatic transformative strategy that facilitates nationwide delivery.

Supply chain cyber risk management is a key concern in business ecosystems. In essence, supply chain cyber risk management recognizes that if one business in a supply chain suffers a cyber incident, it may have repercussions for the remainder of the supply chain. For instance, the 2013 Target data breach where attackers compromised Fazio Mechanical, a third-party contractor, allowing attackers to infiltrate and install malware on Target’s point of sales systems [5]. The financial impact of this attack was severe with an estimated cost of over USD$202 million [9], More recently, the SolarWinds attack in 2020 gained access to the systems and data of SolarWinds’ customers exposing the customers [8]. It is then critical that supply chain cyber risk is managed to avoid having business data and systems exposed because of a supplier’s vulnerabilities. Effective supply chain cyber risk management will require the cybersecurity of the entire supply chain. There also needs to be trust between the parties in the supply chain that other parties have implemented suitable controls. Further, securing the supply chain is not limited to the larger businesses but should extend to include all business, e.g. SMBs.

The importance of small to medium-sized businesses is also recognized by governments globally with the resilience of these businesses becoming a focus for cybersecurity. For instance, the 46th U.S. President Joe Biden [4] noted that “small businesses are the engines of our economic progress”.

Implementing cybersecurity is then critical for SMBs for the cybersecurity of business ecosystems. However, SMBs are not frequent implementors of mature cybersecurity despite the frequency of cyber incidents experienced. According to the UK Cybersecurity Breaches Survey [14], 47% of surveyed micro businesses and 58% of surveyed small businesses had suffered an incident in the past 12 months.

The lagging cybersecurity maturity of SMBs despite their importance in supply chains and the frequency of cyber incidents experienced may be caused by the cost of cybersecurity, the lack of realizable economic incentive and the limited availability of clear implementable guidance. It is then a priority to uplift global SMB cybersecurity through uplifting nationwide SMB cybersecurity. However, while many nations recognize and have attempted nationwide SMB cybersecurity uplift, to the best of our knowledge, there has not been a scheme which has received widespread adoption by SMBs.

To address this lagging maturity, we suggest that a scheme is needed to change how cybersecurity is presented to SMBs. We propose that market forces need to be leveraged to ensure SMBs act i.e. through procurement-driven or legislative requirements.

In this white paper, we present DSI’s pragmatic transformative strategy that facilitates nationwide delivery and uplift of SMB cybersecurity. We also contextualize DSI’s strategy by reflecting on the lessons learned from existing schemes and clarifying the characteristics of an effective scheme or solution.