Study: Outdated IT, Lack of Policies Define SMEs Taking First Steps in Cybersecurity

Study: Outdated IT, Lack of Policies Define SMEs Taking First Steps in Cybersecurity
Photo: Seiko Kuik

A lack of systemic approach to identifying and fixing vulnerabilities, outdated IT-systems, the absence of risk assessments, security policies, and dedicated security personnel were among the most common challenges found at small and medium sized enterprises (SMEs) who are taking the first steps in cybersecurity, according to a study commissioned by RIA, co-funded by the European Commission and the ECCC, and conducted by PricewaterhouseCoopers in collaboration with Tallinn University of Technology. The study analyzed findings from cybersecurity assessments (“Roadmaps”) created through the Cyber Transformation grants initiative. 

The Cyber Transformation grants initiative was a 1,5 year pilot program intended to boost the uptake of cybersecurity services among SMEs. RIA and the Estonian Business and Innovation Agency distributed grants of up to €10 000 for the procurement of cybersecurity assessment services, provided that they use a common RIA Cyber Transformation Roadmap methodology. After receiving a Roadmap, the SMEs could apply for another grant of up to €50 000 to implement the recommendations. A total of 62 SMEs received grants through the program. 

Unified methodology contributed to the development of the market

The study demonstrates that the Cyber Transformation grants initiative reached SMEs whose cybersecurity level was relatively low and who needed to take the first and most significant steps to enhance their posture. The study concludes that the Cyber Transformation grants initiative and methodology is therefore “an excellent tool that allows SMEs to draw greater attention to cybersecurity with the support of a service provider and identify deficiencies, the resolution of which can significantly enhance the company's cybersecurity level with relatively modest resources and simple actions.”