An End-To-End Cyber Security Maturity Model For Technology Startups

Cybersecurity is increasingly becoming an important discussion topic in the boardroom of companies, regardless of the size or industry. Hackers nowadays are becoming increasingly smart. Instead of attacking big multi-national companies, international banks and government organisations which have built strong protection against cyber threats, the perpetrators now placed their focus on smaller and medium size businesses like technology start-ups through a variety of attacks from phishing, ransomware to the exploitation of vulnerabilities in the web or mobile applications. Therefore, it is imperative that technology start-ups have the capability in assessing their cyber security maturity to combat against cyber threats. However, for technology start-ups, it is especially imperative as cyber-attacks or data breaches could undeniably result in the loss of customers’ confidence, regulatory implications and revenue loss which could eventually result in the start-up untimely closure. Although there are available security frameworks commonly used in the industry by cyber security practitioners, these frameworks are not suitable for technology start-ups as they tend to be broad and generic, taking a long time to conduct the assessment requiring adequate manpower or even the need for a budget to hire external consultants to help in conducting the assessment. This study seeks to analyse the current cyber security frameworks and introduce an end-to-end Cyber Security Maturity Model, which can be used specifically for technology start-ups. The proposed model not only provides an end-to-end maturity assessment of the start-up’s cyber security posture but also coupled with an existing quantification model to justify the investments allocated in implementing cyber security measures for the start-up. Right-sizing the cyber security measures for the start-up in the different stages of the start-up lifecycle could allow reasonable controls to be implemented at the appropriate phase.