Navigating the Digital Landscape: Enhancing Small and Medium Business’s Security through Asset Management and Data Classification

Small and Medium Enterprises (SMEs) account for 90% of businesses globally and contribute to 50% employment worldwide. Despite many widely acclaimed cybersecurity standards or frameworks that exist in the industry, SMEs are most vulnerable to cyberattacks and have a high chance of losing their existence if they undergo a successful cyberattack by cybercriminals. SMEs are rapidly adopting latest technologies but don’t have enough resources to implement the cybersecurity controls and therefore are actively targeted by cybercriminals. SMEs often try to manage cyber risk informally or as a reaction to security events or incidents. Both approaches, informal management and reaction-based risk mitigation, lack a structured method and blinds SMEs to actual cyber risk. Actual cyber risk can only be measured once the organization has visibility of all the assets that it aims to protect. This research provides guidance to SMEs on implementing cybersecurity techniques for protection of their assets. This research can help SMEs to follow a methodological approach to find all the assets in the organization, calculate the assets’ values, and subsequently apply protection controls. These techniques can serve as a suitable baseline protection of assets for SMEs and help them comply with potential future Service and Organization Controls 2 (SOC 2) requirements or comply with cybersecurity frameworks such as ISO 27001 and National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). In this paper, we focus on Asset Management and Data Classification.