Cybersecurity is a topic of interest for most enterprises, regardless of their size. Cybercrime and cyberwarfare are not restricted to large, multinational enterprises. Increasing numbers of small and medium-sized enterprises (SMEs) are being targeted. In an SME context, information security and cybersecurity are often difficult to implement in a satisfactory and cost-effective manner. SMEs need hands-on guidance for affordable and effective cybersecurity. ISACA’s Cybersecurity Guidance for Small and Medium-sized Enterprises and this Implementing Cybersecurity Guidance for Small and Medium-sized Enterprises are designed to meet the needs of typical SMEs: reasonable security at affordable cost. These publications help SMEs to prepare for, and manage, typical cybersecurity issues, risk and threats.
This implementation publication provides practical advice on how to implement cybersecurity governance, risk management, assurance and compliance using Cybersecurity Guidance for Small and Medium-sized Enterprises and its COBIT 5 foundation. SMEs do not need to apply to the full extent the recommendations in this publication. Examples and cases give SMEs insights into implementing the standard. However, the implementation guidance should not be read as prescriptive.