Cyber Resilience Key Metrics in Small and Medium-Sized Enterprises

Introduction. Cyber security is a dynamic, human-made environment where information, processes, and technologies converge, making cyber resilience essential for sustainable economic development. Cyber security incidents impede national security, economic stability, and digital transformation, underscoring the need to strengthen cyber capacity globally, especially among small and medium enterprises (SMEs), where each participant’s responsibility is essential in the cyber security landscape. Cyber security, being transdisciplinary, necessitates effectively managing the risks, compliance, and socioeconomic impact of cyber security incidents. Aim and tasks. This study introduces a cyber resilience metrics framework that consolidates security controls by functional areas, aligns them with incident lifecycle stages, and clarifies the purpose and tasks of each stage. Results. This study offers an approach for implementing and validating a comprehensive set of cyber security measures, emphasising continuous testing and proactive updates. The cyber resilience metrics framework makes compliance in the evolving cyber security landscape mandatory using a reliability assessment based on Cronbach’s alpha, which measures internal consistency reliability and the credibility of the item set. Frameworks confirm a significant correlation observed in the process of resolving cyber incidents, which means that the more accurate the information acquisition (based on metrics data), the less time is required to resolve the overall incident. Expert validation confirmed that these metrics promote compliance, competitiveness, and effective risk mitigation within a cost-effective framework. The cyber security exercise was conducted in five stages. Cyber simulation exercises and analytical hierarchy processes (AHP) are interconnected as they use a hands-on approach to the hierarchical analysis of cyber security requirements as critical elements. Conclusions. This study identified key areas of cyber resilience based on the protection of critical infrastructure and the financial sector, using both regular testing of business continuity plans and assessments of cyber capabilities. Experimental studies adopt quantitative and qualitative data to create reliable metrics and frameworks for enhancing SMEs' cyber resilience. Thus, using the optimal cyber resilience metric framework and experiment, cyber resilience metrics can help identify organisational weaknesses in decision-making and resolve cyber incidents.