Information Security Risk Management in Small Business Enterprises (SMES)

The desire to optimize organizational processes such as planning, control, communication, and collaboration is a significant driver for business enterprises, especially SMEs, to invest in Information Technology (IT). IT investments contribute to improved operational efficiency, financial management, flexibility, and agility, providing a competitive edge in the market. SMEs particularly invest in IT to facilitate new partnerships and collaborations through electronic linkages, enabling them to overcome barriers and enhance business performance. However, IT investments in SMEs face numerous challenges, including insufficient resources, lack of time for implementation, poor IT staff expertise, and inadequate management commitment. Inadequate IT investments often result in Information Security (IS) breaches, leading to significant financial and non-financial losses. Non-financial losses included damage to reputation, product piracy, and theft of critical business information. Effective Information Security Risk Management Investment (ISRMI) is essential for ensuring long-term competitiveness and survival, guiding the selection of security measures to protect IT assets while ensuring data confidentiality, integrity, and availability. However, existing literature lacks guidance on effective ISRMI strategies, focusing primarily on the implementation of ISRM approaches rather than the economics of security investment. This research aimed to explore the ISRMI strategies adopted by SMEs within Nairobi’s Central Business District, based on SMEs that have implemented ISRM programs, through a review of literature and interviews with information security experts.