Proportionate defense: a NIST‑aligned cyber risk scoring model for resource-constrained enterprises

Small and medium enterprises (SMEs) often need to prioritize cyber risk with limited staff, data and assessment capacity. The Common Vulnerability Scoring System (CVSS) scores vulnerability severity, Factor Analysis of Information Risk (FAIR) depends on loss-frequency and loss-magnitude inputs and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) Controls do not prescribe a compact SME-specific organizational score. We propose the Proportionate Defense Scoring Model (MPDS), which combines a NIST-aligned base score with a binary Critical Failure Constraint (Ω) and a multiplicative Shadow IT Decay Function (Ψ). We evaluate its scoring behavior on 1,000 synthetic SME profiles using a paired CIS Implementation Group 1 (IG1)-style additive baseline, component ablations, sensitivity analysis and scenario-based stress tests. The additive baseline has a mean score of 65.25, compared with 44.06 for MPDS; 766 profiles change rating band, and 107 profiles with additive scores of at least 70 fall below 50 under the full model. Component ablations show that Ω produces the zero-score cases when survival-critical requirements fail, while Ψ accounts for the full-model reduction whenever Ω=1. These results show how the two mechanisms alter score magnitude, ranking and rating under the synthetic assumptions. They do not establish real-world breach prediction or empirical superiority over CIS IG1. The main contribution is a formal scoring architecture that makes survival-critical failures and unmanaged Software-as-a-Service (SaaS) exposure explicit in resource-constrained SME risk prioritization.