Cyber Resilience in SMEs: A Decade of Research, Insights, and Gaps
Purpose:
This paper examines thematic emphases in information security, cybersecurity and cyber resilience in small and medium-sized enterprises (SMEs) from 2015 to 2025 and assesses the representation of National Institute of Standards and Technology [NIST] Cybersecurity Framework functions and Enterprise Architecture domains.
Design/Methods/Approach:
A systematic literature review was conducted using the Scopus and Web of Science databases. The final sample comprised 97 scientific articles. The analysis covered keywords, NIST functions, primary Enterprise Architecture domains, and the practical validation of models and frameworks in primary research articles.
Findings:
The analysis across time periods identifies different thematic emphases, including standards, risk management, information security, cyber resilience, digital transformation, human factors and advanced technologies. The most frequently represented functions are Govern (86), Identify (60) and Protect (59), while Detect (38), Respond (37) and Recover (34) receive less attention. Business Architecture dominates with 77 articles, followed by Technology Architecture (11), Application Architecture (6) and Data Architecture (3). Practical validation was identified in 14 of the 87 primary research articles included in this analysis.
Research Limitations / Implications:
The review is limited to English-language scientific articles indexed in the selected databases and published within the defined period. The analysis records the presence of functions but does not assess the depth of coverage or the methodological quality of individual studies.
Practical Implications:
The findings support the development of balanced, modular and practically feasible cyber-resilience models adapted to SME constraints.
Originality/Value:
The paper combines analysis of thematic emphases across time periods with mapping across NIST functions, Enterprise Architecture domains and practical validation, providing researchers and practitioners with a structured overview of major research gaps.
UDC: 005.934:004.056
Keywords: small and medium-sized enterprises (SMEs), cyber resilience, information security and cybersecurity, NIST Cybersecurity Framework, Enterprise Architecture, systematic literature review