Minimalistic Cyber Security Framework (MCSF): A Bridge Framework for Small Businesses

Abstract

Small businesses face significant cybersecurity challenges, often lacking the resources, expertise, and awareness required to mitigate risks effectively. This doctoral thesis investigates these challenges and provides practical solutions through the development and validation of the Minimalistic Cyber Security Framework (MCSF).
The research began by evaluating the existing awareness of cybersecurity risks among small business owners. Surveys revealed moderate awareness of basic threats such as phishing and malware, but a critical underestimation of complex risks like ransomware and insider attacks. Subsequently, the study examined common cybersecurity practices, finding heavy reliance on basic protections like antivirus software and firewalls, with minimal adoption of advanced measures such as multi-factor authentication or employee training. Barriers such as limited budgets, lack of technical expertise, and perceptions of low risk emerged as key impediments.
To address these issues, the study explored established cybersecurity frameworks, including the NIST Cybersecurity Framework and ISO/IEC 27001. These frameworks, while comprehensive, proved challenging for small businesses due to their complexity and resource demands. Using grounded theory, a streamlined Minimalistic Cyber Security Framework was developed. This framework focuses on simplicity, modularity, and practicality, enabling small businesses to incrementally strengthen their cybersecurity posture.
Training programs and expert consultations were integral to the study. Tailored training sessions provided hands-on, relatable guidance, significantly improving participants’ awareness and readiness to adopt cybersecurity measures. Personalized consultations ensured the framework could be adapted to individual business needs, fostering independent implementation and sustainability.
This thesis highlights critical gaps in small business cybersecurity and offers actionable, scalable solutions. By emphasizing accessibility and practicality, it paves the way for resource-constrained businesses to achieve robust cybersecurity resilience.