Security-by-Transformation: A Capability Prioritization Framework for Resource-Constrained SMEs
Main Article Content
Keywords
SMEs, Digital Transformation, Cybersecurity Prioritization, Resource Constraints, Resilience
Abstract
Small and medium-sized enterprises (SMEs) are under growing pressure to digitalize operations, rely on cloud platforms, integrate external partners, and sustain digitally mediated workflows. Yet the pace of digital transformation often exceeds the pace of formal cybersecurity capability development, particularly under conditions of limited budget, staffing, and implementation bandwidth. Existing literature establishes the importance of SME digital transformation, organizational readiness, and cyber resilience, but it offers weaker guidance on how resource-constrained SMEs should sequence cybersecurity capability development as transformation deepens. This paper develops Security-by-Transformation, a bounded, stage-aware, resource-sensitive framework that translates transformation stage, exposure growth, compliance pressure, recovery sensitivity, and dependency concentration into a prioritized cybersecurity capability roadmap. Unlike broader readiness or maturity-oriented treatments that mainly classify preparedness states or describe desirable conditions, the framework is designed to answer a narrower managerial question: which capability domains should be built now, next, and later under SME constraint. The framework offers a context-sensitive sequencing heuristic tailored to uneven transformation conditions. The paper contributes a structured architecture, an explicit sequencing logic, and a compact decision aid to support analytical appraisal and practical prioritization.
References
Fen, L. X., & Ping, T. A. (2024). Cloud Computing Adoption Among Malaysian SMEs Manufacturers: The Role of Relative Advantage, Complexity and Cybersecurity Readiness. 2024 2nd International Conference on Software Engineering and Information Technology (ICoSEIT), 336–341. https://doi.org/10.1109/icoseit60086.2024.10497522
Ghobakhloo, M. (2021). Digital transformation success under Industry 4.0: a strategic guideline for manufacturing SMEs. Journal of Manufacturing Technology Management, 32(8), 1533–1556. https://doi.org/10.1108/jmtm-11-2020-0455
Hanisch, M., Goldsby, C., Fabian, N. E., & Oehmichen, J. (2023). Digital governance: A conceptual framework and research agenda. Journal of Business Research, 162, 113777. https://doi.org/10.1016/j.jbusres.2023.113777
Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design Science in Information Systems Research. MIS Quarterly, 28(1), 75–105. https://doi.org/10.2307/25148625
Islam, M. M., Bhuiyan, M. R. I., Islam, S. H., Tabassum, M. N., & Billah, M. (2026). Unlocking the Mediating and Moderating Role of Information Security in Information Systems: A Combined TAM, ISM, and HBM Model. Human Behavior and Emerging Technologies, 2026(1), 5593002. https://doi.org/10.1155/hbe2/5593002
Karie, N. M., Sahri, N. M., Yang, W., Valli, C., & Kebande, V. R. (2021). A Review of Security Standards and Frameworks for IoT-Based Smart Environments. IEEE Access, 9, 121975–121995. https://doi.org/10.1109/access.2021.3109886
Katsaliaki, K., Galetsi, P., & Kumar, S. (2021). Supply chain disruptions and resilience: a major review and future research agenda. Annals of Operations Research, 319(1), 965–1002. https://doi.org/10.1007/s10479-020-03912-1
Khatun, M., Hossain, R., Bhuiyan, M. R. I., Tabassum, M. N., & Riaj, M. A. (2025). Green Entrepreneurship and Digital Transformation for Sustainable Development: A Systematic Review. In Digitizing Green Entrepreneurship (pp. 153–180). IGI Global Scientific Publishing. https://doi.org/10.4018/979-8-3693-7442-9.ch006
Khurana, I. (2022). SMEs and digital transformation during a crisis: The emergence of resilience as a second-order dynamic capability in an entrepreneurial ecosystem. Journal of Business Research, 150, 623–641. https://doi.org/10.1016/j.jbusres.2022.06.048
Kirmizi, M., & Kocaoglu, B. (2022). Digital transformation maturity model development framework based on design science: case studies in manufacturing industry. Journal of Manufacturing Technology Management, 33(7), 1319–1346. https://doi.org/10.1108/jmtm-11-2021-0476
Klein, V. B., & Todesco, J. L. (2021). COVID-19 crisis and SMEs responses: The role of digital transformation. Knowledge and Process Management, 28(2), 117–133. https://doi.org/10.1002/kpm.1660
Li, L. (2022). Reskilling and Upskilling the Future-ready Workforce for Industry 4.0 and Beyond. Information Systems Frontiers, 26(5), 1697–1712. https://doi.org/10.1007/s10796-022-10308-y
Loo, M. K., Ramachandran, S., & Yusof, R. N. R. (2024). Systematic Review of Factors and Barriers Influencing E-Commerce Adoption among SMEs over the Last Decade: A TOE Framework Perspective. Journal of the Knowledge Economy, 16(2), 9624–9648. https://doi.org/10.1007/s13132-024-02257-5
Mäkká, K., & Kampová, K. (2024). Cyber Security and Business Continuity Management: Ensuring Resilience in a Digital World. Challenges to National Defence in Contemporary Geopolitical Situation, 1(1). https://doi.org/10.3849/cndcgs.2024.326
Molla, C., Bhuiyan, M. R. I., Islam, M. T., & Amin, A. (2026). Mediating role to banking performance for adopting digital bank using a technology organizational environment model. Digital Finance, 8(1), 4. https://doi.org/10.1007/s42521-025-00168-x
Omrani, N., Rejeb, N., Maalaoui, A., Dabic, M., & Kraus, S. (2022). Drivers of digital transformation in SMEs. IEEE Transactions on Engineering Management, 71, 5030–5043. https://doi.org/10.1109/tem.2022.3215727
Peffers, K., Tuunanen, T., Rothenberger, M. A., & Chatterjee, S. (2007). A Design Science Research Methodology for Information Systems Research. Journal of Management Information Systems, 24(3), 45–77. https://doi.org/10.2753/mis0742-1222240302
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207
Saeed, S., Suayyid, S. A., Al-Ghamdi, M. S., Al-Muhaisen, H., & Almuhaideb, A. M. (2023a). A Systematic Literature Review on Cyber Threat Intelligence for Organizational Cybersecurity Resilience. Sensors, 23(16), 7273. https://doi.org/10.3390/s23167273
Saeed, S., Altamimi, S. A., Alkayyal, N. A., Alshehri, E., & Alabbad, D. A. (2023b). Digital transformation and cybersecurity challenges for businesses resilience: Issues and recommendations. Sensors, 23(15), 6666. https://doi.org/10.3390/s23156666
Skare, M. (2023). Digital transformation and European small and medium enterprises (SMEs): A comparative study using digital economy and society index data. International Journal of Information Management, 68, 102594. https://doi.org/10.1016/j.ijinfomgt.2022.102594
Soluk, J. (2021). Digital transformation in family-owned Mittelstand firms: A dynamic capabilities perspective. European Journal of Information Systems, 30(6), 676–711. https://doi.org/10.1080/0960085x.2020.1857666
Teng, X., Wu, Z., & Yang, F. (2022). Research on the Relationship between Digital Transformation and Performance of SMEs. Sustainability, 14(10), 6012. https://doi.org/10.3390/su14106012
Troise, C. (2022). How can SMEs successfully navigate VUCA environment: The role of agility in the digital transformation era. Technological Forecasting and Social Change, 174, 121227. https://doi.org/10.1016/j.techfore.2021.121227
Zighan, S. (2024). Navigating the Cyber Landscape: A Framework for Transitioning from Business Continuity to Digital Resilience. 2024 2nd International Conference on Cyber Resilience (ICCR), pp. 01–06. https://doi.org/10.1109/iccr61006.2024.10532999
Article Sidebar
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Copyright Telecommunications Association Inc.
Tran Duc Le, University of Wisconsin-Stout Polytechnic, Menomonie, WI, USA
let@uwstout.edu
Truong Duy Dinh, Posts and Telecommunications Institute of Technology, Hanoi, Viet Nam
duydt@ptit.edu.vn
How to Cite
