Published Online:December 2025
Product Name:The IUP Journal of Information Technology
Product Type:Article
Product Code:IJIT011225
DOI:10.71329/IUPJIT/2025.21.4.7-18
Author Name:Hermano J De Queiroz, Shalom Charles Malka and Sanket Sahoo
Availability:YES
Subject/Domain:Engineering
Download Format:PDF
Pages:7-18
Small businesses constitute over 90% of enterprises globally, yet remain disproportionately vulnerable to cyber threats due to resource constraints, limited expertise, and cognitive biases regarding risk. This paper addresses the paucity of cybersecurity research focused specifically on small businesses by conducting a systematic review of empirical literature. Searching the semantic scholar corpus and applying rigorous inclusion criteria, the study identified 10 studies examining small business cybersecurity practices. Thematic analysis, guided by technology organization-environment (TOE) framework and risk homeostasis theory (RHT), revealed three interdependent pillars distinguishing robust from weak cybersecurity approaches: organizational culture, risk management strategy, and technology adoption. Integrating these theoretical perspectives, the study developed the integrated cybersecurity resilience framework (ICRF), a practical, evidence-based model designed for resource-constrained implementation. The framework includes a phased 12-month roadmap, barriers-drivers matrix for strategic positioning, and curated free-to-low-cost tools. The study contributes theoretically by synthesizing TOE and RHT in the small business cybersecurity context and practically by providing actionable guidance tailored to small business realities.
Small businesses are vital economic engines, representing over 90% of all enterprises, employing 65% of the global workforce, and generating 55% of worldwide GDP (Malka, 2025). In the US alone, approximately 31 million small businesses comprise over 99% of all firms, account for nearly 50% of private sector employment, and drive 44% of economic activity (US Small Business Administration (SBA), 2024).