A Comprehensive Review of Information Security Research regarding SMEs and Future Directions

Information security is a critical concern for small and medium-sized enterprises (SMEs) in today’s world. The increasing number of security incidents and their growing complexity and sophistication pose a serious threat to SMEs. They need to be able to understand information security risks and rely on tailored solutions and frameworks to establish an appropriate information security posture. In order to provide targeted assistance to these organisations in their security efforts, it is important to identify the areas of research that have already been considered in this context and highlight important avenues for future research open to the academic community. To address this challenge, the research objective of this publication is to provide a fundamental overview of the existing research in SME information security and the future work that is yet to be done. In doing so, we aim to establish a baseline to guide future research in this area. We pursued this research objective by conducting a multi-vocal, systematic literature review within seven scientific databases and further consider grey literature on the topic. A total of 112 scientific publications and 16 grey literature sources were clustered to provide an adequate overview of existing research in SME information security. Furthermore, the publications have been reviewed for their implications for future directions of research. In doing so, we have provided an overview of research in the field of SME information security and provided the academic community with open research gaps to consider for future research efforts.