Cybersecurity Guidance For Small And Medium Size Enterprises

Cyber risk management is important for organizations of all kinds and sizes. Small and medium size enterprises are increasingly being targeted by cyber criminals. In November 2016, the U.S. National Institute of Standards and Technology ("NIST") issued an interagency report titled Small Business Information Security: The Fundamentals to provide cyber risk management guidance for small businesses. The Report and similar guidance issued by Canadian and U.S. agencies provide useful advice for organizations of all sizes.

The NIST Report

The Report encourages small businesses to understand and manage risks to their information, systems and networks. The Report explains that information security encompasses people, processes and technologies, and focuses on protecting the confidentiality, integrity and availability of information. The Report notes that an information security program should not be limited to cybersecurity (which relates to the security of information