Small and medium-sized businesses (SMBs) often face many of the same cybersecurity challenges as larger organizations, but with fewer resources to manage them. ISC2’s third Peer-Sourced Technical Guidance paper of 2026, Best-Value Cybersecurity for Small and Medium-sized Businesses, explores how SMBs can use their people, tools and controls more effectively to mitigate cyber risk.
The paper takes an unusual view of what is an SMB; where many definitions are based on the number of employees, the authors instead consider an SMB in terms of the organization's ability to resource and fund a cybersecurity function – noting that if you do not have someone whose sole role is cybersecurity, you can probably call yourself an SMB, and so this paper is relevant to you.
What is Best-Value Cybersecurity?
The paper introduces the concept of BVC – Best Value Cybersecurity. It explores the various elements of BVC, under the guiding principle that in an SMB there is no such thing as perfect security, and what matters is how effectively the tools, controls and techniques used mitigate the cyber risk of an organization. There are four key ingredients to BVC, and the paper explores each in turn.
Measuring the effectiveness of cyber controls is cited as a key element of SMB security, with the paper noting that clever controls that are done ineffectively are far less valuable than simple controls implemented and run well. And in the same vein, there is discussion of the trade-off between having many controls of modest effectiveness versus a few controls that are highly effective – something we wrote about some time ago, in fact.
Connecting Cybersecurity to Business Risk
The paper also examines the relationship between cybersecurity technology and business risk. It proposes a sequence of steps SMBs can follow to establish their requirements, identify risks and determine the technologies needed to address them. It then moves on to consider the relative merits of buying cybersecurity technology and services in or building it internally. There is also a case study that will ring true that describes how an organization made a significant improvement to its cybersecurity by looking inwards and deciding to use their existing tools to better effect.
Identity, Security, Cyber Insurance and AI
Another subject the paper touches on is one we have addressed several times in the past: the fact that with the move to cloud and hybrid services, securing the perimeter has given way to securing identity management and authentication.
The paper also considers cyber insurance, including benefits beyond reimbursing the cost of recovering systems following an attack. The members of the workshop in which it was discussed cited very different benefits that they experienced when they had needed to call on their insurers.
Artificial intelligence (AI) also features in the discussion, with an important caveat: AI should augment human judgment, not replace it. And as it begins to wrap up there is a revisit to one of concepts mentioned earlier, namely that reasonableness is better than perfection; in this sense there are a number of views expressed, and examples given, by those with some positive experiences of the attitude taken to how well responses were conducted even when an attacker was able to get in.
The paper wraps up with a short checklist of how SMBs (remember the definition we cited earlier) – can evaluate their organization's capability in the context of Best Value Cybersecurity, which will help identify areas to address in order to work toward a more secure cyber regime.
Guidance Shaped by ISC2 Members
These papers are driven by the ideas and views of ISC2 members, which come through surveys, workshops and direct interaction. The members who provide their views work in a plethora of areas of the industry, for organisations of all types and sizes.
Papers are available only to members. To access them, sign into your ISC2 account, visit the Member Benefits link, and use the Resources filter at the top of the page. Or, go to the Peer-Sourced Guidance Documents page to view this and the collection of other papers in the series.
