![](bg2.png)
SMEs capabilities (ENISA, 2015).
• The European Digital SME Alliance fosters the
SME ecosystem by developing a “EU trusted so-
lution” label that would stress European qualities
like data protection and high security standards.
It would also accelerate the development process
across the ecosystem and act as a differentiator es-
pecially to increase the international visibility of
European SMEs (Digital SME Alliance, 2017).
• The European Commission is investigating the
possibility of creating a framework for certifi-
cation of relevant ICT products and services.
It would be complemented by a voluntary and
lightweight labelling scheme for the security of
ICT products (EU, 2016).
• To improve the protection of personal data, the EU
has issued a new General Data Protection Regula-
tion (GDPR). (EU, 2016). It will be enforced in
May 2018 and comes at the price of a strict data
protection compliance regime with severe penal-
ties. Demonstrating cybersecurity maturity will
thus be part of measures to avoid data breaches.
While the idea of some form of labelling is clearly in
the air, the following caveats should be avoided, as
stressed by Digital Europe (Alex Whalen, 2017):
• As cyber security has no border, EU should take
into account the existing international ecosystem.
• A new EU certification scheme cannot be the
unique answer in a complex cyberspace.
• False sense of security possibly induced by la-
belling should be complemented e.g. by bench-
marking of security practices
• Avoid rigid and costly schemes: the approach
should be affordable by SMEs and allow some
form of voluntary and agile self-certification.
As many other countries, the need to better sup-
port SMEs has also triggered an initiative to define
and deploy a cyber security labelling scheme oper-
ated by a network of third party expert companies,
supported by specific public funding (e.g. cyber se-
curity vouchers). As highlighted above, such a work
should not be done in isolation but as much as pos-
sible aligned with strategic directions. It should also
rely on similar existing or on-going work carried out
in other countries having progressed on this topic.
The aim of this position paper is therefore to out-
line the main directions to build a realistic cyber secu-
rity labelling approach addressing the needs of SMEs.
Its overall goals should include raising awareness and
helping them reach a first level of assurance and matu-
rity. The process followed was to perform an in-depth
review of existing frameworks and emerging national
labels. Those were ranked against a number of re-
quired criteria for their adoption by SMEs. We also
collected existing feedback, especially about specific
barriers reported to deploy a specific approach.
This paper is structured as follows. Section 2 iden-
tifies relevant constraints and needs SMEs have to
face when dealing with cyber security. Section 3 gives
an overview of the existing approaches in the light of
those needs. In this light, Section 4 highlights a pro-
posed realistic approach. Finally, Section 5 describes
our roadmap to implement such a label in Belgium.
2 SMEs NEEDS ABOUT
INFORMATION/CYBER
SECURITY
A survey made in 2014 among UK SMEs shows
some interesting findings about their perception and
approach of cyber security (Osborn et al., 2015):
1. Only 21% of the respondents have shown a low
awareness about basic security guidelines.
2. One of the main reported barriers is the lack of
trust and quality regarding available information,
amongst others such as the lack of resources or
knowledge.
3. 39% have done an in-depth risk analysis including
cyber security and 48% keep the company’s risk
analysis, policies and backups up to date.
4. Most SMEs are aware of the reasons why cyber
security measures are necessary.
5. The cost is still the main barrier for implementing
cyber security solutions and standards, as those
are designed for bigger companies.
The bottom line is that most SMEs already have
a good level of awareness and are ready to devote re-
sources to cyber security. However they lack “simple
effective measures that are not too time-consuming
and require a great in depth knowledge of IT sys-
tems”. This lack of reliable sources of truth and guid-
ance is a huge hindrance for them and the perceived
incentives are not sufficient to break that barrier.
Given the limited space, we just give an overview
of the main requirements gathered from different
surveys (Boateng and Osei, 2013)(Osborn et al.,
2015)(Padfield, 2015) and our own interactions with
local SMEs. They are structured according to the
FFIEC Cybersecurity Domains:
• Management and oversight: the whole organisa-
tion should be committed with management sup-
port. A dedicated person should be identified and
given resources. Roles could be aligned with risk
management process to make the link with the
Towards a Cyber Security Label for SMEs: A European Perspective
427