The development of a maturity framework to guide small to medium enterprises in the implementation of cybersecurity practices in the Eastern Cape

Abstract

Technology continues to play a critical role in the modern corporate environment, making the adoption of sound cybersecurity practices essential, particularly for small and medium-sized enterprises (SMEs). Cybercriminals frequently target SMEs due to their perceived vulnerabilities and limited security resources. This study examined the current state of cybersecurity practices among SMEs in South Africa’s Eastern Cape province, a region with significant economic potential but high susceptibility to cyber threats that can compromise business operations and consumer trust.

Using an interpretivist qualitative research approach, data were collected from 22 SMEs across diverse sectors through semi-structured interviews supported by questionnaires and supplementary document analysis. A constructivist grounded theory approach guided the iterative coding and analysis process. Drawing on institutional theory and structural functional theory, the study explored how SMEs respond to cybersecurity expectations shaped by their institutional environments and internal organisational structures. Thematic analysis revealed several recurring weaknesses, including limited familiarity with cybersecurity frameworks, the absence of formal cybersecurity governance structures, reliance on basic security tools, lack of structured cybersecurity training programmes, and the marginal prioritisation of cybersecurity within organisational decision-making. These shortcomings were primarily driven by limited awareness, financial constraints, and restricted technical capacity.

Based on these findings, the study developed a Cybersecurity Maturity Framework tailored to the Eastern Cape SME context. The SME CyberMat framework is structured around four interrelated dimensions: human, organisational, technical, and policy/external. These dimensions collectively capture the internal capabilities and external institutional pressures that influence cybersecurity maturity within SMEs. By integrating organisational behaviour, governance structures, technical controls, and regulatory engagement, the framework provides a developmental roadmap for SMEs to progressively assess and strengthen their cybersecurity posture in resource-constrained environments.

The study contributes to both theory and practice by providing an empirically grounded and context-sensitive maturity framework that reflects the realities of SMEs operating in developing economies. It demonstrates that cybersecurity maturity is shaped not only by technological adoption but also by institutional pressures, organisational structures, and governance capacity. Strengthening cybersecurity within SMEs is therefore not merely a technical exercise but a strategic imperative for safeguarding South Africa’s economic resilience and supporting the long-term sustainability of its most vital enterprises.