The Complete Guide to IT Risk Management for SMEs — A Map of Security, Regulation, and Business Continuity

IT risk management for small and medium enterprises (SMEs) covers more than preventing cyberattacks. It also includes the reputational damage that can follow a data breach, and delays in adapting to regulatory changes such as Japan's Electronic Bookkeeping Act, the Invoice System, and the Freelance Act. This article maps out the full landscape of these risks and points to companion articles that cover each area in depth.

IPA (Information-technology Promotion Agency, Japan), which publishes an annual list of the top ten information security threats, has repeatedly flagged ransomware and supply-chain attacks as leading risks affecting organizations of every size, SMEs included. At the same time, a series of regulatory changes tied directly to how companies handle data and IT — the Electronic Bookkeeping Act, the Invoice System, and the Freelance Act — mean that security and regulatory compliance can no longer be treated as separate concerns.

The assumption that small companies are not attractive targets does not necessarily match reality. Some recent attacks reportedly use a smaller business partner as a stepping stone to reach a larger target company — a pattern known as a supply-chain attack. Many attacks are also not aimed at specific companies at all; they scan mechanically for vulnerable devices or accounts, which means company size is not necessarily a factor in whether an organization becomes a target.

IT risk facing SMEs can broadly be grouped into three categories: (1) the risk of being attacked, such as ransomware or phishing emails; (2) the risk of losing trust, such as a data breach or failing to meet a business partner's security requirements; and (3) the risk of falling behind on regulation, such as a delayed response to the Electronic Bookkeeping Act, the Invoice System, or the Freelance Act. Each is outlined below.

The most direct source of damage tends to be external attacks such as ransomware, targeted phishing emails, and business email compromise (BEC). For how these attacks work and why SMEs are often exposed, see Ransomware Basics for SMEs. If you are unsure where to start, 5 First Steps in Security for SMEs outlines the highest-priority measures.

Even without being attacked, a data breach can undermine the trust of customers and business partners. What to do immediately after a breach is covered in Initial Response to a Personal Data Breach. It has also become more common for large business partners to request a completed security checksheet before signing a contract; How to Respond to a Business Partner's Security Checksheet explains how to approach this. For financial exposure, Cyber Insurance Basics is a useful reference, and IT-BCP Basics for SMEs covers how to keep operations running when systems go down due to an attack or disaster.

Separate from security, falling behind on regulatory change is also part of IT risk. Electronic Bookkeeping Act Basics covers compliance with that law, Day-to-Day Operations Under the Invoice System covers routine invoice handling, and The Freelance Act and Ordering Practices covers new rules for placing orders with freelance contractors.

As more companies use generative AI in daily operations, how data entered into AI tools is handled has become a new category of IT risk. How to Set Company Rules for ChatGPT and Other Generative AI Tools covers how to think about internal usage rules.

- Take stock: Inventory the IT devices, cloud services, and accounts your company actually uses
- Check backups: Confirm that important data is backed up regularly, with at least one copy stored offline or offsite
- Update software: Check whether the OS, business applications, and VPN devices are up to date
- Manage access: Remove accounts of former employees and review any shared accounts
- Set internal rules: Document how to handle suspicious emails and how staff should use generative AI
- Line up your contacts: Identify in advance who you can call in an emergency — legal counsel, an insurance agent, an IT vendor

IT risk for SMEs spans three areas — being attacked, losing trust, and falling behind on regulation — and addressing only one of them is not enough on its own. The first step toward sustainable countermeasures is to take stock of how well-prepared your company is in each area, then start with the highest-priority gaps.