Strategic Management and Cybersecurity: A Literature Review on Enhancing Organisational Resilience in the Digital Era for Small to Medium-Sized Businesses
Abstract:
This review examines the theoretical and empirical literature at the intersection of strategic management and cybersecurity, and how organisations can strategically manage cybersecurity to strengthen their resilience in the digital era. The review synthesises eight components of the literature, including the theoretical foundations of strategic management; the role of strategic management in cybersecurity; cybersecurity challenges in the digital era; emerging technologies; cybersecurity incidents and business continuity; leadership and organisational culture; building organisational resilience; and best-practice frameworks. The literature consistently indicates that cyber resilience is not achieved through isolated information technology (IT) controls but through integrated strategic management that connects cyber risk, operational priorities, and business continuity. Gaps remain in the contextual literature on developing economies, where empirical evidence on the relationship between strategic management and cybersecurity remains limited.References:
[1].
Dal Cin P. State of cybersecurity resilience 2025.
Accenture; 2025. Available from: https://www.accenture.com/en/insights/security/state-cybersecurity-2025
[2].
Thompson A, Peteraf M, Gamble J, Strickland AJ III.
Crafting and executing strategy: The quest for competitive advantage. New York:
McGraw Hill Education; 2016.
[3].
European Union Agency for Cybersecurity. ENISA threat
landscape 2021. 2021. Available from: https://www.enisa.europa.eu/sites/default/files/publications/ENISA%20Threat%20Landscape%202021.pdf
[4].
Sithole M, Odette S, Munzhelele F. Cybersecurity
challenges and a conceptualised maturity typology in Ugandan SMEs: A
qualitative analysis. Int J Bus Ecosyst Strateg. 2026;8:105-19.
[5].
Kumar S, Gangwar SP, Singh N, Pagaria R, Garg A, Das
S. Securing the skies: Innovating cybersecurity governance for India's emerging
small airports. Eur Conf Cyber Warf Secur. 2025;24:318-27.
[6].
Alnaabi AAH, Al Mahruqi AAH. Artificial intelligence
methods for enhancing cybersecurity in Oman: A comprehensive review. J Cloud
Comput. 2026;15.
[7].
Agyemang R, Furnell S, Muller T. A context-aware
cybersecurity readiness assessment framework for organisations in developing
and emerging environments. Future Internet. 2026;18:178.
[8].
Khresat O. Compliance with regulatory, legislative and
contractual requirements for cyber security and its impact on the continuity of
the Jordanian banking sector. Asian Econ Financ Rev. 2025;15:1592-603.
[9].
Albustanji H, Paulovics A. A critical review of the
Jordanian legal frameworks on international cooperation in combating
cybercrime. AAU J Bus Law. 2026;10.
[10]. von Solms B, Upton
D. Cyber security capacity governance. Bus Manag Rev. 2016;7(4):35-9.
[11]. GuruFocus. Westport
(WPRT) faces cybersecurity breach but ensures business continuity. Newstex
Finance Account Blogs. 2026 Mar 20.
[12]. Mearian L. Data
security key to business continuity. CIO Canada. 2005;13(12).
[13]. Grant RL. Exploring
effects of organizational culture upon implementation of information security
awareness and training programs within the defense industry located in the
Tennessee Valley region [doctoral dissertation]. Melbourne (FL): Florida
Institute of Technology; 2017.
[14]. Andronache A.
Increasing security awareness through lenses of cybersecurity culture. J Inf
Syst Oper Manag. 2021;15:1-16.
[15]. BCM Institute. What
is organizational resilience? BCM Institute Blog. 2023 May 17. Available from: https://bcm-institute.org
[16]. Malatji M,
Marnewick AL, Von Solms S. Cybersecurity capabilities for critical
infrastructure resilience. Inf Comput Secur. 2021;30:255-79.
[17]. Zhang X, Ba X, Li
B. Cyberattacks in supply chains: A multi-case study. PLoS One.
2026;21:e0350010.
[18]. Ramage X, Lebea K,
Sithungu S. Cyber warfare and critical infrastructure. Eur Conf Cyber Warf
Secur. 2025;24:566-75.
[19]. International
Organization for Standardization. ISO/IEC 27001:2022 Information security,
cybersecurity and privacy protection: Information security management systems:
Requirements. Geneva: ISO; 2022. Available from: https://www.iso.org/standard/27001.html
[20]. Parliament of Guyana. Cyber Crime Act 2018 (Act No. 16 of 2018). 2018. Available from: https://www.parliament.gov.gy/publications/acts-of-parliament/cyber-crime-act-2018
[21]. Parliament of Guyana. Data Protection Act 2023 (Act No. 18 of 2023). 2023. Available from: https://www.parliament.gov.gy/publications/acts-of-parliament/dataprotectionact18of2023
