IT Service Management from a Perspective of Small and Medium Sized Companies

Most of the existing information security management studies focus on information security of large organizations preventing security threats. However, a security management perspective of a small and medium-sized (SME) company is relatively different. Small and medium sized companies are at a greater risk because they cannot afford expensive tools. They lack process improvement capabilities and effort that can be spent on security management is limited. Due to limited budget, they cannot invest heavily in the IT service infrastructure and IT manpower. They become easy targets for cyber criminals and they can be easily victimized as they lack the resources compared to larger companies. Malicious internet content also becomes one of the major security concerns. Therefore, this study aims to answer the research problem: How small and mediumsized organizations perform IT security management. The main contribution of the paper is to capture information security management challenges from an SME's viewpoint and provide solutions to tackle these challenges. This paper aims to improve information security management of SMEs. From IT Service management perspective, the case study research approach was utilized in the study.