Study Title: Digital Resilience for SMEs
I, the Principal Investigator, Dr. Hazel Murray, Cybersecurity Lecturer and Researcher at CyberSkills Munster Technological University, would like to invite you to take part in a research study. Before you decide, you need to understand why the research is being done, and what it would involve for you. Please read the following information and consider whether or not to take part.
What is this research about?
Our project is to enhance Irish SMEs’ digital resilience. While SMEs are increasingly moving to digital platforms, they are not investing sufficient time or resources in cybersecurity measures to adequately protect their businesses. The reasons for this include financial and/or time constraints, an inability to identify their cybersecurity risks and a lack of confidence to address these risks. Through our research, we aim to supply SMEs with a free and accessible Risk Assessment Tool that will help them mitigate their cybersecurity risks.
Why have I been invited to take part?
We are asking owners or managers of SMEs to use our Risk Assessment Tool. We will collect your answers, which will be kept anonymous, and use it to further our research and improve the tool.
Do I have to take part? Can I withdraw?
Participation in the study is optional and voluntary. You have the right to decline participation from the outset. As the data is anonymous, it will not be possible for the research team to identify your input, and so withdrawal of gathered data will not be possible. If you decline participation in the study, there will be no negative consequences of this.
If you enter your email address into the tool to receive tailored feedback and/or to participate in the follow-up survey, your answers will not be anonymous. In this case, you can withdraw your input up to the point of data anonymization, which will be approximately 6 weeks after the completion of the tool.
What will participation involve?
We will ask you to fill in the questions on the Risk Assessment Tool in relation to your small or medium enterprise. We will then collect your answers. We will use your answers to improve and develop the Risk Assessment Tool. The tool should take approximately 15-20 mins to complete and will be completed in person or online, dependent on where the workshop is taking place
What will happen to my data?
Personal or identifiable details will not be collected during the Risk Assessment. Participant data will be transferred to Digital Format within one week of the interview process and the original Paper Form securely shredded. The answers you provide will be kept anonymous. They will be shared in an open data repository. We will use the information collected from this study of SME owners/managers using the Risk Assessment Tool to further develop and improve the tool.
If you choose to enter your email address into the tool, this data will not be anonymous. The data will be securely stored in the MTU One Drive, which will only be accessible by our research team. We may publish the answers of the tool but will not publish identifiable information.
What are the benefits of taking part in the research study?
The goal of this research is to develop a Risk Assessment Tool and a Cyber Action Plan that will be made freely available to Irish SMEs at the conclusion of the project. The Cyber Action Plan will be tailored to the SMEs’ specific needs and allow them to reduce their cybersecurity risk depending on their available resources. By taking part in this research study, you are helping us to reach this goal.
What are the risks of taking part in the research study?
A risk of this study is that you may feel more vulnerable to security threats after potentially finding out that you do not have a lot of the security mitigations listed in the assessment.
However, we believe the benefit of understanding your business risks and how to mitigate these risks outweighs the disadvantages as we will also direct you towards the skills and knowledge to make yourself secure and cyber resilient.
This research is approved by the MTU Human Research Ethics Committee MTU-HREC-MR-24-007-A.
How will participants be debriefed when the project is completed?
We will provide a copy of the final research report to all participants on request at the conclusion of the project.
Will results from the data possibly be used in publication(s) and/or at conferences?
Results of our work will be published at journals and/or conferences but information about individual participants will never be published or disclosed. Questions, further clarifications, or expressions of interest in taking part in the study, can be emailed to the Principal Investigator:
Dr. Hazel Murray
Hazel.Murray@mtu.ie