According to the Cybersecurity Strategy of the European Union, to promote cyber resilience in the EU, both public authorities and the private sector must develop capabilities and cooperate effectively; securing networks and information systems in the EU is essential to keep the online economy running and to ensure prosperity. The use of new technologies brings new opportunities for enhanced business performance and operations, but also introduces several information security and privacy risks. Addressing these risks plays a significant role in business success and development nowadays, as growing security threats may potentially disrupt business continuity and cause monetary, reputational and other types of losses to SMEs. It is important to determine and mitigate risk to an acceptable level and maintain risk level for an integrated cyber risk management, which is connected in particular with cyber information security for SMEs. The organizations are required to assess the threats and opportunities, which affect their information systems, and the developments in current information technologies, publishing and creating of business information via internet. Also social media tools being a part of basic marketing strategies of SMEs make them generally more fragile against cybercrimes and attacks. Since cyber risk management and assessment are considered as backbones of a secure IT environment, the REDCYBERSG project aims to improve cybersecurity management skills of SMEs by filling gaps in SMEs in partner countries and to provide a comprehensive guide for integrating best practices into their procedures in order to mitigate cyber risks. This is achieved by focusing on such direct target groups as VET teachers and trainers, SME managers and employees and other stakeholder organisations related to the SME sector, which can make use of the developed intellectual outputs respectively by educating students (future employees, as SMEs represent 99% of all businesses in the EU), training employees or, in case of stakeholder organisations, by sustaining and disseminating information regarding the education and training solutions. The REDCYBERSG project will develop training materials accessed via an e-learning platform, which enables SME enterprises to take cyber risks into account and deploy their cybersecurity activities into the risk management processes of the organization taking into account the international standards, and making an assessment of this model on the basis of cross-regional and multi-cultural business domains. Thus it will be possible to mitigate cyber risks to an acceptable level in SMEs to manage risks and to contribute at the national and at the EU level for creating a suitable infrastructure. The partnership is composed of 7 organisations from 4 different European countries: Baltijas Datoru akademija (Baltic Computer academy) and Ventspils University College (Latvia), Mugla Sitki Kocman University and Gazi University (Turkey), Training 200 and ITIS "E. Mattei" (Italy), Universitet po Bibliotekoznanie i Informacionni Tehnologii (University of Library Studies and Information Technologies) (Bulgaria). The associated partners: Switzerland - The Institute for Information Systems and Networking; Latvia - Latvian Information and communications technology association (LIKTA); Italy - CNA of Pesaro and Urbino - is the National Association of SMEs in Italy; Turkey - Mugla Chamber of Trade and Industry (MUTSO); Bulgaria - Cluster Sofia Knowledge City. The partner organisations are experts in cyber risk, cybersecurity and VET training. The partnership involves stakeholders and interested organizations to support the sustainability of the project beyond the project life cycle.
As society becomes more technically advanced, cyber-attacks are becoming an increasingly common type of crime. Also direct attackers are becoming more and more difficult to identify, and the price of the crime is much higher, it is not only information that criminals can exchange for a currency, cryptocurrency or even a commodity, in this case, companies also threaten to damage their reputation. Large companies have identified these potential risks to prevent or mitigate attacks and their consequences, they have a separate department and a budget allocated for that. At the same time small and medium size enterprises are only now beginning to realize the seriousness of these attacks. However, they still believe that their company is not really valuable in the eyes of criminals and that the chances of becoming a victim of this crime are quite low. And here they are mistaken - SMEs can become an indirect victim of an attack, they can be used as a tool for a larger scale crime. The aim of this project is not only to remind companies of this, but also to offer a free opportunity to explore valuable resources that would increase their awareness, insight and raise or develop new competencies in cybersecurity. At the beginning of the project a survey was developed and conducted in order to better understand the direct target group of the project, their competences and the protective measures implemented. During the project, the partners together analyzed cyber security risks and activities/job responsibilities for their management. Defined 3 job roles and selected 1, which was the most important one (Cyber security risk manager), determining the necessary levels of competencies required, afterwards aligned them to EQF and ECVET levels, thus developing a competency map. Developed a Training methodology which defines tools and methods to implement the project training process in order to guide trainers, VET organisations and stakeholders in the implementation of the training material in SMEs interested in cybersecurity risk management issues. This methodology describes the different tools created within the project, the didactic principles and the lessons learnt for the future implementation of similar training courses. Also a Testing methodology was developed, which describes the methodology to be used to carry out the testing phases of the project outputs, from the very beginning to the overall evaluation report. The developed training program consists of 6 training modules, which include reading parts (texts), presentations, videos, interactive videos, webpages, self-assessment gameful quizzes and interactive material. The Training program is created for individual, remote learning online. However, it can be also easily adopted for classroom training. All developed materials are available in the local languages of the partner countries. After the development of almost all outputs the joint staff training followed. The main task was to revise developed training materials, to agree on the necessary improvements, as well to agree on the SMEs and VET pilot training format and prepare trainers as the following pilot training had to be done fully online. This joint staff training took more time as planned, because shortly before this event all borders under the influence of COVID-19 were closed and this measure had to be done online. Another difficulty faced by the partners was the accreditation of the program. When reviewing the laws and regulations of each country related to the accreditation of the program, it was clear that it was not possible to be carried out in any of the countries. The partners agreed on the following assessment criteria and the type of certification: 1. The participant, after completing the training and passing the final test, can receive a badge within the training module, confirming that their acquired competency level is at least at 70%. 2. After the completion of the entire program and the accumulation of all 6 badges, the participant can receive a Certificate of Completion for the whole training program, including an attachment describing the program and the acquired knowledge. Despite the fact that all training materials are freely available, in order to receive badges and the certificate at the end the participant will have to register on the training platform first. As all partners felt the pressure of COVID-19, the main task was to prepare the training materials and upload them on the training platform as fast as possible, afterwards provide the pilot trainings and improve the training materials. Due to the complexity of the surrounding conditions, the implementation of these remaining activities took a longer time than originally planned in the beginning of the project. It was not possible to smoothly organize the pilot training groups, practically it was necessary to address each participant in the pilot training individually so that she/he could be persuaded and retained for pilot training. Since initial public communication did not provide results, partners agreed to take a radical step – address existing and former clients to involve them in the training. As the training period was extended there was a need to extend the project as well. The training materials were gradually improved during these pilot trainings.