Desafíos técnicos y organizacionales en el cumplimiento de normas de ciberseguridad para pymes: un enfoque desde la adopción y sostenibilidad de controles de seguridad
TL;DR
Preliminary results indicate that budget constraints, a shortage of specialized personnel, an inadequate organizational security culture, and the complexity of regulatory requirements constitute the primary barriers to compliance.
Abstract
The increasing digitalization of business processes has heightened the risk of small and medium-sized enterprises (SMEs) facing increasingly sophisticated cyber threats. While international frameworks—such as ISO/IEC 27001:2022, the NIST Cybersecurity Framework (CSF) 2.0, and CIS Controls—provide guidelines for strengthening organizational security, SMEs continue to face significant difficulties in implementing and maintaining effective cybersecurity controls. This study aims to identify and analyze the key technical and organizational challenges influencing compliance with cybersecurity standards and the sustainability of security controls within SMEs. A qualitative approach based exclusively on secondary sources was employed, utilizing a systematic review of scientific literature, technical reports, and specialized documents. Preliminary results indicate that budget constraints, a shortage of specialized personnel, an inadequate organizational security culture, and the complexity of regulatory requirements constitute the primary barriers to compliance. It was found that executive leadership, continuous training, and risk-based management foster the sustainability of implemented controls. Regulatory compliance must be addressed from a holistic perspective that integrates technological, human, and organizational factors.