Information Security Recipe in Small- and Medium-Sized Enterprises: An Interpretive Study in Japan

The progress of the Internet of Things (IoT) or ubiquitous computing has increased the need for information security to high levels. Information security initiatives in an enterprise cover complicated processes that are affected by many factors including the human factor, education, technology, and organizational culture. Therefore, there is a clear difference in company's efforts towards information security, depending on the size of the company. This research focuses on small- and medium-sized enterprises (SMEs) in Japan. SMEs' incentives and resources are generally limited, and therefore it tends to widen the gap between themselves and large companies. In this study, we elucidated a critical difference regarding information security measures between "the truly excellent SMEs (the top-tier SMEs)" and "the runners-up following the top-tier SMEs" by applying qualitative comparative analysis (QCA) and text-mining to the interview survey of SMEs in Japan.