{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T14:29:03Z","timestamp":1783520943594,"version":"3.55.0"},"reference-count":47,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2023,8,14]],"date-time":"2023-08-14T00:00:00Z","timestamp":1691971200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"The British Council under the Partnership for Education and Research (PERR) Programme for Women n Cyber"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Digital"],"abstract":"<jats:p>The emergence of Industry 5.0 has revolutionized technology by integrating physical systems with digital networks. These advancements have also led to an increase in cyber threats, posing significant risks, particularly for small and medium-sized enterprises (SMEs). This research investigates the resistance of SMEs in Saudi Arabia and the United Kingdom (UK) to cyber security measures within the context of Industry 5.0, with a specific focus on governance and policy. It explores the cultural and economic factors contributing to this resistance, such as limited awareness of cyber security risks, financial constraints, and competing business priorities. Additionally, the study examines the role of government policies and regulations in promoting cyber security practices among SMEs and compares the approaches adopted by Saudi Arabia and the UK. By employing a mixed methods analysis, including interviews with SME owners and experts, the research highlights challenges and opportunities for improving cyber security governance and policy in both countries. The findings emphasize the need for tailored solutions due to the differing cultural and economic contexts between Saudi Arabia and the UK. Specifically, the study delves into the awareness and implementation of cyber security measures, focusing on SMEs in Saudi Arabia and their adherence to the Essential Cyber Security Controls (ECC-1:2018) guidelines. Furthermore, it examines the existing cyber security awareness practices and compliance in the UK, while also comparing official guidance documents aimed at supporting SMEs in achieving better cyber security practices. Based on the analysis, greater engagement with these documents is recommended in both countries to foster awareness, confidence, and compliance among SMEs, ultimately enhancing their cyber security posture. This paper offers a comparative research study on governance and policy between Saudi Arabia and the UK, presenting a set of recommendations to strengthen cyber security awareness and education, fortify regulatory frameworks, and foster public\u2013private partnerships to combat cyber security threats in the Industry 5.0 landscape.<\/jats:p>","DOI":"10.3390\/digital3030014","type":"journal-article","created":{"date-parts":[[2023,8,14]],"date-time":"2023-08-14T12:35:25Z","timestamp":1692016525000},"page":"200-231","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":36,"title":["Enhancing Cyber Security Governance and Policy for SMEs in Industry 5.0: A Comparative Study between Saudi Arabia and the United Kingdom"],"prefix":"10.3390","volume":"3","author":[{"given":"Nisha","family":"Rawindaran","sequence":"first","affiliation":[{"name":"Cardiff School of Technology, Cardiff Metropolitan University, Cardiff CF5 2YB, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6328-0554","authenticated-orcid":false,"given":"Liqaa","family":"Nawaf","sequence":"additional","affiliation":[{"name":"Cardiff School of Technology, Cardiff Metropolitan University, Cardiff CF5 2YB, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Suaad","family":"Alarifi","sequence":"additional","affiliation":[{"name":"Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5533-3203","authenticated-orcid":false,"given":"Daniyal","family":"Alghazzawi","sequence":"additional","affiliation":[{"name":"Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9967-2207","authenticated-orcid":false,"given":"Fiona","family":"Carroll","sequence":"additional","affiliation":[{"name":"Cardiff School of Technology, Cardiff Metropolitan University, Cardiff CF5 2YB, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3376-3218","authenticated-orcid":false,"given":"Iyad","family":"Katib","sequence":"additional","affiliation":[{"name":"Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7593-6661","authenticated-orcid":false,"given":"Chaminda","family":"Hewage","sequence":"additional","affiliation":[{"name":"Cardiff School of Technology, Cardiff Metropolitan University, Cardiff CF5 2YB, UK"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,8,14]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Pizo\u0144, J., and Gola, A. (2023). Human\u2013Machine Relationship\u2014Perspective and Future Roadmap for Industry 5.0 Solutions. Machines, 11.","DOI":"10.3390\/machines11020203"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"e06016","DOI":"10.1016\/j.heliyon.2021.e06016","article-title":"Measuring the level of cyber-security awareness for cybercrime in Saudi Arabia","volume":"7","author":"Alzubaidi","year":"2021","journal-title":"Heliyon"},{"key":"ref_3","unstructured":"Malek, C. (2022, November 20). Saudi Arabia \u2018Prime Target for Hackers\u2019. Available online: https:\/\/bricade\/alerts\/alert\/public\/1275423\/saudi-arabia-prime-target-for-hackers\/."},{"key":"ref_4","unstructured":"(2022, November 20). Saudi Arabia\u2019s Population Statistics of 2019. Available online: https:\/\/www.globalmediainsight.com\/blog\/saudi-arabia-population-statistics\/."},{"key":"ref_5","unstructured":"(2022, November 20). Number of Internet Users in Saudi Arabia from 2015 to 2023 (in Millions). Available online: https:\/\/www.statista.com\/statistics\/462959\/internet-users-saudi-arabia\/."},{"key":"ref_6","unstructured":"Ijomah, W.L., and McMahon, C.A. (2023). Industry 4.0: Managing the Digital Transformation, Springer."},{"key":"ref_7","unstructured":"Mourtzis, D., Vlachou, E., and Milas, N. (2023). Advances in Manufacturing, Springer."},{"key":"ref_8","unstructured":"Forte, P., Schiraldi, M.M., and Petrescu, R.V. (2023). Robotics in Industry, Springer."},{"key":"ref_9","unstructured":"(2022, November 20). Saudi Arabia Social Media Statistics 2020. Available online: https:\/\/www.globalmediainsight.com\/blog\/saudi-arabia-social-media-statistics\/."},{"key":"ref_10","first-page":"2090","article-title":"Compliance with Saudi NCA-ECC based on ISO\/IEC 27001","volume":"29","author":"Alsahafi","year":"2022","journal-title":"Teh. Vjesn."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1016\/S1361-3723(20)30059-2","article-title":"Verizon: Data breach investigations report 2020","volume":"2020","author":"Widup","year":"2020","journal-title":"Comput. Fraud Secur."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1285","DOI":"10.1007\/s10796-019-09959-1","article-title":"Investigating the security divide between SME and large companies: How SME characteristics influence organizational IT security investments","volume":"21","author":"Heidt","year":"2019","journal-title":"Inf. Syst. Front."},{"key":"ref_13","unstructured":"Zec, M. (2015). Cyber Security Measures in SMEs: A research of IT Professionals Organisational Cyber Security Awareness. [Master\u2019s Thesis, Linnaeus University]."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"393","DOI":"10.1108\/ICS-07-2018-0080","article-title":"Developing cyber security education and awareness programmes for small- and medium-sized enterprises (SMEs)","volume":"27","author":"Bada","year":"2019","journal-title":"Inf. Comput. Secur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"78","DOI":"10.2478\/raft-2022-0011","article-title":"An Argument for Cyber security in Saudi Arabia","volume":"27","author":"Dawson","year":"2022","journal-title":"Land Forces Acad. Rev."},{"key":"ref_16","unstructured":"(2023, February 10). Worlddata.info. (n.d.). Saudi Arabia: Country Data and Statistics. Available online: https:\/\/www.worlddata.info\/asia\/saudi-arabia\/index.php#:~:text=According%20to%20the%20definition%20from."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1909","DOI":"10.47836\/pjst.30.3.08","article-title":"Vulnerability of Saudi Private Sector Organisations to Cyber Threats and Methods to Reduce the Vulnerability","volume":"30","author":"Shafie","year":"2022","journal-title":"Pertanika J. Sci. Technol."},{"key":"ref_18","unstructured":"nca.gov.sa. (n.d.) (2022, November 20). \u0627\u0644\u0647\u064a\u0626\u0629 \u0627\u0644\u0648\u0637\u0646\u064a\u0629 \u0644\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a, Available online: https:\/\/nca.gov.sa."},{"key":"ref_19","unstructured":"Vision 2030 (2023, February 10). Vision 2030 Overview, Available online: https:\/\/www.vision2030.gov.sa\/v2030\/overview\/."},{"key":"ref_20","unstructured":"(2022, November 22). \u0627\u0644\u062a\u0627\u0644\u064a:\u202c \u202b\u0646\u0633\u062a\u0639\u0631\u0636\u202c \u202b\u0627\u0644\u062a\u0642\u0631\u064a\u0631\u202c \u202b\u0647\u0630\u0627\u202c \u202b\u0641\u064a\u202c(n.d.), Available online: https:\/\/www.monshaat.gov.sa\/sites\/default\/files\/2022-6\/Monshaat%20Quarterly%20Report%20Q1%202022%20-%20EN%20%282%29.pdf."},{"key":"ref_21","unstructured":"(2023, February 10). Grant Thornton Saudi Arabia. Home. (n.d.). The Future of Cyber Security in Saudi Arabia. Available online: https:\/\/www.grantthornton.sa\/en\/insights\/articles-and-publications\/future_cybersecurity\/."},{"key":"ref_22","unstructured":"(2023, February 10). GHCQ Overview, Available online: https:\/\/www.gchq.gov.uk\/section\/mission\/overview."},{"key":"ref_23","unstructured":"Businesses, F. (2023, February 10). The Federation of Small (n.d.). FSB|The Federation of Small Businesses. Available online: https:\/\/www.fsb.org.uk\/."},{"key":"ref_24","unstructured":"(2023, February 10). Gov.wales. Business Wales|Supporting businesses in Wales, Available online: https:\/\/businesswales.gov.wales\/."},{"key":"ref_25","unstructured":"Scottish-enterprise.com (2023, February 10). Funding and Support for Businesses in Scotland. Available online: https:\/\/www.scottish-enterprise.com\/."},{"key":"ref_26","unstructured":"ICO (2023, February 10). Guide to the UK General Data Protection Regulation (UK GDPR). Available online: https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/guide-to-the-general-data-protection-regulation-gdpr\/."},{"key":"ref_27","unstructured":"NCSC (2023, February 10). About Cyber Essentials, Available online: https:\/\/www.ncsc.gov.uk\/cyberessentials\/overview."},{"key":"ref_28","unstructured":"Hassan, M., Saeedi, K., Almagwashi, H., and Alarifi, S. (2022). Research and Innovation Forum 2022, Springer."},{"key":"ref_29","unstructured":"ISO (2023, February 10). ISO\/IEC 27001 Standard\u2014Information Security Management Systems. Available online: https:\/\/www.iso.org\/standard\/27001."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Rawindaran, N., Jayal, A., and Prakash, E. (2021). Machine Learning Cyber Security Adoption in Small and Medium Enterprises in Developed Countries. Computers, 10.","DOI":"10.3390\/computers10110150"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1007\/s42979-022-01020-4","article-title":"Cyber security, data privacy and blockchain: A review","volume":"3","author":"Wylde","year":"2022","journal-title":"SN Comput. Sci."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Alharbi, F., Alsulami, M., Al-Solami, A., Al-Otaibi, Y., Al-Osimi, M., Al-Qanor, F., and Al-Otaibi, K. (2021). The Impact of Cyber security Practices on Cyberattack Damage: The Perspective of Small Enterprises in Saudi Arabia. Sensors, 21.","DOI":"10.3390\/s21206901"},{"key":"ref_33","unstructured":"Albaroodi, H.A., Abomaali, M., and Manickam, S. (2020). International Conference on Advances in Cyber Security, Springer."},{"key":"ref_34","first-page":"aaaa004","article-title":"The BANI environment: Cybersecurity implications","volume":"9","author":"Thompson","year":"2023","journal-title":"J. Cybersecur."},{"key":"ref_35","first-page":"85","article-title":"Future strategy for organizations in BANI environments","volume":"14","author":"Ghosh","year":"2023","journal-title":"Int. J. Strateg. Decis. Sci."},{"key":"ref_36","first-page":"121108","article-title":"The brittleness of socio-technical systems: Towards a conceptualization","volume":"176","author":"Grange","year":"2023","journal-title":"Technol. Forecast. Soc. Chang."},{"key":"ref_37","first-page":"467","article-title":"\u201cIt\u2019s like herding cats\u201d: Coordinating boundary-spanning work for cybersecurity in organizations","volume":"24","author":"Panteli","year":"2023","journal-title":"J. Assoc. Inf. Syst."},{"key":"ref_38","first-page":"194","article-title":"Second-order cybernetics of cognitive processes: An analysis of BANI environments","volume":"40","author":"Mackey","year":"2023","journal-title":"J. Manag. Inf. Syst."},{"key":"ref_39","first-page":"44","article-title":"Analyzing strategies in BANI environments: A comparative study","volume":"55","author":"Smith","year":"2023","journal-title":"Comp. Politics"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"715","DOI":"10.1080\/02681102.2017.1390437","article-title":"Factors affecting the adoption of information and communication technology in small and medium enterprises: A perspective from rural Saudi Arabia","volume":"25","author":"AlBar","year":"2019","journal-title":"Inf. Technol. Dev."},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Svehla, Z.L., Sedinic, I., and Pauk, L. (June, January 30). Going white hat: Security check by hacking employees using social engineering techniques. Proceedings of the 2016 39th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, Croatia.","DOI":"10.1109\/MIPRO.2016.7522362"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"196","DOI":"10.1016\/j.cose.2009.09.002","article-title":"A framework and assessment instrument for information security culture","volume":"29","author":"Eloff","year":"2010","journal-title":"Comput. Secur."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1080\/13562517.2020.1767057","article-title":"Experiences of distance doctoral supervision in cross-cultural teams","volume":"28","author":"Alebaikan","year":"2023","journal-title":"Teach. High. Educ."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"75","DOI":"10.1057\/s41599-021-00746-5","article-title":"Exploring cybersecurity-related emotions and finding that they are challenging to measure","volume":"8","author":"Renaud","year":"2021","journal-title":"Humanit. Soc. Sci. Commun."},{"key":"ref_45","unstructured":"De Mooij, M. (2009). Global Marketing and Advertising: Understanding Cultural Paradoxes, Sage."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Rawindaran, N., Jayal, A., and Prakash, E. (2022). Exploration of the Impact of Cybersecurity Awareness on Small and Medium Enterprises (SMEs) in Wales Using Intelligent Software to Combat Cybercrime. Computers, 11.","DOI":"10.3390\/computers11120174"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"3093","DOI":"10.3758\/s13428-022-01792-w","article-title":"Integrating web applications into popular survey platforms for online experiments","volume":"54","author":"Carter","year":"2022","journal-title":"Behav. Res. Methods"}],"container-title":["Digital"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2673-6470\/3\/3\/14\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:33:28Z","timestamp":1760128408000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2673-6470\/3\/3\/14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,14]]},"references-count":47,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2023,9]]}},"alternative-id":["digital3030014"],"URL":"https:\/\/doi.org\/10.3390\/digital3030014","relation":{},"ISSN":["2673-6470"],"issn-type":[{"value":"2673-6470","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,14]]}}}