A Decision-Support Framework for Cybersecurity-by-Design in Small and Medium-sized Enterprise Product Development : A multiple-case study

Sammanfattning

Small and medium-sized enterprises that build products with digital elements now face a new EU obligation. The EU Cyber Resilience Act makes cybersecurity a mandatory design requirement, yet most of these SMEs decide on security during product development with little structure and few resources. This thesis asks how those decisions are made and how they can be supported. It uses Design Science Research to study the problem and to build a response. The empirical work is an embedded multi-case study of three Swedish SMEs, with eight semi-structured interviews and onsite observation of the product development life cycle at the primary case. The findings show that cybersecurity decisions are mainly made at a small number of design moments, that the difficulty of interpreting regulatory text is the central friction, and organisational maturity, rather than company size, shaped practice the most. From these findings the thesis develops a decision-support framework that organises cybersecurity decisions across four product development phases, calibrates the depth of engagement to three maturity levels, maps each decision to the relevant Cyber Resilience Act articles, and gathers governance and human factors into an adoption- readiness check. The framework was assessed in a formative evaluation by five practitioners at the primary case against utility, clarity, relevance, and adoption, where it was rated most highly for making decisions consistent and defensible. The thesis contributes an empirical account of SME cybersecurity decision-making, a design-stage framework grounded in that account, and an integration of five research areas that have developed separately.