{"id":"https://openalex.org/W7225660907","doi":"https://doi.org/10.1080/17517575.2026.2750207","title":"Proportionate defense: a NIST\u2011aligned cyber risk scoring model for resource-constrained enterprises","display_name":"Proportionate defense: a NIST\u2011aligned cyber risk scoring model for resource-constrained enterprises","publication_year":2026,"publication_date":"2026-11-09","ids":{"openalex":"https://openalex.org/W7225660907","doi":"https://doi.org/10.1080/17517575.2026.2750207"},"language":"en","primary_location":{"id":"doi:10.1080/17517575.2026.2750207","doi":"https://doi.org/10.1080/17517575.2026.2750207","is_oa":false,"landing_page_url":"https://doi.org/10.1080/17517575.2026.2750207","pdf_url":null,"source":{"id":"https://openalex.org/S24861202","display_name":"Enterprise Information Systems","issn_l":"1751-7575","issn":["1751-7575","1751-7583"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a","anvur-class-a","anvur-scientific","cwts-core","dongbi-d","fnege-3","jufo-2","norway-1","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Enterprise Information Systems","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038961438","display_name":"Tran Duc Le","orcid":"https://orcid.org/0000-0003-3735-0314","observed_orcids":["https://orcid.org/0000-0003-3735-0314"]},"institutions":[{"id":"https://openalex.org/I1921588","display_name":"University of Wisconsin\u2013Stout","ror":"https://ror.org/01gb8pc70","country_code":"US","type":"education","lineage":["https://openalex.org/I1921588"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tran Duc Le","raw_affiliation_strings":["University of Wisconsin-Stout Polytechnic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Wisconsin-Stout Polytechnic","institution_ids":["https://openalex.org/I1921588"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137296230","display_name":"Phuc Hao Do","orcid":"https://orcid.org/0000-0003-0645-0021","observed_orcids":["https://orcid.org/0000-0003-0645-0021"]},"institutions":[{"id":"https://openalex.org/I4210125720","display_name":"Danang Architecture University","ror":"https://ror.org/03aebk093","country_code":"VN","type":"education","lineage":["https://openalex.org/I4210125720"]}],"countries":["VN"],"is_corresponding":true,"raw_author_name":"Phuc Hao Do","raw_affiliation_strings":["Danang Architecture University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Danang Architecture University","institution_ids":["https://openalex.org/I4210125720"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041417996","display_name":"Truong Duy Dinh","orcid":"https://orcid.org/0000-0002-9993-9792","observed_orcids":["https://orcid.org/0000-0002-9993-9792"]},"institutions":[{"id":"https://openalex.org/I4400600977","display_name":"Posts and Telecommunications Institute of Technology","ror":"https://ror.org/0363rtq22","country_code":"VN","type":"education","lineage":["https://openalex.org/I4400600977"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Truong Duy Dinh","raw_affiliation_strings":["Posts and Telecommunications Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Posts and Telecommunications Institute of Technology","institution_ids":["https://openalex.org/I4400600977"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5017967256","display_name":"Van Dai Pham","orcid":"https://orcid.org/0000-0003-1363-0784","observed_orcids":["https://orcid.org/0000-0003-1363-0784"]},"institutions":[{"id":"https://openalex.org/I109689652","display_name":"FPT University","ror":"https://ror.org/03esj4g97","country_code":"VN","type":"education","lineage":["https://openalex.org/I109689652"]}],"countries":["VN"],"is_corresponding":false,"raw_author_name":"Van Dai Pham","raw_affiliation_strings":["FPT University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"FPT University","institution_ids":["https://openalex.org/I109689652"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076686067","display_name":"Thi Le Quyen Nguyen","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Thi Le Quyen Nguyen","raw_affiliation_strings":["University of Science and Technology - The University of Danang"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Science and Technology - The University of Danang","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5137296230"],"corresponding_institution_ids":["https://openalex.org/I4210125720"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/small-and-medium-sized-enterprises","display_name":"small and medium-sized enterprises","score":0.9480000138282776},{"id":"https://openalex.org/keywords/nist-cybersecurity-framework","display_name":"NIST Cybersecurity Framework","score":0.8799999952316284},{"id":"https://openalex.org/keywords/cis-controls","display_name":"CIS Controls","score":0.7919999957084656},{"id":"https://openalex.org/keywords/shadow-it","display_name":"shadow IT","score":0.8199999928474426},{"id":"https://openalex.org/keywords/risk-prioritization","display_name":"risk prioritization","score":0.8320000171661377},{"id":"https://openalex.org/keywords/resource-constrained-organizations","display_name":"resource-constrained organizations","score":0.7350000143051147},{"id":"https://openalex.org/keywords/vulnerability-severity","display_name":"vulnerability severity","score":0.4869999885559082}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5784000158309937},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5629000067710876},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.5386000275611877},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.4577000141143799},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.40849998593330383},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4066999852657318},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.3880000114440918},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.38339999318122864},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.37720000743865967},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.3723999857902527},{"id":"https://openalex.org/C65660741","wikidata":"https://www.wikidata.org/wiki/Q3952743","display_name":"Score","level":2,"score":0.3441999852657318},{"id":"https://openalex.org/C2776036281","wikidata":"https://www.wikidata.org/wiki/Q48769818","display_name":"Constraint (computer-aided design)","level":2,"score":0.3425999879837036},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33379998803138733},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.3327000141143799},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.32019999623298645},{"id":"https://openalex.org/C83282275","wikidata":"https://www.wikidata.org/wiki/Q7435350","display_name":"Scoring algorithm","level":2,"score":0.3149999976158142},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.31299999356269836},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.31119999289512634},{"id":"https://openalex.org/C2984538763","wikidata":"https://www.wikidata.org/wiki/Q2260590","display_name":"Scoring system","level":2,"score":0.3043000102043152},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.2985000014305115},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.29829999804496765},{"id":"https://openalex.org/C2780795517","wikidata":"https://www.wikidata.org/wiki/Q6030997","display_name":"Information assurance","level":3,"score":0.2793000042438507},{"id":"https://openalex.org/C162118730","wikidata":"https://www.wikidata.org/wiki/Q1128453","display_name":"Actuarial science","level":1,"score":0.2770000100135803},{"id":"https://openalex.org/C121017731","wikidata":"https://www.wikidata.org/wiki/Q11661","display_name":"Information technology","level":2,"score":0.2752000093460083},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C17020691","wikidata":"https://www.wikidata.org/wiki/Q139677","display_name":"Operator (biology)","level":5,"score":0.2635999917984009},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.26339998841285706},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.26330000162124634},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.2547999918460846},{"id":"https://openalex.org/C93226319","wikidata":"https://www.wikidata.org/wiki/Q193137","display_name":"Differential (mechanical device)","level":2,"score":0.25209999084472656}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1080/17517575.2026.2750207","doi":"https://doi.org/10.1080/17517575.2026.2750207","is_oa":false,"landing_page_url":"https://doi.org/10.1080/17517575.2026.2750207","pdf_url":null,"source":{"id":"https://openalex.org/S24861202","display_name":"Enterprise Information Systems","issn_l":"1751-7575","issn":["1751-7575","1751-7583"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["abdc-a","anvur-class-a","anvur-scientific","cwts-core","dongbi-d","fnege-3","jufo-2","norway-1","poland-100","russia-white-list-1","vabb-shw"],"host_organization":"https://openalex.org/P4310320547","host_organization_name":"Taylor & Francis","host_organization_lineage":["https://openalex.org/P4310320547","https://openalex.org/P4310320449"],"host_organization_lineage_names":["Taylor & Francis","Informa"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Enterprise Information Systems","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W2472097883","https://openalex.org/W2755650610","https://openalex.org/W2914692020","https://openalex.org/W3022249433","https://openalex.org/W3131632839","https://openalex.org/W3158968632","https://openalex.org/W4200579948","https://openalex.org/W4214938748","https://openalex.org/W4223972832","https://openalex.org/W4280537136","https://openalex.org/W4296898178","https://openalex.org/W4315497982","https://openalex.org/W4320019812","https://openalex.org/W4362681962","https://openalex.org/W4368232268","https://openalex.org/W4385562826","https://openalex.org/W4388553227","https://openalex.org/W4395681556","https://openalex.org/W4399061734","https://openalex.org/W4401149290","https://openalex.org/W4403107363","https://openalex.org/W4407994814","https://openalex.org/W4413129974","https://openalex.org/W4413967541","https://openalex.org/W4416703057","https://openalex.org/W4417336745","https://openalex.org/W7124461783","https://openalex.org/W7201957884"],"related_works":["https://openalex.org/W7204248937","https://openalex.org/W7169792255","https://openalex.org/W7165938666","https://openalex.org/W4285266025","https://openalex.org/W3022249433","https://openalex.org/W3203504702","https://openalex.org/W7220810168","https://openalex.org/W7155020834","https://openalex.org/W3158968632","https://openalex.org/W7164836874"],"abstract_inverted_index":{"Small":[0],"and":[1,15,36,39,45,51,87,119,142,192,223],"medium":[2],"enterprises":[3],"(SMEs)":[4],"often":[5],"need":[6],"to":[7],"prioritize":[8],"cyber":[9],"risk":[10,232],"with":[11,80,133,145],"limited":[12],"staff,":[13],"data":[14],"assessment":[16],"capacity.":[17],"The":[18,123,211],"Common":[19],"Vulnerability":[20],"Scoring":[21,71],"System":[22],"(CVSS)":[23],"scores":[24,147],"vulnerability":[25],"severity,":[26],"Factor":[27],"Analysis":[28],"of":[29,43,130,148],"Information":[30],"Risk":[31],"(FAIR)":[32],"depends":[33],"on":[34,100],"loss-frequency":[35],"loss-magnitude":[37],"inputs":[38],"the":[40,68,156,165,176,185,195],"National":[41],"Institute":[42],"Standards":[44],"Technology":[46],"(NIST)":[47],"Cybersecurity":[48],"Framework":[49],"(CSF)":[50],"Center":[52],"for":[53,135,175],"Internet":[54],"Security":[55],"(CIS)":[56],"Controls":[57],"do":[58,199],"not":[59,200],"prescribe":[60],"a":[61,76,81,88,106,127,215],"compact":[62],"SME-specific":[63],"organizational":[64],"score.":[65],"We":[66,95],"propose":[67],"Proportionate":[69],"Defense":[70],"Model":[72],"(MPDS),":[73],"which":[74],"combines":[75],"NIST-aligned":[77],"base":[78],"score":[79,129,189],"binary":[82],"Critical":[83],"Failure":[84],"Constraint":[85],"(\u03a9)":[86],"multiplicative":[89],"Shadow":[90],"IT":[91],"Decay":[92],"Function":[93],"(\u03a8).":[94],"evaluate":[96],"its":[97],"scoring":[98,217],"behavior":[99],"1,000":[101],"synthetic":[102,196],"SME":[103,231],"profiles":[104,138,144],"using":[105],"paired":[107],"CIS":[108,209],"Implementation":[109],"Group":[110],"1":[111],"(IG1)-style":[112],"additive":[113,124,146],"baseline,":[114],"component":[115],"ablations,":[116],"sensitivity":[117],"analysis":[118],"scenario-based":[120],"stress":[121],"tests.":[122],"baseline":[125],"has":[126],"mean":[128],"65.25,":[131],"compared":[132],"44.06":[134],"MPDS;":[136],"766":[137],"change":[139],"rating":[140,193],"band,":[141],"107":[143],"at":[149],"least":[150],"70":[151],"fall":[152],"below":[153],"50":[154],"under":[155,194],"full":[157],"model.":[158],"Component":[159],"ablations":[160],"show":[161,183],"that":[162,219],"\u03a9":[163],"produces":[164],"zero-score":[166],"cases":[167],"when":[168],"survival-critical":[169,221],"requirements":[170],"fail,":[171],"while":[172],"\u03a8":[173],"accounts":[174],"full-model":[177],"reduction":[178],"whenever":[179],"\u03a9=1.":[180],"These":[181],"results":[182],"how":[184],"two":[186],"mechanisms":[187],"alter":[188],"magnitude,":[190],"ranking":[191],"assumptions.":[197],"They":[198],"establish":[201],"real-world":[202],"breach":[203],"prediction":[204],"or":[205],"empirical":[206],"superiority":[207],"over":[208],"IG1.":[210],"main":[212],"contribution":[213],"is":[214],"formal":[216],"architecture":[218],"makes":[220],"failures":[222],"unmanaged":[224],"Software-as-a-Service":[225],"(SaaS)":[226],"exposure":[227],"explicit":[228],"in":[229],"resource-constrained":[230],"prioritization.":[233]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}