Enhancing Information Security in Technology Small and Medium-Sized Enterprises: A Metrics-Driven Model Based on ISO/IEC 27001:2022

This paper designs and evaluates an Information Security Management System (ISMS) model tailored for technology-sector Small and Medium-sized Enterprises (SMEs) in Metropolitan Lima. The model integrates the International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001:2022 standard with operational guidance from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 and incorporates decision-support frameworks such as Factor Analysis of Information Risk (FAIR) (for economic impact assessment) and Common Vulnerability Scoring System (CVSS) v3.1 (for vulnerability severity). Structured around the Plan–Do–Check–Act (PDCA) cycle, the model introduces three custom metrics—the Global Model Compliance Metric (GMCM), the Improvement Index per Evaluation Cycle (IIEC), and the Associated Residual Risk Index (ARRI)—to monitor maturity progression and residual risk levels. A six-month pre- and post-implementation evaluation in a single SME showed a 9-percentage-point increase in GMCM and a 22-percentage-point reduction in ARRI, reflecting an improved security control posture while acknowledging the constraints of short-term assessment. The paper presents the theoretical foundation for the proposed hybridization, details the ISO–NIST control mapping, formalizes the new metrics, and explains how FAIR and CVSS jointly inform prioritization. Finally, it discusses threats to validity and outlines a practical adoption roadmap for SMEs. The generalization of results remains tentative and calls for longitudinal replication across multiple organizations.