Cybersecurity Framework for Cloud-Based Websites and E-Business Platforms in U.S. SMEs: Defending Against Credential Theft, Payment Fraud, and Ransomware

Abstract

Small and medium-sized enterprises (SMEs) in the United States are increasingly adopting cloud-based e-business platforms to enhance operational efficiency, drive growth, and remain competitive in the digital economy. While cloud computing offers benefits such as scalability, cost reduction, and flexibility, it also exposes small and medium-sized enterprises (SMEs) to significant cybersecurity threats. Credential theft, payment fraud, and ransomware attacks are among the most prevalent and damaging risks, often resulting in severe financial losses and reputational harm.

Compared to larger corporations, SMEs typically lack the security infrastructure, expertise, and financial capacity to defend against such threats. To address this vulnerability, this paper proposes a cybersecurity framework tailored explicitly for U.S. small and medium-sized enterprises (SMEs) operating in cloud-based environments. The framework is designed to be affordable, modularly scalable, and practical for resource-constrained settings. It integrates six key components: identity and access management, data protection, endpoint security, incident response, employee training, and regulatory compliance.

A hypothetical case study is used to illustrate the framework’s real-world applicability. At the same time, a comparative evaluation with the NIST Cybersecurity Framework (CSF) and ISO/IEC 27001 demonstrates its alignment with recognized best practices. This research provides a strategic pathway for SMEs to strengthen their cybersecurity posture and establish long-term digital resilience.