The company has carried out a cybersecurity self-assessment. The results show that staff skills need to be strengthened, contingency planning needs to be improved, and action needs to be taken in response to some of the identified risks. A clear picture of the current situation has therefore been obtained. But what happens next?
It is precisely this question that the KULTTI project - Integrating Cybersecurity into SME Strategy and Security Culture - is seeking to address by working with companies to find practical solutions.
An identified risk is merely a starting point
The development of cyber security should not stop at assessing the current situation. The assessment helps to identify shortcomings and risks, but the next question is at least as important: what do we do next?
Take, for example, a small business where it is noticed that staff do not have a consistent approach to handling suspicious emails. A development measure could be a clear reporting channel, standardised guidelines and staff training.
In another company, a self-assessment might highlight the issue of backups. Backups do exist, but no one has tested for a long time whether they can actually be used to restore data and systems that are critical to business operations. In this case, the next step is not a new assessment, but testing the recovery process and documenting the procedure.
In a third company, the key risk may lie outside the organisation itself. What happens if the system of a supplier critical to the business is unavailable? Has the dependency been identified and have preparations been made for this situation?
The examples vary, but they are united by the same idea: simply identifying a risk does not in itself reduce it. A decision is needed on what to do, who will do it, and what will be monitored following the action taken.
People are a vital part of cybersecurity
Nor can all areas for improvement be resolved through technology alone. The importance of a security culture is emphasised when various attempts at fraud are part of everyday working life.
In an EU-wide survey published by ENISA (the European Union Agency for Cybersecurity) in September 2026, 74 per cent of employees reported having encountered suspicious emails, messages, phone calls or links at work during the previous six months. By contrast, only 45 per cent said their organisation regularly shared information on cybersecurity or updates to raise awareness. On a positive note, there is a willingness to learn: 85 per cent of respondents were interested in developing their cybersecurity skills.
In practice, developing an information security culture means, for example, that an employee can recognise a suspicious situation, knows how to respond to it and to whom to report their findings. At the same time, it is management’s responsibility to ensure that there are common practices and conditions in place for secure operations.
From self-assessment to a practical operating model
The KULTTI project is developing a practical operating model for SMEs, which will enable identified cyber risks and areas for improvement to be prioritised and translated into concrete measures.
The work builds on the cyber security self-assessment tool developed in the earlier ‘Cyber Security for Industry in Satakunta’ (Kytee) project. The aim of the KULTTI project is to take this work a step further and build an operational model around the self-assessment that supports companies even after the assessment has been completed.
However, not everything needs to be resolved at once. The key is to identify the risks that are most significant for the business and to target development measures where their impact is greatest. Cyber security affects business continuity, operational reliability and competitiveness, so it should be reflected in a company’s management, risk management and decision-making in the same way as other risks affecting business operations.
We are now looking for pilot companies
The KULTTI project invites SMEs from various sectors in Satakunta to join in developing and piloting the operating model.
Together with the pilot companies, we will assess the current state of cyber security, identify key cyber risks and areas for improvement, and seek concrete ways to address them. At the same time, the companies’ experiences will help shape the operational model so that it meets the real needs of SMEs and can be put to practical use in day-to-day operations.
No prior cybersecurity expertise is required to take part. The most important thing is an interest in developing your organisation’s cybersecurity and information security culture.
Interested? Get in touch and join the KULTTI project as a pilot company.
