ABSTRACT Cybersecurity is a critical global concern, particularly for small‐ and medium‐sized enterprises (SMEs) with limited resources and expertise. The authors are developing CyberESP, a tailored cybersecurity framework supported by a semi‐automated tool to ensure Spanish SMEs' cybersecurity management. Following the Design Science Research (DSR) methodology and grounded in international standards, the authors identified six requirements to be satisfied by a cybersecurity framework for SMEs, which should support the identification of assets, vulnerabilities, threats, and risks. This paper presents the first part of the CyberESP framework dealing with asset management, particularly their identification and analysis of dimensions and cost. A prototype supporting these activities was developed and validated through a case study in a retail SME, showing the solution's potential and identifying particular improvements. The paper also addresses threats to validity and limitations, noting the framework's focus on hardware, software, and networks. Future work includes vulnerability management and will explore the use of cloud and IoT deployment, positioning CyberESP as a practical solution to enhance SMEs' cybersecurity resilience.

Cybersecurity continues to be one of the principal issues in the computing environment. Organizations and researchers have made various efforts to mitigate the risks of cyberspace. The treatment of cyber risk is a fundamental stage in risk management. In the risk treatment stage, countermeasures are carried out to reduce the probability of risk materialization. This article presents a systematic mapping review of the principal catalogues/taxonomies of countermeasures applied in cybersecurity, involving studies between 2010 and 2021. Seventy-four (74) studies were assessed, and 25 studies were selected for further analysis. We identified 26 catalogues/taxonomies used to address cybersecurity-related risks. After analyzing these 26 catalogues/taxonomies, we identified: (1) the related trends, (2) the type of risks and sectors that these catalogues/taxonomies focus on, (3) the complexity of these taxonomies, and (4) what mentions they make about residual risk. We have identified that institutional taxonomies, which were not created for cybersecurity risks, are fitted for this purpose. The predominant risks in these taxonomies are those related to awareness and cyber-attacks. We note that the complexity of the catalogues/taxonomies is defined by the number of taxa and the number of countermeasures. Another relevant result is the lack of complexity in non-institutional catalogues/taxonomies. Finally, we have identified a lack of relevant information on residual risk in the studies.

The growing interest of software companies for improving their internal processes, not just software development processes, but also processes in other domains such as Information Technology (IT) service management or information security management, has encouraged these companies to implement recognized models or standards. Most of the ISO standards that define models for software quality, IT service management or information security management provide their recommendations, guidelines, requirements or good practices under a process approach. Due to this approach, there are a large number of relations between these models as well as many common elements. From the study of these relations, this paper presents MIN-ITs, a new framework that supports the integration of different ISO standards related to IT management.

ABSTRACT Most organizations that use the Capability Maturity Model Integration (CMMI) stop their process improvement journey at Maturity Level 3 or less. The discussion about CMMI high‐maturity levels has always been controversial, going most of the times through the consideration of return of investment, provider selection, and interpretation issues. Achieving Level 5 is not an easy task; it derives a lot of steps during the way. This article will show an example of the implementation of Level 5 in a consultancy company in two constellations: development and service. It depicts the example in steps, to help the understanding of the whole process. Copyright © 2014 John Wiley & Sons, Ltd.

Currently, software acquisition is strategic for organizations. Companies need support to succeed in software acquisition projects because such projects commonly present high failure rates. To solve this problem, it is necessary to design mechanisms for software acquisition, such as risk classification to identify the typical risks that may affect the success of a software acquisition project. Thus, herein, we present a case study, showing the implementation of a risk taxonomy whose structure is designed using a method for its construction, with a mechanism to reduce the risk of acquisition projects that adversely affect their success.

SUMMARY This paper describes a multi‐model methodology that implements a smooth and continuous process improvement, depending on the organization's business goals and allowing users to establish their improvement implementation pace. The methodology focuses on basic process components known as ‘best practices’. Besides, it covers following the topics: knowledge management and change management. The methodology description and the results of a case study on project management process are included. Copyright © 2010 John Wiley & Sons, Ltd.

SUMMARY Top‐down process improvement approaches provide a high‐level model of what the process of a software development organization should be. Such models are based on the consensus of a designated working group on how software should be developed or maintained. They are very useful in that they provide general guidelines on where to start improving, and in which order. However, the majority of them have only worked in scenarios within large companies. We aim to help small software development organizations to adopt an iterative approach by providing a Process Improvement Web‐based Tool (SysProVal). This paper presents research into the proposal that a small organization may use this tool to define and implement a set of project management practices that can be strengthened using the CMMI‐DEV 1.2 model as reference. Copyright © 2010 John Wiley & Sons, Ltd.

This paper presents a case study that describes TSPi teaching (Introduction to the Team Software Process) to 4th year students, grouped by teams, at the Computer Science School, Polytechnic University of Madrid (UPM). The achievements of the teams, due to training and the use of TSPi, were analyzed and discussed. This paper briefly discusses the approach to the teaching and some of the issues that were identified. The teams collected data on the projects developed. They reviewed the schedule and quality status weekly. The metrics selected to analyze the impact on the students were: size, effort, productivity, costs and defects density. These metrics were chosen to analyze teams' performance evolution through project development. This paper also presents a study related to the evolution of estimation, quality and productivity improvements these teams obtained. This study will prove that training in TSPi has a positive impact on getting better estimations, reducing costs, improving productivity, and decreasing defect density. Finally, the teams' performance are analyzed.

Team Software Process is an integrated framework that guides development teams in producing high-quality software-intensive systems. This paper analyzes the effects of TSPi training and the improvements achieved by 44 teams, comprising fourth-year students on the software engineering degree programme, corresponding to two academic years. This study shows the benefits of using defined models such as TSPi to improve the students’ skills and knowledge. The metrics of size and effort estimation, defects, productivity and costs are collected to measure the improvements through two development cycles.