Adapting NIST CSF 2.0 Framework to Enhance Cybersecurity Readiness Against Phishing in SMEs in Yemen

Abstract

Small and medium-sized educational institutions in Yemen face significant challenges in building cybersecurity readiness, particularly against phishing attacks, which serve as a primary gateway to more sophisticated threats given the absence of formal policies and weak behavioral awareness. This study proposes a practical model for adapting the NIST CSF 2.0 framework to this resource-constrained context. A quasi-experimental methodology was conducted across four sequential stages: risk assessment, framework adaptation using low-cost administrative and technical controls, expert validation of the model's validity and acceptability, and final effectiveness evaluation through phishing simulations along with measurement of perceived awareness before and after the intervention. The results showed statistically significant improvements: the click rate on suspicious links decreased from 30% to 10%, while the reporting rate increased from 10% to 45%. Expert evaluation yielded a mean total score of 3.9 out of 5, with a standard deviation of 0.41, reflecting good model acceptance and consensus among experts. The study demonstrates that flexible adaptation of global frameworks using affordable technologies and simplified procedures can achieve tangible cybersecurity improvements for such institutions, thereby enhancing cybersecurity as an indispensable pillar for sustainability in the digital age.