A Control Framework for a Secure Internet of Things within Small-, Medium-, and Micro-Sized Enterprises in a Developing Economy

Abstract

Small and medium enterprises (SMEs) play a critical role in the economic growth of a nation, and their significance is increasingly acknowledged. More than 90% of commercial establishments, almost 70f% of jobs, and 55% of the GDP are held by SMEs in mature economies. Additionally, this sector accounts for 70% of employment possibilities and up to 40% of the GDP in developing countries. Technologically, the Internet of Things (IoT) enables multiple connected devices, i.e., “things”, to add value to businesses, as they can communicate and send messages or signals promptly. In this article, we investigate various challenges SMEs experience in IoT adoption to further their businesses. Amongst others, the challenges elicited include IoT considerations for SMEs, data, financial availability, and challenges related to the SME environment. Having analysed the challenges, a three-tiered solution framework coined the Secure IoT Control Framework (SIoTCF) to address the said challenges is developed and briefly validated through a theoretical analysis of the elements of the framework. It is hoped that the proposed framework will assist with aspects of design, governance, and maintenance in enhancing the security levels of IoT adoption and usage in SMEs, especially start-ups or less experienced SMEs. Future work in this area will involve surveying SME owners and ICT staff to validate the utility of the SIoTCF further. The study adds to the body of knowledge in general by developing a secure IoT control framework. In the field of ICT, this paradigm is expected to be useful for academics, researchers, and students.

1. Introduction

The Internet of Things (IoT) enables multiple connected devices, “things”, to add value to the business as they are able to communicate and send messages or signals across in a timely manner [1]. The study’s recommendations are intended to help SME management or owners improve their secure IoT practices. The recommendations will direct the organisation on how to create value and generate performance outcomes that are noticeably improved. They will also direct the organisation to the right activities to take from an IoT practice viewpoint. Additionally, the organisation may gain a competitive edge by deploying the IoT control framework, which can potentially be one of the company’s key technologies. In the end, the study’s conclusions will have a big influence, offer a lot of value to IoT practice, and advance the IT discipline.

A control framework from an IoT practice and theory point of view ought to guarantee that there are components set up to authorise safety efforts and eliminate any possible vulnerability [2]. Moving to a promising period of the IoT, pervasively, little-inserted devices are fitted with different sensors, and by 2020, 26 billion devices will be connected to the world [3]. Cybersecurity events have demonstrated that IoT devices may be used to breach owner privacy or wreak havoc on data security [4]. Although the Internet of Things has emerged as a crucial infrastructure for creating intelligent ecosystems, the widespread use of unsecured IoT devices has already made them more susceptible to cyberattacks and other crimes online [5]. This means that with the adoption of IoT, which is defined as things that are designed to communicate with each other, mostly through sensors, systems, and devices (and these can be appliances, electronic devices, and cars) [6], IoT services are becoming crucial for resolving problems SMEs encounter, such as those related to the security, cost-effectiveness, and accessibility of ICT resources, including software and hardware (IoT) [7]. However, these businesses face both possibilities and difficulties with the rise of IoT. The heterogeneity of devices and technologies that are utilised in providing services greatly affects the interoperability and administration of IoT devices [2]. Furthermore, numerous devices have compelled assets and restricted computational capacities and are sent in open situations (e.g., water meters), which makes them inclined to be controlled or decimated by malevolent individuals. Thus, ensuring the security of the IoT is a troublesome yet essential assignment [8]. In the IoT environment, security attacks are prevented by secure measurements, and one of them is authenticity. The correct application of authenticity can prevent attackers from impersonating authorised users [9].

SMEs system have security vulnerabilities due to the technologies and IoT involved. The integration of the systems from the smart factory perspective increases the security challenges in SMEs and makes it more complex to manage security risks [10]. SMEs are often described by quantitative parameters such as the staff count, total capital, total assets, and sales volume [2], and according to [5] the importance of SMEs in economic growth is increasingly acknowledged. SMEs make up more than 90% of commercial enterprises, roughly 70% of employment, and 55% of the GDP in industrialised economies, according to [6]. This sector also generates up to 40% of the GDP of developing nations and accounts for 70% of employment opportunities [7]. Additionally, SMEs account for almost 99% of all businesses in the EU-28 and more than 66 percent of all employees [8]. Therefore, maintaining sensible competition in the present market and ensuring long-term survival is crucial for this category.

The way SMEs operate, cause change, and collaborate may be impacted positively through the IoT, and different manufacturers will have significant improvements through strategically connected environments [10]. IoT security vulnerability awareness should be inculcated in the staff that are going to use the implemented ideas in their daily tasks, such as planning, monitoring, control, operations, and production, from an IoT practice perspective [11]. The use of interconnected devices and systems for business process purposes makes IoT extra vulnerable from a security perspective. Intellectual property (IP) and crucial whilst sensitive information are the most targeted facets of the business from a cyber-criminal perspective [12]. There are a few SMEs that consider securing their products and services [13]. Due to the fact that the number of devices increases daily, and their utilisation has become a vital part of regular day-to-day existence, security and individual well-being issues will emerge. Security concerns are observed to repress the take-up of IoT and cloud services, particularly regarding sensitive information within SMEs [14].

According to [15], only when technology such as IoT smart devices started to advance did the world start to encounter numerous security challenges from these devices. Security challenges are not only a concern and a challenge for organisations but also manufacturers as well [16]. Consequently, this study aims to develop a control framework that uses the IoT to address security challenges for SMEs in a developing economy.

Organisations require agility in their activities, whether it be via services or goods, because SMEs face many challenges from competitors. An organisation should endeavour to lead the market and shorten the time to market. The IoT is a crucial component of technology that may improve business outcomes. IoT security concerns are some of the main problems, and they need to be managed effectively and productively from the standpoint of security framework challenges. According to IoT theory and practice, a control architecture should ensure that components are in place to authorise safety activities and eliminate any potential vulnerabilities [17]. By establishing a conceptual framework to handle the IoT challenges that SMEs are confronted with in a developing economy from a security viewpoint, the study adds to the increasing literature and the body of knowledge in general. In the field of ICT, this paradigm is expected to be useful for academics, researchers, and students. By suggesting the processes and risk mitigation strategies to use in an IoT for sustained competitive advantage and an organisation’s success, it will also offer a useful contribution to SMEs.

2. Background to the Study

SMEs are crucial to the growth of a nation’s economy. SMEs are defined in a variety of ways, and each definition varies depending on the organisation. Generally, SMEs are classified according to a series of numerical standards, including the number of workers, total capital, total assets, and sales volume [2]. The significance of SMEs in economic growth is increasingly being acknowledged, claims [5]. SMEs make up more than 90% of commercial enterprises, roughly 70% of employment, and 55% of the GDP in industrialised economies, according to [6]. This sector also generates up to 40% of the GDP of developing nations and accounts for 70% of employment opportunities [7]. Additionally, SMEs account for almost 99% of all businesses in the EU-28 and more than 66 percent of all employees [8]. It is crucial for this market segment to survive in the long term and to stay intelligently competitive.

As a result, SMEs are considered to be the main forces behind innovation in the economy of a nation’s sectors. This indicates that when the IoT gets adopted, which is defined as items that are meant to connect with one another, often through sensors, systems, and devices (and these can be appliances, electronic devices, and automobiles [6]), more of these types of interactions will occur. IoT services are crucial for resolving problems SMEs encounter, such as those related to the security, cost-effectiveness, and accessibility of ICT resources, including software and hardware (IoT) [10]. However, these businesses face both possibilities and difficulties with the rise of the IoT.

3. Problem Statement

The IoT is anticipated to have a favourable influence on how SMEs interact, operate, and bring about change. Different manufacturers will see major advancements thanks to strategically linked settings [10]. As new ideas that may help organisations are offered, innovation may play a big role in drawing attackers. As a result, attackers will take advantage of this possibility to profit from whatever helps organisations. To make sure that the drive to innovate does not present obstacles to an organisation from the standpoint of security risks, there should be intelligent IoT security measures that go along with the execution of its practices and new ideas. Additionally, the personnel who will utilise the implemented concepts for everyday duties such as planning, monitoring, controlling, operating, and producing from an IoT practice viewpoint should be made aware [14]. The use of linked devices and systems for business activities makes the Internet of Things (IoT) more security-vulnerable. From a cybercriminal standpoint, intellectual property (IP) and vital yet sensitive information are the company aspects that are most frequently targeted [15].

4. Research Question, Aim, and Objectives

The research question addressed in this research is:

• What are the challenges with IoT adoption in SMEs?

The aim of the study is to:

• Develop a control framework that uses the IoT to address security challenges for SMEs in a developing economy (aim).

In achieving the above aim, our objectives are to:

• Identify IoT-related aspects that ought to be included in a control framework for SME IoT security (Obj1);
• Identify some of the existing IoT frameworks (Obj2).

5. Literature Review

Our literature review (LR) is aimed at synthesising and critiquing aspects that are relevant to aspects of control frameworks, IoT, and SMEs. Owing to the fine blend of academic aspects interspersed with industry-related aspects in our work, our literature review explores and explains the business research problem from a theoretical perspective. It further identifies the trends of the study about the relationship between variables and probes existing theoretical research [18,19,20].

We start with a presentation of IoT perspectives as per the extant literature.

5.1. The Common Definitions of IoT

The following definitions for the IoT have been proposed:

• The IoT is a paradigm in which common things may be given identification, sensing, networking, and processing skills that let them connect with one another and with other devices and services through the Internet to achieve a goal [21,22];
• The IoT is a collection of physical items that are connected to a network and incorporated with sensors or actuators. Additionally, because the IoT creates advantageous network externalities, broad government use will encourage business adoption [23];
• The platform, which incorporates the shared resources used by ecosystem participants, is the central component of the IoT. An IoT platform’s success depends on the existence of a business ecosystem of organisations where the purchasers, suppliers, and producers of related goods and services, as well as their socioeconomic environment, collectively offer a range of IoT end-user applications, goods, and services [24];
• The “things” are designed to communicate with others, mostly through sensors, systems, and devices (these can be appliances, electronics devices, and cars) [6].

For our purposes, we adopt the definitions used by [23,24], stating that the IoT is an environment where physical devices and objects are connected and communicate with each other through sensors or actuators to serve a specific purpose. These devices can serve various purposes, be it business, home usage, health system, or even government usage, such as streetlights, smart meter readings (water and electricity), and smart buildings. From an SME perspective, the IoT is used for a variety of purposes, such as enabling applications, products, and services for end-users in a digitalised manner.

5.2. Why SMEs Need Digitalisation Systems such as the IoT

Simply put, SMEs may adopt innovative strategies for supposedly insurmountable sustainable business difficulties through the growth of their digital leadership [25]. These are generally referred to as the managers’ or decision-maker’s digital performance, which results in a process of sustainable digital transformation. Digital leaders are required to negotiate this digital change in accordance with sustainable company objectives, since digitalisation is currently a major strategic issue for SMEs [26]. As a result, whose businesses may flourish in the future of SMEs will depend on the successes of digital leaders [27]. The development of new technology-oriented strategies at all levels with digital leadership and competitive positioning from decision-makers promotes organisational performance and increases business value according to a number of experts [28,29,30]. It is noteworthy that extraordinary leadership is required for business projects to attain sustainable success or long-term market success [31].

SMEs may use digital technologies, such as IoT, to discover new business markets and optimisation opportunities that will help them succeed or develop [32,33,34]. In reality, a large number of decision-makers across a variety of industries have realised that how their businesses respond to current digitalisation issues will likely determine whether they succeed or fail [35]. One study [36] anticipates that by the end of 2023, at least 50% of the world’s GDP will be digital. Organisations will spend in the order of $2.3 trillion USD on appropriate next-generation technology over the course of the next five years alone in order to advance these new digital initiatives. Recent efforts by OECD countries to increase SME technology adoption competence, foster digital connectivity, and expand SME connections to global technology and innovation networks have come together [37].

5.3. The Challenges of SMEs That Have already Embarked Unsuccessfully on the Use of the IoT

The IoT can have lucrative advantages for sustainable business while also reducing its negative effects on the environment [38]. IoT usage in SMEs is, however, challenged by a number of issues. The quality of and assistance for the usage of the devices are the key barriers to IoT adoption in SMEs [38]. In Australia, for instance, the deployment of the IoT did not result in many profitable companies achieving positive returns on investment until 2016 [39]. However, it is anticipated that Australian SMEs will in the future play a larger role in the agricultural sector.

The general challenges related to IoT usage revolve around the value, quality, and access of data and access to the Internet. These are briefly considered next.

5.3.1. Perceived Value of Data

Data usage and maintenance have become challenges amongst SMEs for both local and global organisations in all sectors. Amongst others, in agriculture, farm-based data are crucial for enhanced decision-making processes, while regional data can be used to assess the companies’ performance through the benchmarking process [40]. Such data are also important for biosecurity management, natural resource management, research, and policy formulation [40]. The perceived value of the data is an important part of our framework.

5.3.2. Data Quality and Access

Different IoT devices have different measures and require management personnel to have different approaches concerning the use of data. Additionally, the data ought to be scalable and interoperable so as to build on wide data streams and networks to enable efficient analyses. Correct IoT usage requires data of a sufficient scale, quantity, accuracy, and resolution [41]. As a result, the use of IoT requires that there be access to data from several years to enhance efficient agricultural operations and be able to make effective decisions [41].

Access to high-quality IoT data is important for developing-economy SMEs; consequently, such data are part of our framework.

5.3.3. Internet Access

Access to fast Internet is one of the IoT challenges as devices require a reliable and fast Internet connection. Notably, access to the Internet in the rural parts of a developing economy can be a major impediment [41]. The IoT wave is expected to be more than 5G in the not-so-distant future, which means that SMEs would have to look for higher Internet access in a developing economy [41]. Our work is mostly about IoT aspects; therefore, these form important parts of our framework.

Next, we turn our attention to IoT-related challenges for SMEs.

5.4. Challenges for SMEs Entering the IoT World

The IoT and digitalisation have been the subjects of much debate. In the media and online, phrases such as “any business or business domain can be disrupted at any time by IoT” are often used [42]. This leads to a form of “digital anxiety,” or high levels of tension without necessarily providing solutions for moving forward [42].

It might not be feasible for a small organisation such as an SME with 10 to 20 employees [43] to hire numerous individuals to gain access to IoT knowledge. As a result, it may be challenging to even consider a change in product categories, manufacturing processes, or business models.

5.5. Challenges of the IoT in SMEs

Concerning the IoT challenges, resource limitations and cyber security coupled with privacy have been identified as two of the many probable challenges of the IoT [44]. These challenges are discussed next, with further IoT challenges discussed in the subsections that follow thereafter.

Probable IoT Challenges

Resource limitations: One study [44] indicates that scheduling and locating communication and task sensors among the many different types of devices that have sensing capabilities may be a rather challenging undertaking.

One of the main resource challenges is for mobile devices to sense and collect data, as they are required to be high-powered in their capabilities and availability, e.g., predicting the bandwidth and energy requirements in an IoT application [44].

Cyber security and privacy: Four levels make up the Internet of Things: data collection, transmission, service, and interfacing [3,45,46,47,48,49]. As an illustration, data related to smart buildings include information on the thermostat settings, the condition of the windows and doors, the occupancy of the rooms, the building’s materials and construction, and many other things, in addition to information on energy usage and weather. Therefore, it is a challenging task to convert social factors and biological and physical data into a succinct and suggestive electrical signal. For example, appliance acoustics, use, infrared signatures, motion detection, vibration, imaging, disturbances, and many other factors may be used to determine the occupancy in a building; however, they all just serve as noisy indicators of room occupancy [50].

Despite its challenges, particularly for SMEs, the IoT is expected to revolutionise the commercial world. Data collection is one area that is expected to expand quickly and is seen as the new asset and fuel for businesses in the twenty-first century [51]. Data processing and translation can give businesses fresh, original insights for improved strategic decision-making and forecasting [51].

Amongst other things, our framework developed in this article duly takes cognizance of the above IoT challenges for developing-economy IoTs, as indicated by the three levels of IoT challenges in the framework.

5.6. Security Challenges in the IoT

Privacy, standards, legality, and data manipulation are some of the IoT security challenges that the world has been facing in recent years. It is of paramount importance to protect and secure IoT platforms from vulnerabilities. Arguably, similar IoT security issues manifest within SMEs. Consequently, these challenges should be recognised when the advantages of the IoT are considered [52]. In the following sections, we unpack these challenges with respect to communication, threats, supply chains, smart SMEs, intellectual property, sensitive information, and product development.

5.6.1. Communication Challenges in the IoT

The industrial IoT (IIoT) relates to how industrial systems are integrated with their processes—the integration element might cause challenges in transporting information [53,54]. Furthermore, it combines innovations that exist owing to technology [53,54]. The emergence of the IoT/IIoT is the recognition of the technology that emanates from ICT and human capital. These boost the economy (through SMEs) and elevate the industrial IoT through cyber innovation from an IoT perspective [53,54]. One study [55] argues that the industrial IoT is the integration of all physical devices and channels that are linked through digitisation and digital value chain associations in the organisation. Device-to-device (D2D) communication through sensors and other machinery transports messages and signals from a cyber-technology perspective.

In SME product development, sensors create processes that cater to produce services and products to enable the organisation to gain a competitive advantage, which ultimately integrates with cyber-technologies. These facilitate much-improved communication from a cost-effective and IoT perspective [56,57]. It is, therefore, evident that the IoT has impacted various SMEs in a positive manner from customer growth and revenue increase perspectives. Furthermore, with respect to manufacturing, factories in recent years have been dependent on sensors with IoT capability to collect and organise data in the form of a data warehouse to drive daily operations and production and to generate revenue accordingly [53].

5.6.2. IoT Security Threats

The integration of the systems from a smart factory perspective increases the security challenges in SMEs and makes it more complex to manage security risks. Vulnerabilities are caused owing to the fact that the infrastructure in the SMEs involves external and internal system connections for smoother communication and information processing [10,14]. It follows that the IoT needs to focus on security threats that occur most often and ensure that there are mechanisms in place to mitigate most—if not all—security risks [10,14].

5.6.3. IoT Systems and Supply Chain

Suppliers can be the root cause of security vulnerabilities such as stolen information (login details), and this results in company exposure from a security threats (or vulnerabilities) perspective [14]. There is more efficiency and ability in the supply chain environments, which assists to connect more of the IoT features across system entities, albeit these systems readily attract attackers and are exploited quite often [14].

5.6.4. Smart SMEs and Security

The way SMEs operate, collaborate, and effect change will be impacted positively through the IoT, and different manufacturers will have significant improvements through strategically connected environments [10]. Innovation can be the root cause of attracting attackers as new ideas that will benefit the organisations are being introduced. There should be smart security measures that come together with the implementation of new ideas to ensure that the initiative to innovate does not introduce side effects in the form of additional challenges to an organisation from a security vulnerabilities perspective [14]. Furthermore, awareness should be inculcated in staff that are going to use these ideas in their daily tasks, such as planning, monitoring, control, operations, and production [14].

5.6.5. Cyber Security, Intellectual Property, and Sensitive Information

As indicated before, numerous facets need to be factored in when it comes to IoT security. Amongst others, the protection of intellectual property (IP) is crucial; sensitive information is the highest targeted resource in the business from a cyber-criminal perspective [15]. Therefore, to manage and secure sensitive information in the IoT, confidentiality must be strongly adhered to [15]. Cybersecurity incidents have shown that IoT devices can be harnessed to breach data security or compromise the privacy of their owners [4].

Protecting sensitive information, especially during the migration from one platform to another, deserves special consideration.

5.6.6. Challenges in Securing IoT Products

Digital transformation is one of the concerning areas in SMEs from an IT perspective. Hence, it remains hard to use the IoT to drive productivity and at the same time reduce the time to market (TTM). There is a scarcity of product development and innovative ideas within SMEs. There are relatively few SMEs that consider securing their products and services [16]. One study [18] argues that only when technology such as the IoT and smart devices started to advance did the world start to encounter numerous security challenges from these devices. Security challenges are not only a concern and a challenge for organisations but manufacturers as well, as acknowledged by [19]. The IoT enhances sensor capabilities such as part-following, screen hardware, and task guiding from an assembling point of view. Everyday appliances, including televisions, washing machines, and vehicles, as well as modern things such as siphons and shipping holders, are advanced through IoT innovation [58]. The IoT brings much more flexibility to SMEs, as it elevates the platform to automate processes and increase their operations from a productivity perspective [59]. Within SMEs, it might not be possible and affordable for the business owners to recruit an expert to address their IT challenges from an IoT perspective, hindering them in expanding their offerings and implementing strategic business models [45]. Understanding the ecosystem that surrounds IoT goods and being able to apply exactly the right amount of general business knowledge to an IoT-based system is essential to comprehending the setting in which such IoT items will be used. The simple definition of the IoT is that it involves connecting objects, opening up verticals, and producing beneficial energy through open data sharing and data analyses [58].

In line with the above considerations, communication, threats, protection of supply chains, smart SMEs, intellectual property, and product development all form part of our framework.

5.7. Managerial, Financial, Legal, Labour, and Environmental IoT Challenges in SMEs

Although enterprises make important contributions to a country’s national economy, SMEs face challenges, as indicated before. To address the said challenges, SME foundations throughout the world have been actively helping businesses to overcome these obstacles. The difficulties are either monetary, legal, or performance-related [60]. Inhibitions in the organisational structure and management pose a threat to the growth and survival of SMEs. Previous research has discovered a variety of difficulties. These include financial instability, credit restrictions, a lack of business expertise and innovation, high production and manufacturing expenses, subpar managerial abilities, problems with employee rights, and license and tax regulations. The development of SMEs in developing nations is hampered by these issues [61,62]. It has been noted that business owners with procedural backgrounds may encounter difficulties managing advancements and operational aspects of the sector [62,63,64,65].

Major external hurdles, including competition, unfavorable business environments, problems with government regulations and the rule of law, as well as the status of the economy, may potentially impede the expansion of SMEs [66]. Meeting local and international competition from established enterprises is the main problem for SMEs in the majority of emerging nations [67]. The affordability and competitiveness of SMEs in developing nations are hampered by a shortage of skilled labor, a lack of access to suitable financing, and an increase in production costs [68,69]. SME enterprises constantly struggle with regulatory and legal difficulties [70].

We discuss the above challenges in the sections that follow.

5.7.1. Financial Instability (FiS)

Since the SME sector increases the gross domestic product by lowering unemployment, lowering poverty levels, and encouraging entrepreneurship, it has a growing impact on the economy [71]. With respect to developing economies, the shortage of funding for Bangladeshi SMEs is a serious problem according to a 2002 World Bank assessment of the growth of SMEs in Bangladesh. In addition, the “Report on the Contribution of Banks to the SME Sector in Bangladesh” indicated that SMEs have never had enough money to support their operations and that their owners only very infrequently obtain financial aid, which leads to financial instability [72].

5.7.2. Financial Loans (FL)

Only around 10% of Bangladesh’s SMEs receive financing from banks, while the majority of their funding—76.5% of fixed capital and 51.8% of working capital—comes from self-financing [73]. According to studies, it has been observed that in Bangladesh, almost 89% of SMEs obtain loans from micro-finance institutions (MFIs), often at higher interest rates, because banks do not see a way to help SMEs with loans. It is also challenging to obtain fixed and working capital from banks because they are often reluctant to offer a loan of a small size at a higher rate [61,74]. Because it is often simpler to manage and assist larger clients, commercial banks typically limit lending to well-established and large-scale trade and manufacturing companies. As a result, many SMEs borrow money from friends, family members, and other acquaintances while also depleting their personal savings [75].

The Bangladeshi case is relevant to our work since the control framework developed in this article is cognizant of developing economic aspects throughout.

5.7.3. Managerial Inexperience (MiE)

Entrepreneurs also experience a barrier to the efficient functioning of their SMEs due to a lack of training, business expertise, and management experience. The majority of SME owners adopt a leadership style that stems from informal environments and cultural conventions, which may not be the best for the long-term success of the business [76]. Entrepreneurs must be able to manage their staff, as well as possess the knowledge and abilities to inspire staff members and practice talent management by assigning them to the appropriate roles inside the SME. Inexperienced business owners frequently impose these restrictions, which ultimately causes SMEs to fail [77].

It follows that considerations on managerial inexperience and skillset challenges should be part of our framework.

5.7.4. Lack of Innovation Performance (LIP)

The effectiveness of innovation inside a corporation is a key factor linked to other key factors. Any SME’s ability to produce quality goods for the market is a result of its knowledgeable workforce. When an SME has skilled and innovative workers, the organisation may have an innovation process, the performance is exceptional, and eventually that particular SME stands out and achieves a competitive advantage. On the other hand, a lack of expertise might make the SME less effective [78].

5.7.5. Regulatory Licenses and Taxes (RLT)

SMEs are under constant pressure to adhere to new laws, license requirements, and tax rules. SME operations may be significantly compromised by even a small divergence from the standards; hence, SMEs must be well aware of them [79]. Additionally, the government’s regulatory permits and taxes provide SMEs with ongoing difficulties and impede their development and operating procedures [63,80,81].

5.7.6. Competitive Environment (CE)

Competition between SMEs primarily motivates businesses to produce better, more specialised goods and services and to enter markets with a stronger focus on the needs of customers, thereby advancing SMEs [76]. However, SMEs should foster a competitive climate so that businesses may work together to advance rather than work against one another [75,76,77,78,82].

5.7.7. Increased Production Cost (IPC)

Operations management deficiencies are frequently identified as the main reason SMEs fail. The production costs increase when the operating skills are poor because of budgetary constraints and a lack of strong competition. However, a lack of innovation and even old technology might also result in higher manufacturing costs [83,84,85].

5.7.8. Rights of Employees (ER)

According to [86], employees’ rights must be recognised as an essential element in any organisation and should be regarded as one of the essential elements. The Bangladesh Employees’ Federation (BEF) claims that the Bangladesh Labour Act 2006, which was approved, has employee procedures that must be followed by all organisations, especially those that are listed on the stock market and in the Bangladesh SME Foundation [87]. The International Labour Organisation’s (ILO) protocols, among others, provide a foundation for employee rights protocols [88].

Whenever the rights of employees are adequately fulfilled, they tend to be self-motivated, satisfied with their job, and do not wish to leave the organisation [87].

We note that financial and managerial aspects, legislation, employee rights, competitiveness, and increased production have been incorporated into our framework.

The discussions in the preceding sections provide an answer to our research question in Section 4.

5.8. SME Requirements

The IoT is significantly impacted by SMEs, who are the backbone of many manufacturing economies [89], as was already noted. As indicated before, SMEs frequently confront different obstacles and problems than bigger businesses [90,91]. The difficulty for SMEs to embrace smart manufacturing (SM) was validated by a 2017 study involving manufacturing SMEs in West Virginia, USA [92]. The research that is currently available indicates that few studies concentrate on assisting SMEs’ evolutionary route and a paradigm shift towards SM or the IoT. Some writers refer to SMEs that have handled this shift effectively as the “SME IoT” [93,94].

5.8.1. Transforming the Customer–Provider Relationship

Even businesses offering tangible goods made of durable materials, such as metal panels, need to have a strong client–provider connection. Providing high-quality goods and excellent customer service is essential to gaining recurring business. However, switching to a digital product will bring new elements to the connection, changing it from a series of discrete sales and delivery interactions to a more ongoing relationship that will probably require frequent software upgrades and maintenance.

Selling equipment functionality instead of making equipment available via a lease or subscription would further strengthen the bond between the consumer and supplier. This is a much-wanted IoT model. In a win–win scenario, the supplier gains ownership, data, and a consistent source of income while the client enjoys the functionality without having to handle the upkeep [60].

5.8.2. Technical Skills Needed in the IoT World

Gaining the necessary skills is perhaps the most obvious issue for SMEs looking to enter the IoT market [60,95]. Arguably the first aspect that comes to mind is technical expertise, yet other areas are equally significant. Technology difficulties affect the project and the prototype’s hardware and software components. It might be difficult for a small business to find employees with the hardware and software expertise required to design an IoT device. However, technological proficiency alone is not sufficient. The process of creating a new product involves a wide variety of skills, from the fundamental ability to create software to understanding how to provide a digital product.

The follow-up knowledge required would be maintenance and upgrades, handling data collected by the product, and creating viable business models [60,95].

5.8.3. Understanding the Ecosystem around IoT Products

Before releasing a product based on the Internet of Things, it is crucial to comprehend the ecosystem in which it will operate [60]. The IoT is really about connecting things; opening up verticals; and generating synergies from connectivity, open data, and data analyses. To fit in and contribute to the openness of IoT rather than limiting it, an IoT-based device must be able to connect to others, share its data, abide by standards that make this possible, and be highly adaptable.

5.9. The IoT in Manufacturing SMEs

IoT networks can improve production efficiency, particularly in remote and globally diversified situations [52]. The development of IoT solutions may help support SMEs in the next generation of manufacturing, from the start of the production line through to warehouse operations. The supply chain is changing as a result of the capacity to offer reliable data on the flow of resources and goods in real time [53]. In order to restructure production operations, enhance materials tracking, and reduce distribution costs, businesses engage with the IoT [96]. For instance, to reduce costs and boost supply efficiency, John Deere and UPS currently deploy IoT-enabled fleet tracking solutions [97,98].

Because it is based on real-time information, smart manufacturing enables smarter decisions that may lead to more efficient operations inside the plant and throughout the supply chain [99]. The advantages of the IoT include better supply chain linkages, proactive maintenance, higher quality outside of the plant, increased sustainability, and the capacity to plan and schedule based on real-time data collection [47].

According to [48], the IoT enables the virtualisation of supply chains, allowing buyers to follow the progress of their purchases and perform sophisticated quality control and planning. Simultaneously, references [100,101] introduced a concept for incorporating IoT data into strategic planning for product assortments.

While [102] listed several advantages of IoT-related sourcing, reference [101] investigated the impact of IoT on suppliers (SMEs) and advised the deployment of IoT technologies that would allow greater flexibility. The IoT has a price even if it promises to give the supplier useful real-time visibility [12]. To analyse the effect of the cost of sensors and alerts on the unit purchase cost, reference [102] created a straightforward linear cost model. The IoT apps serve as the interface between the user and the devices, allowing for an intuitive presentation of data while also spotting issues and making recommendations for fixes [53].

According to [103], organisations have profited from the combination of strategic planning, organisational learning, and cutting-edge IT applications. IT by itself has not given them a durable advantage. In this context, reference [104] has researched the interaction of IT and the IoT and asserts that doing so presents businesses with a singular opportunity that could fundamentally alter the organisation. The process level is the first step toward a successful digital company strategy [104].

Our above discussions elaborate on a specialised SME involved in manufacturing, although since our framework is generic for developing-country SMEs, the said aspects are not included in our framework.

5.10. Training within SMEs

For SMEs to remain relevant and competitive, entrepreneurs should keep abreast of business operations. According to [105], SME development is crucial to the growth of economies in both developed and developing nations. SMEs play a significant role in employment creation, lowering income inequality, boosting company competitiveness, and promoting social stability. Employee training and development (T&D) is a crucial tool for every SME to boost their performance, capacity, and production, as well as to maintain a competitive edge. Therefore, T&D should be used by SME owners and managers to enhance and develop workers’ knowledge, abilities, attitudes, and other performance-related outcomes [105].

Entrepreneurs should equip themselves with the knowledge and skills to remain competitive and relevant and to survive [106]. Therefore, training is one facet that is an integral part of growth and survival [106,107]. According to [107], some studies have attested that training programmes benefit SMEs’ survival. Thus, entrepreneurs stand a better chance of surviving in their businesses when trained to improve their entrepreneurial skills and knowledge. Therefore, for SMEs, it is paramount that various training programmes are attended to gain the necessary skillset and required knowledge to run a business efficiently, effectively, and profitably [108].

Furthermore, it is also paramount that the business programmes (training) are attended regularly to enhance the knowledge and skills needed to run a business from a development perspective. Such training is not necessarily confined to business owners only; employees stand to benefit the business when they become part of this training, as they should comprehend better what needs to be done to run a profitable business [108].

One study [107] advocates that training becomes beneficial to training providers when it is generalised instead of customised for a particular SME’s employees; this allows training providers to target a large group of entrepreneurs. Furthermore, it is expensive to receive customised training from a provider. However, this benefits the SME, as it is tailored for that particular group and aids in gaining a competitive advantage.

Owing to its importance, training in SMEs is included in our framework.

5.11. Supporting South African SMEs

According to [109], although ample initiatives were undertaken in 2009 to ensure that South African SMEs are equipped with the necessary training to assist them in running a business successfully, there are still gaps in acquiring the necessary training. SMEs tend to go through one training programme only. There is a reluctance to attend additional training that could elevate them to be more diverse and achieve a 360-degree skillset as opposed to being equipped with just one facet, such as marketing. Therefore, SMEs do not see a need to attend additional training for their business to remain relevant and be kept abreast of the dynamics of entrepreneurship. Furthermore, reference [109] argues that the service providers (training institutions) quote SMEs more money for additional training, discouraging SMEs from attending development programmes continuously. One study [110] indicates that many entrepreneurs experience difficulty in operating business successfully due to a lack of proper training, knowledge enhancement, and skills. This significantly impacts the high number of businesses that cease operating in their infancy. South Africa has initiated numerous initiatives from business development perspectives; therefore, these initiatives need to be probed as to whether they serve the purpose of developing SMEs to run profitable entities [111].

When the South African (SA) government established the Department of Small Business Development (DSBD), its aim was solely to ensure that the SMEs get sufficient support from the government through funding and training to address common challenges that SMEs face. Despite all these initiatives, elements are still being overlooked and should be addressed so that the effort does not become fruitless from an SME’s development perspective [112]. One study [113] argues that the support SMEs receive from public and private institutions is insufficient.

Next, we address the role to be played by the government.

5.12. The Need for Supporting Institutions’ Services

The dynamic corporate world is often unforgiving and unpredictable; consequently, the survival of SMEs relies on the government for training and funding schemes to survive and grow [114]. Moreover, the SMEs that receive training tend to outperform the ones that do not receive any training. Therefore, the initiatives from public and private institutions will assist start-up SMEs in sustaining growth [115,116]. On the downside, there is a narrative that even if training is provided, it will have a minor effect on improving and developing SMEs [117]. SMEs can easily be discouraged by the government’s participation in businesses due to the lack of creating favourable and conducible environments. Some SMEs are still struggling to be profitable because even if training from (public and private) institutions is provided, it is not applied wisely to benefit them [118].

Nevertheless, SMEs that go through training from either public or private institutions may stand a better chance of survival and profitability than those that did not go through the said training [116,119]. Furthermore, business owners of start-up SMEs should consider training to acquire a 360-degree skillset instead of just one training element to grow their businesses [120,121,122,123].

The preceding discussions meet our first objective (Obj1), namely, to elicit the SME aspects that ought to be included in an SME control framework for IoT security.

5.13. Existing IoT Frameworks for SMEs

Next, we delve into existing IoT and governance frameworks for SMEs.

5.13.1. IoT Framework for Rapid Integration of IoT Systems in SMEs

A small–medium deployment is determined first by the size of the hosting company, as this may account for the few resources (cash, knowledge, and time) that are made accessible, and then by the size of the deployed solution (number of sensors, size of area, services, and applications). It should be reasonably simple to support, administer, and justify the advantages of an IoT solution implemented in an SME domain. The IoT, however, continues to be a challenging topic, even among frontline researchers, and as a result it can increase the complexity and workload of a company’s technical employees. Service unavailability, inconsistent or unreliable sensors, and devices that frequently need their batteries to be replaced are some of these problems. Other difficulties include disconnected gateways or a graphical user interface (GUI) that does not fit the needs of an end-user. Because it interferes with routine business activities and can necessitate more labour in technically complex domains that are presumably unfamiliar to the user, it will lead to mistrust and abandonment of the solution [119].

Section 5.13.2, Section 5.13.3 and Section 5.13.4 with Figure 1, Figure 2 and Figure 3 consider the current IoT control frameworks in the extant literature.

5.13.2. Track-and-Trace Supply Chain Conceptual Framework for the IoT in SMEs

This section discusses and unpacks the current IoT control frameworks in the agriculture sector as eminent in the literature. The IoT is made possible by the proliferation of devices in a coordinated communicating–actuating network architecture. Smart items or integrated things that provide value are becoming increasingly networked as a result of technological advancements in wireless network connectivity, cell phone advancements, sensor network technologies, and so forth. Therefore, from the standpoint of enterprise systems technology, these interconnected “things or smart objects” (IoT) technologies have also significantly influenced modern ICT, especially when it comes to 4IR developments. With respect to an agricultural application, this is done to deal with the conceptual underpinning for sophisticated animal track-and-trace systems effectively and efficiently. The IoT’s technical standards should be modified to establish the specifications for information exchange, processing, and communication amongst objects in order to allow these capabilities and benefit the end users or stakeholders [52]. The success of the IoT depends on standardisation, which offers worldwide interoperability, compatibility, dependability, and efficient operations [120]. Consequently, aspects of standardisation form part of our framework.

An animal track-and-trace enterprise supply chain IoT conceptual framework from [121] is depicted in Figure 1.

Figure 1 addresses numerous aspects addressed in this article, notably manufacturing, cell phone usage, end users, and so forth.

5.13.3. IoT Conceptual Framework in Agriculture (SME) for an Advanced Animal Track-and-Trace Business Process Model (BPM)

Figure 2 illustrates a business process model (BPM) of an advanced animal tracking-and-tracing enterprise supply chain conceptual framework for IoT in farming SMEs. It is a continuation of Figure 1. Further details are provided in [121]. The information and components of Figure 1 and Figure 2 are embedded in our framework in Section 8.

The BPM in Figure 2 is divided into three categories, starting with the 3D printing sector for digital manufacturing, where tags are created and attached to cattle. ICT system architecture enablers are mapped in the middle portion, and then the stakeholder or end-user segment follows, which can include livestock producers, veterinary professionals, and SME agricultural enterprises. The last component updates the IoT section with data or information changes and gets information from it in real time [121].

The supply chain and numerous stakeholders in the agribusiness can gain from the animal monitoring and tracking system. The farmer is informed of the whereabouts of the animals via integration with the Google Earth application, which also provides important information to other stakeholders. In particular, for SMEs and agribusinesses, the advantages that integrated ICT enablers provide to industries in the form of IoT are crucial [121].

5.13.4. Existing IoT Conceptual Framework in Production Systems

Figure 3 illustrates a conceptual framework of an IoT application in a production system for a sensing SME. The framework assists in managing different levels and elements to improve the production system [123].

Figure 3 represents different phases of the IoT framework for the environment of a production SME, which include planning, operations, and control. A sensing business uses information systems to enhance its production process. Product information offered by the IoT is organised into three levels, namely the edge, access, and application levels. These complement the underlying information systems. The phases in which information has to be enhanced (inventory to plan, product localisation to run, manufacturing environment to regulate) should be considered by SMEs based on these notions. An SME should then research the components required for each level of the IoT structure as follows: What sort of application is necessary? Will this be a brand-new application or an enhancement of an existing application? With respect to the access network, how will the objects interact? How many items will there be? Regarding the edge, which ID technologies will be used by objects? Will sensors be required?

According to [123], the above considerations may help SMEs from essentially any industry in adopting the IoT and providing examples of applications that enhance the production system at each stage. The framework in Figure 3 is meant to assist SMEs in developing sensitivity to disruptions in the production system. Validating this framework in the relevant sector to see whether these ideas will help with the implementation of the IoT is an important future line of action.

The above discussions on the IoT frameworks in the literature meet our second objective, Obj2, stated in Section 4.

6. Data Collection

The data collected for this article essentially embody scholarly literature, and to this end, PRISMA was used as a technique to organise the literature review as part of a systematic analysis that this research study followed. Keywords such as IoT, control framework, framework, SME challenges, security challenges, and developing economy were used to source the relevant publications. A total of 305 publications on these topics were found and downloaded using Google Scholar. Thereafter, 76 duplicates were found in the articles and accordingly removed. A total of 229 were left, whereafter those articles (56) that had no relevance in the study were removed, having evaluated the title and abstract, and we were left with 173 publications. Of these, 23 publications with relevant titles and abstracts did not have many details for our study. Subsequently, these were removed, leaving us with 150 publications we could utilise in our study. Finally, we removed the publications that were not scholarly (20), leaving us with 130 articles. The remaining 130 were included in the analysis of our above literature review.

The flowchart in Figure 4 depicts the systematic PRISMA technique that was followed to organise the literature.

7. Materials and Methods

This section presents the research methodology used in this article as well as some of the underlying theories with respect to developing a control framework to secure an IoT environment within SMEs in a developing economy.

Research Methodology

This research was conducted using Saunders et al.’s research onion [122] depicted in Figure 5.

The research onion provides a breakdown of the crucial aspects that must be observed and examined before beginning any investigation. The various layers of the onion provide a framework for considering the researcher’s philosophical orientation, research approach, appropriate research strategies, research timelines that are being reviewed, and data collection methods the researcher is using.

Starting at the outermost layer of the onion, our research philosophy is interpretivist in nature, since in this work we interpret the literature text and frameworks usually in the form of diagrams. Examples of these include Figure 1, Figure 2 and Figure 3. Moving to the second layer from the outside, our approach to theory development is inductive, since our main deliverable is a control framework that we develop from the literature analysed in this article. At the third level from the outside, our methodological choice is mono-qualitative, since at this stage our work is conceptual and involves analyses of text and diagrams.

Regarding our strategy at the fourth level of the onion, we consider cases as in Figure 1, Figure 2 and Figure 3; consequently, our strategy involves a number of case studies. The research reported in this article was done over a relatively shorter time period, hence our time horizon is cross-sectional. This is in contrast to a longitudinal time horizon conducted over a longer time period, such as human research over one or more decades.

At the innermost layer of the onion, our data collection and data analysis are, as indicated before, performed through the literature in line with the illustration in Figure 4. In line with our future work plans, the follow-up research will involve surveys among stakeholders in the relevant industry. At that stage, our data collection will be augmented with the said surveys.

Next, we present the main deliverable of our work, namely a control framework for the secure adoption of the IoT by developing-economy SMEs.

8. Results

Our framework coined a secure IoT control framework (SIoTCF) for SMEs, is synthesised from the above literature review.

The SIoTCF, depicted in Figure 6, may act as a reference guide for addressing aspects of the design, governance, and maintenance in enhancing the security levels of IoT adoption and usage in SMEs. We note that our framework follows the layout of the horizontal three-level framework developed by [123] in the context of e-learning technologies for management accounting.

9. Discussion

The SIoTCF framework in Figure 6 is structured around three tiers: high-level challenges, second-level challenges, and solutions to these. While the said framework may still be high-level, at least as far as the implementation aspects are concerned, we believe it will be valuable for start-ups and new SMEs that embark on the IoT in the 4IR to advance their businesses. The first tier synthesises the various IOT-related challenges that were elicited in this article. Likewise, the second tier unpacks the challenges further, again on the strength of the literature findings in the article. The third tier proposes solutions to the second-level challenges. The links among the entities (ovals, hexagons, and rectangles) indicate associations that may exist among the entities and may assist an SME in further analysing the said challenges and solutions proposed.

The vital role of SME data and security aspects of such data are recognised in the framework. Financial aspects, availability, and aspects concerning the IoT environment are likewise recognised in the framework. As indicated, legislation forms an important part of the framework. We further note that concerns around employees in the form of job security, upskilling, labour aspects, and innovative operations have been included.

The Figure 6 control framework and the above discussion meet the aim of our research stated in Section 4.

10. Contributions of the Research

Our research adds to the body of knowledge on aspects of the IoT in the 4IR, coupled with security controls for developing-economy SMEs. This is achieved through the framework synthesized in Figure 6. In the field of ICT, it is expected to be useful for academics, researchers, and students. By suggesting the processes and risk mitigation strategies to use in an IoT-based environment for a sustained competitive advantage and organisation success, the framework may offer a useful contribution to SMEs.

11. Conclusions and Future Work

This article elicited the various challenges facing young or developing-country SMEs. Following a comprehensive literature review, various challenges were identified and synthesised into seven groups as indicated in the first tier in the SIoTCF framework in Figure 6. We thereafter further unpacked the challenges as a second level, eliciting further details as indicated. Finally, the second-level challenges were addressed in the form of proposed solutions. While the framework has a qualitative flavour in line with the qualitative research choice adopted in this article, it nevertheless exhibits a left-to-right flow of information as well as control, hence the idea of a control framework. As indicated in the previous section, human and employee aspects are recognised in our framework, indicating a progression from technical 4IR aspects to human–machine aspects embodied by the 5IR [124].

Future work in this area may be pursued along a number of avenues. The solution tier in Figure 6 may be viewed by some (still) as a problematisation segment [124], i.e., stating a third level of challenges rather than solutions. While this may be the case, we intend to validate the utility of the framework among ICT specialists and SME owners to simultaneously validate the framework and enhance it. Following the mentioned follow-up work among stakeholders in the industry, we could implement the resultant framework in one or more SMEs over an extended period, thereby adding a longitudinal component to the time horizon layer of our research methodology in Section 7.