Abstract

The paper examines cyber resilience in small and medium-sized enterprises as a managerial capacity to maintain and restore critical business processes after digital incidents. Based on NIST Cybersecurity Framework 2.0, small-business guidance and ENISA threat reports, a practical sequence of management decisions is proposed: identifying critical processes, mapping digital dependencies, prioritizing risks, establishing baseline controls and testing recovery. Particular attention is paid to connecting technical indicators with business-continuity outcomes. The contribution is a conceptual management framework, not a report of original field measurements.