risk assessment.

When thinking about budgeting wisely for cyber security, which ONE of the following statements is true for small to medium size businesses (SMEs)?

SMEs do not need to spend much money as criminals will target bigger organisations.

SMEs only need to spend money on controls that are easy to implement.

SMEs only need to spend money to bring themselves up to the same level as other SMEs.

SMEs only need to spend money on things they’ve identified in the risk assessment.