Designing a Scalable and Adaptive Cyber Incident Response (DACIR) Framework for SMEs

Small and medium-sized enterprises (SMEs), due to resource constraints, lack optimal decision-making mechanisms to respond to cyber incidents. Common frameworks model the process as linear cycles and lack explicit decision-making under uncertainty. This paper presents an optimized framework as a partially observable Markov decision process (POMDP), in which the system's true state is not fully observable and the decision-maker must act based on a belief distribution. Risk is dynamically estimated on the asset dependency graph, and action selection is performed by minimizing expected loss, cost, downtime, and uncertainty penalty. The proposed framework (DACIR) provides lightweight, executable orchestration for SMEs using micro-playbooks and updates policy parameters through post-event learning. Simulation-based evaluation shows that the proposed method, compared to static procedures, achieves significant improvement in metrics such as MTTR, business loss, and regret.