Information Security Management frameworks such as the ISO$/$IEC $27000$ ISMS or the NIST Cybersecurity Framework are only suitable for very large organizations and not very helpful for small to mid$-$size organizations.