What are the essential factors that small and medium enterprises $($SMEs$)$ should take into consideration when deciding between the NIST Cybersecurity Framework and ISO $27001/27002$ Version $2013$ to meet their information security risk management requirements?

Additionally, which framework would be more suitable for SMEs, and what are the reasons behind this preference?