Small and medium enterprises increasingly depend on digital technologies for coordination, customer interaction, data access, and operational continuity. However, technology adoption alone does not guarantee resilience or improved performance. Many SMEs remain exposed to cyber incidents, fragmented IT systems, weak security routines, and limited recovery capacity. This conceptual paper develops a model for future empirical testing by explaining how IT infrastructure capability and cybersecurity capability can improve operational performance when they are embedded in daily operational routines. Operational embedding refers to the integration of technology and security practices into critical workflows, recovery priorities, and continuity responsibilities. Drawing on recent literature published between 2021 and 2026 and selected foundational theory, the study argues that digital resilience should be understood as an organizational capability that enables SMEs to anticipate disruptions, absorb shocks, adapt processes, and recover operations. The proposed model positions IT infrastructure as the technical foundation, cybersecurity as the protection and recovery layer, operational embedding as the condition that strengthens their effect, and digital resilience as a partial mediator between capabilities and operational performance. Operational performance is captured through downtime reduction, continuity, response speed, productivity, and service quality.
Tumakov et al. (Sun,) studied this question.