Designing a cyber risk assessment tool for small to medium enterprises