Most SMBs have not identified and documented cybersecurity threats