## 2 State of the Art
### Researches about the Security Culture  
In order to analyze the solutions proposed by other researchers so as to resolve the problem detected as regards the lack of a security culture in SMEs, we carried out a short literature review on this topic, which enabled us to select 12 research works. These were considered to have the closest relationship with our analysis, whose eventual objective was to create a framework for the security culture in SMEs and its problems. Of the proposals analyzed, the ones that provided most details were those by [PERSON] and [PERSON], since they were the frameworks most similar to the MARISMA methodological framework and because they contained elements of interest for the completion of that framework, such as aspects of e-learning and learning in the case of [PERSON] and those of external influences and behavior in that of [PERSON]. These two pieces of research were also those that presented the most complete security culture frameworks. The majority of research into the information security culture [31; 32; 33; 34; 35; 36; 37] stresses that a cooperative culture that includes an information security culture is a collective phenomenon of a transcendental nature and can be designed by an organization's management. [PERSON] [33] places special emphasis on the fact that the organizational culture plays an important role in information security, since it allows the organization to resist the changes undergone by its system. Although the majority of research coincides as regards the importance of the security culture for ISMSs [33], there is not as yet a clear definition of the concept of'security culture' [37], and several viewpoints exist:  
* [PERSON] [38] states that \"the consciousness of information security\" is a state in which an organization's users are conscious of their mission as regards security, and this is divided into two categories: (i) the application framework (standardization, certification and institutionalization activities), and (ii) content (the human aspect). * [PERSON] and [PERSON] [39; 40], meanwhile, suggest the establishment of a training culture and cooperation with employees on the basis of the gradual adoption of the organization's security management, individual values and user behavior. * [PERSON] [6] has a broad view of the term \"security culture\", and defines it as the behavior of an organization's users that contributes towards the protection of data, information and knowledge. * [PERSON] [31] defines the information security culture as a set of information security characteristics, such as integrity and the availability of information. * For [PERSON] [41], the information security culture is a fundamental aspect, and this author defines a set of dimensions that are important as regards measuring the efficiency of the information security culture: (i) a belief in the importance of information security; (ii) a long and short-term balance, goals, policies, procedures and continual improvement processes; (iii) cooperation and collaboration; and (iv) attention to auditing objectives and their fulfillment. This list has, however, recently been criticized by [PERSON] [42], who places particular emphasis on the human aspects of information security. * [PERSON] [43] maintains that with information systems it is always assumed that a person belongs to a single culture, and this author therefore proposes using the theory of social identity as a basis for research into the information security culture. The idea behind the social identity culture is that each individual is influenced by a multitude of cultures. According to [43], upon applying the social identity culture, users will be influenced by ethical aspects, each country's legislation and the organization of security. This culture has an effect on the way in which the individual interprets the significance and importance of information security. * [PERSON] [44] proposes a system in which the security culture is created on the basis of the interaction between the reference framework and its components.