## 4 SME-SCCM: Security Culture Certificate Management
Unless the user is able to answer 50% or more of the questions in the test correctly, his/her level of knowledge regarding the company's information system security culture will be deemed inadequate, and it will be necessary to continue taking tests until a mark of five or more has been obtained. The user will not be able to access the company's information system until s/he attains a sufficient level of \"Security Culture\". This therefore guarantees that the culture is introduced efficiently. Once the user has managed to pass the test, his/her mark is saved in a register, a \"Security Culture\" certificate is issued and access to the information system is granted. The mark obtained will be important as regards maintaining the certificate over time, since it will be modified by other tasks in the system. During the research carried out at SMEs, which were Sicaman's customers, it was decided that the ideal number of questions should be between 20 and 30. A lower number makes the results less valuable while a higher number makes those users that must take that test feel dissatisfied and uncomfortable. Figure 5: How a “security culture” certificate is initially obtained. The questions are chosen from a knowledge base, which has a group of questions that are pre-established on the basis of the regulation pattern/schema chosen (e.g., they are based on ISO27001). This knowledge base is complemented with questions excerpted from the company's security policy, which all users must know and comply with. The second process of which the \"take the security culture test\" task is composed is that of renewing the security culture (SC) certificate, either because it is out of date or owing to the loss of qualification points. The steps involved in this process are detailed in Figure 6.  
The renewal period for the security culture certificate has been set at 1 year, although this time period can be reduced to 6 months if it is deemed necessary to speed up the establishment of the information security culture. The simplicity of the procedure signifies that it is not advisable to let more time lapse before the certificate is renewed, as the security culture may decrease (i.e., a time period of 2 years would be counterproductive) or to make it more frequent as this may lead users to reject it (i.e., a time period of less than six months may cause the users to reject the culture). Figure 7 shows that, according to the investigations carried out during the development of this research, if the renewal time is imposed as being between 6 and 18 months, the level of the security culture (LSC), which is measured as the average mark obtained in the tests that must be passed to obtain the certificate, is higher. It is, therefore, recommendable to renew the certificate every 12 months. Figure 6: Schema for SC certificate renewal. In order to avoid interfering with the users' daily work, the notification stating that the certificate needs to be renewed is issued 1 month before its expiry data, thus allowing the user to take the test at the time that best suits him/her during that period. The system reminds users of this on a daily basis. If the user has not taken and passed the test by the time the expiry date is reached, his/her access to the system will be blocked until the certificate has been renewed. Given that the time taken up with resources (TtR) is one of the principal success factors of the methodology (particularly in the case of SMEs), we have estimated how long it would take to establish the security culture and have reached the conclusion that the simplicity of the process makes it totally acceptable for SMEs (it has been estimated that the time need to initially obtain the certificate is between 1 and 2 h--around 90 min to read the security policy and understand the elements of the ISMS, and about 30 min to take the test). This investment of time is only necessary initially since, although the certificate must be renewed periodically, it is only necessary to read the security policy and pass the test the first time.