## 3 MARISMA Framework  
The methodology developed for security management and its maturity in SMEs will allow any organization to manage, evaluate and measure the security of it information systems, but is principally oriented towards SMEs, since they are those with the highest rate of failure as regards the use of existing security management methodologies [68; 69].  
One of the objectives pursued by the MARISMA methodology is that it should be easy to apply, and that the model developed on it will permit a greater level of automation and reusability with a minimum amount of information that has been obtained in a very short amount of time [70]. Speed and cost reduction have been prioritized in the methodology, thus sacrificing the precision provided by other methodologies, i.e. the objective of the methodology developed is to generate one of the best security configurations, but not necessarily the optimum one. Priority is instead given to time and cost saving rather than precision, whilst still guaranteeing that the results obtained will be of sufficient quality [71], since they will be supported by other regulations [72; 73].  
Another of the main contributions of this methodology is a set of matrices that allow the various components of the ISMS to be related (controls, assets, threats, vulnerabilities, risk criteria, procedures, registers, staff, technical instructions, regulations and metrics). The model will use these matrices to automatically generate the majority of the information needed, thus considerably reducing the time needed for the development and introduction of the ISMS [74]. This set of interrelations among all the components of the ISMS is designed in such a way that if any of these objects is changed, the measurement value of the remaining objects in the model will be altered, such that it will always be possible to obtain an updated evaluation of how the company's security system is evolving.  
The information obtained after testing it at various companies has therefore allowed us to develop a security management and maturity methodology for information security systems, along with its associated model (see Figure 2).  
Figure 2: Sub–processes of the methodology MARISMA.  
This methodology has three main sub-processes:  
* SMScG--Security Management Schema Generation: The principal objective of this sub-process is to construct the'schemas', which are the structures needed to build ISMSs, and are created for a possible set of companies in the same category. These schemas are reusable and permit a reduction in both the time needed to create the ISMS and its maintenance costs so as to make them suitable for the dimension of an SME [68]. The use of schemas is of particular interest in the case of SMEs since their special characteristics signify that they tend to have simple information systems that are very similar to each other.
* SMSyG--Security Management System Generation: The main objective of this is the use of an already-existing schema to create an ISMS that will be suitable for a company.
* SMSyM--Security Management System Maintenance: The principal objective of this sub-process is to maintain and manage the security of the company's information system, contributing information that is updated over time to the ISMS generated.  
The principal activities used to create a progressive security culture are focused on the ISMS maintenance process.