## 2 State of the Art
### Researches about the Security Culture
* Finally, [PERSON] [45] considers the security culture to be a key aspect of ISMSs, and has developed a general framework for information security which is based on eight dimensions [37] applied these eight dimension to the areas of information security and identified the principal factors of information security in each dimension. Although recent studies demonstrate SMEs' concern about the difficulties involved in developing an information security culture [46], the fact is that the security culture has a series of additional problems as regards its implementation in SMEs [47]. According to [48; 49], SMEs are, when compared to large organizations, particularly prejudiced against seeking an information security culture. This is for various reasons:  
* SMEs lack the funds, time and knowledge needed to coordinate information security or to impose an information security culture in an efficient manner [10; 50]. * SMEs do not tend to have procedural policies at their disposal, nor do they tend to define the responsibilities of their information systems' users [51]. * When compared to large companies, SMEs are more susceptible to national influences, such as changes in legislation [52]. In conclusion, we can highlight that several security management frameworks for the development of an information security culture have been developed [11; 17; 31; 34; 40; 42; 53; 54; 55], but they tend to be oriented towards large organizations. According to [PERSON] and [PERSON] [48; 56], however, the frameworks for SMEs should be based on the study of their real needs so as to identify and develop a framework specifically intended for them. Experts have proposed various conceptual frameworks that will permit information security management to include the information security culture, and these are based on policy management, the raising of awareness, training and education initiatives [57; 58]. These frameworks may, however, be more appropriate for medium-sized and large companies owing to the resources needed. Various frameworks for the establishment of the security culture have appeared over the last few years, and are based on: organizational culture and the measurement of the information security culture [11; 32]; shared values [51]: information security phases, levels of maturity [17]; measures related to the development of the individual, group or organization that will permit the discovery of their lacks as regards security [31]; the socio-technological level of information security [59]; measures based on the users' morals and ethics [38]; informal awareness-raising methods [40]; key concepts of the organizational culture [34]; the personnel's capabilities [54]; organizational learning [55]; and a multi-faceted approach [41]. Despite their obvious value, these frameworks focus on fragments of the theoretical field, without being integrated into a common and complete framework. What is more, they do not tackle the particular requirements of SMEs. [PERSON] and [PERSON] [44] therefore reach the conclusion that there is no suitable regulation for security management in SMEs, and that there is principally a need for models that are valid and that will allow the security culture to be increased in SMEs. Two proposals focused on analyzing the need for a security culture in SMEs are shown in the following sub-sections.