## 5 Applying the Action-Research Method
### Applying the Action-Research Method during the ISMS Development Phase
* _Principal problems detected_: Many customers attempt to comply with controls that exceed their current business capacity and overdimension the security management systems, which leads to an increase in risks in the medium term. Solution: The selection of a series of business characteristics that allows the determination of maximum maturity levels that it would be advisable for the company to attain, bearing in mind its current properties, with the objective of avoiding overdimensioning or assigning resources to controls of less priority. This was done by carrying out a study of the companies' characteristics and determining certain factors that influence their capabilities, and then establishing a simple algorithm that determines the most desirable level of security management at a particular moment. Result: Although involving a new management element implied an increase in costs, we consider that this cost is mitigated in the medium term by the improvements that it provides. The principal advantage is that it helps ensure that the installation and maintenance process will have a higher percentage of success. Associated with: Activity A1.2 (T1.2.1). Duration: 21 Weeks. * _Cycle I11\({}^{\circ}\)_: Broadening the concept of Maturity Level. * _Objective:_ To introduce the concept of Maturity Level into the Schema structure. * _Characteristics:_ To introduce the concept of Maturity Level into the Schema structure in order to propagate its properties and advantages to the other elements in the schema. * _Principal problems detected:_ The concept of Maturity Level contributes new characteristics to the ISMS, but a costly management task is required to apply it to the different objects. * _Solution:_ The association of the levels of the sub-controls in the schema, such that they are propagated to all the elements in the ISMS, thus allowing the customer to know the maturity level of the security management at all times, and what must be done to attain the following level. * _Result:_ A reduction in the costs associated with the introduction of the'maturity level' element. * _Associated with:_ Activity A1.2 (T1.2.2). Duration: 17 Weeks. * _Cycle I12\({}^{\circ}\)_: Establishing the concept of Maturity Level. * _Objective:_ To introduce the concept of Current Maturity Level (_the level that company currently has, based on the formulas proposed in the methodology_) and the Desirable Maturity Level (_the level that the company should attain bearing in mind its current safety culture_) into the system installation and maintenance process. * _Characteristics:_ The ability to determine the Current Maturity Level and the Desirable Maturity Level of the company's security management during the installation process, along with the overdimensioning of the security controls. * _Principal problems detected:_ The customer wishes to have a simple means to know the current situation, the point that must be reached, and the recovery of resources in order to reach that point with guarantees. * _Solution:_ The information needed to apply the algorithm that determines the company's current situation was obtained by: choosing the most appropriate schema for that company and using questionnaires in order to determine the current security level and the desirable security level. * _Result:_ Although no savings were made as regards costs, the customer's knowledge and confidence in the process increased. * _Associated with:_ Activity A2.2 (T2.2.1-T2.2.3). Duration: 17 Weeks. * _Cycle I13\({}^{\circ}\)_: Automating the risk analysis. * _Objective_: To automate the generation of the risk analysis in order to optimise the costs of this process. * _Characteristics_: The creation of algorithms that employ all the information obtained to generate a basic low-cost risk analysis. * _Principal problems detected_: The customer wished to be involved in the risk analysis process as little as possible, and wished above all else to minimise costs.