## 2 State of the Art
### Researches about the Security Culture
#### 2.2.2 Proposal of [PERSON]  
This author proposes the construction of an ISMS whose core is the development of the information security culture, whilst bearing in mind how people think and behave [63]. The framework for the security culture is therefore established on the basis of qualitative rather than quantitative aspects. The framework was defined by carrying out a study on Australian SMEs with less than 20 employees [64]. This framework describes three external influences:  
* National ethics and organizational culture. A nation's culture may affect the organization of information security. Social ethics may also have an important impact. [PERSON] [51] states the importance of social networks as regards sharing problems related to information security and creating a consciousness about the subject. * Government initiatives: governments could play a fundamental role in the creation of an information security culture by approving special legislation and providing support (courses, subsidies, etc.). * Suppliers: suppliers could ensure that SMEs are reliable in the form of the additional guarantee of the security of the products they sell them. This framework is composed of the following elements:
* Leadership and corporative government: The owners of SMEs should demonstrate that they support information security management. According to [PERSON] [62], the management's support is highly valued by large companies, but this is not the case at SMEs. * Organizational culture: An organization's culture and environment have a direct influence on the fulfilment of security management. * Management: Firstly, SMEs consider the results of risk analyses to be a key aspect as regards guaranteeing that policies and procedures are really necessary. Secondly, SMEs must be guided by the risk of losing assets, which they discover via the risk analysis. [PERSON] identified this need in large organizations. Thirdly, it is necessary to allocate a budget to security management, whose resources should include the initiatives needed to establish a security management culture. [PERSON] also suggested that the budget has a great influence on organizations. Fourthly, the procedures used to respond to information security incidents would help to underline the importance of information security for the employees, and this has also been generally suggested by the OCDE [27]. Fifthly, SMEs should receive some kind of reward for periodically evaluating their information security culture. In addition, finally, the employment contract should include sanctions or incentives with which to motivate employees. All management processes should be evaluated periodically. * Individual and organizational learning: e-learning, training and education are potentially valuable initiatives for the development of the information security culture for both SMEs and large companies [38; 54; 61]. The exchange of knowledge, cooperation and collaboration are important for learning at the different levels of the organization when the objective is to develop the information security culture. The learning processes should be evaluated periodically. * Raising awareness about the organization's security: [61] suggested formal and informal awareness-raising measures for SMEs, while [38] proposed the inclusion of awareness-raising measures that additionally contained aspects of persuasion. * Reviews and evaluation: SMEs should periodically examine and evaluate the measures adopted in order to continuously improve. * Behavior: A series of external and internal initiatives could be used in an attempt to develop behavior regarding responsibility, integrity, trust and ethics. According to [PERSON] [20], in large organizations this transformation originates from internal management initiatives, whilst in the framework proposed [63] this responsibility is shared by internal and external agents. [PERSON] [38] states the importance of intrinsic motivation.