## 5 Applying the Action-Research Method
### Applying the Action-Research Method during the ISMS Development Phase
* _Characteristics_: We sought to directly link the risk analysis elements with the system controls in order to unify all the elements of the ISMS. * _Principal problems detected_: The results of the risk analysis are left isolated from the rest of the ISMS, signifying that a costly task must later be carried out in order to determine how to associate the risks with the controls. * _Solution:_ The creation of association matrices among the risk analysis and the controls. These matrices will be filled on the basis of the knowledge acquired during each of the installations and will associate the vulnerabilities with their associated controls. * _Result_: Huge savings as regards the consultation task needed to establish all the relationships among the risk analysis elements and the system controls. This new matrix allows all the elements in the system to be associated with its controls, thus enabling the majority of the processes to be automated. * _Associated with:_ Activity A1.3 (T1.3.7). * _Duration_: 26 Weeks. * _Cycle I8\({}^{\circ}\)_: Introduction of the concept of Schema [49]. * _Objective_: To generate a structure that will permit knowledge reuse to be maximised (Schema). * _Characteristics_: The structure denominated as Schema will be capable of containing all the lists of the elements involved in the creation of an ISMS and the relationships that exist among them. * _Principal problems detected_: Having defined a set of matrices, we sought to automate and maximise its output, in addition to exploring the possibility of cloning these matrices so as to be able to carry out tests. It was also necessary to be able to incorporate any new elements that might appear during the research in an organised manner and to be able to distinguish these matrices on the basis of a series of characteristics (e.g., business sectors). * _Solution_: The creation of a structure that is capable of containing all the elements involved in the ISMS generation and maintenance process, which will additionally be able to involve new elements in its structure in a simple manner and to allow an unlimited number of configurations. * _Result_: Huge savings as regards the consultation task and the organisation needed to create the ISMS, since all the knowledge acquired in different installations is stored in the'schema' structure. * _Associated with_: the SMSG sub-process. * _Duration_: 18 Weeks. * _Cycle I9\({}^{\circ}\)_: Introduction of the concept of Maturity Level. * _Objective_: To establish evaluation processes and partial certification. * _Characteristics_: The introduction of partial certification and the concept of Maturity Level as an evaluation mechanism. * _Principal problems detected_: Many customers still considered the process to be very complex, and control points were therefore immediately required in order to deal with the projects with the closest deadlines. * _Solution_: The introduction of the possibility of establishing a certification and partial evaluation process by means of maturity levels. Tests were carried out with one level (cancel this concept), three levels, and five levels during the research. The results showed that SMEs tend to be more comfortable with a three-level system, although the process is carried out in such a way that variations are possible. * _Result_: Although involving a new management element implied an increase in costs, we consider that this cost is mitigated in the medium term by the improvements that it provides. The principal advantage is that it helps ensure that the installation and maintenance process will have a higher percentage of success. * _Associated with_: Activity A1.1 (T1.1.3). * _Duration_: 20 Weeks. * _Cycle I10\({}^{\circ}\)_: Broadening the concept of Maturity Level. * _Objective_: To determine the maximum maturity level for a company by establishing a set of'maturity rules'. * _Characteristics_: Determining the maximum maturity level that the company must attain on the basis of its current business structure.