## 5 Applying the Action-Research Method
### Applying the Action Research Method during the ISMS Maintenance Phase  
Let us consider that it is possible to begin applying the action research method to the ISMS maintenance process:  
* _Cycle M1\({}^{\circ}\)_: Initial process. \[ \begin{array}{ll}\circ&\text{\emph{Objective:} The users begin utilising the security management system.}\\ \circ&\text{\emph{Characteristics:} (i) The procedures generated by the system are used on paper; (ii) There is no support tool; (iii) The level of security management is known every 2-3 years when a periodical audit is carried out. \[\circ&\text{\emph{Principal problems detected:} (i) the users consider that it is very complicated to know the functioning of the procedures; (ii) the person responsible for security is overwhelmed by the cost of maintaining the system; (iii) not knowing which part of the system needs more resources leads the system to undergo progressive degradation. \[\circ&\text{\emph{Solution:} Generalised changes as regards the way work is carried out.}\\ \circ&\text{\emph{Result:} The current way of working leads to a medium-term failure rate in over 80% of the cases in which the system has been installed.}\end{array} \]
* _Cycle M2\({}^{\circ}\)_: Improvements oriented towards controlling the security level. \[\circ&\text{\emph{Objective:} To discover the security level of the controls at all times.}\\ \circ&\text{\emph{Characteristics:} The person responsible for security must, at all times, know which controls are degrading, with the objective of being able to balance the resources that are available. \[\circ&\text{\emph{Principal problems detected:} Not knowing the level of security management so as to be able to control it in the short term signifies that it is not possible to take the measures that are necessary to prevent the system from functioning incorrectly.}\\ \circ&\text{\emph{Solution:} The introduction of the concept of the scorecard.}\end{array}\] \begin{table}
\begin{tabular}{l c} \hline \hline
**Description of Activity (Mod-I13)** & **Hours** \\ \hline Pre-audit & 16 \\ Identification of assets & 8 \\ Risk Analysis and Management & 24 \\ Security Culture Course & 8 \\ Training regulation domains (14) & 14 \\ Consultation domains for the regulation. & 49 \\ Literal Training in the regulation & 4 \\ Literal consultation as regards the regulation. & 25 \\ Review and validation of documentation. & 16 \\ Internal audit & 16 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Description of cost in consultation hours for the MARISMA installation model in interaction 113. Result: The introduction of the concept of the scorecard led to a reduction in the failure rate of between 75% and 80%. Associated with: Activity A3.3. * _Cycle M3\({}^{\circ}\)_: Improvements oriented towards controlling the security level. * _Objective_: The use of a tool and metrics to automate the maintenance of the security scorecard. * _Characteristics_: The person responsible for security must, at all times, know which controls are degrading with the objective of being able to balance the resources that are available, but it must not take much time to acquire this knowledge. * _Principal problems detected_: it is necessary to introduce the concept of the scorecard, but as this cannot depend on the continual audits carried out by the person responsible for security we must rather incorporate automation processes. * _Solution_: The introduction of a tool with metrics that will enable the security scorecard maintenance process to be automated. * _Result_: The introduction of the tool and the metrics led to a reduction in the failure rate of between 60% and 70%. * _Associated with:_ Activity A3.3 (T3.3.1-T3.3.7). * _Cycle M4\({}^{\circ}\)_: Improvements oriented towards procedure management. * _Objective_: To automate the use of the procedures by means of a tool. * _Characteristics_: The person responsible for security and the users must, at all times, know the functioning of all the procedures, although the majority of those procedures do not directly affect them.