## 3 The MARISMA Framework  
When we embarked upon our research, there were no methodologies that could clearly be used to apply 'Security Management Plans' in companies. There were only standards, such as the BS799 or COBIT, which explained 'what to do' but not 'how to do it'. In order to confront the aforementioned challenge, we therefore decided to develop a methodology for ISMSs that would provide a solution to the problems detected, denominated as MARISMA (Metodology for Risk Analysis and Information Security Management). The MARISMA methodology was created in such a way that it would be valid for any organisation, regardless of its size, but it was validated in and oriented towards SMEs, since these companies are far more dependent on low-cost systems. What is more, SMEs have the highest rate of failure as regards the installation of these security management methodologies [45; 46], and it was therefore important to ensure that the new methodology would be valid for them, but without the loss of quality and scientific rigour required by this type of systems. One of the objectives pursued by the MARISMA methodology is that of it being simple to apply, and that the model developed over it will allow the greatest possible level of automation and reusability to be obtained with the minimum amount of information, gathered in a very small amount of time. Speed and cost-saving have been made a priority in this methodology, signifying that the precision offered by other methodologies has been sacrificed. That is to say, the methodology developed seeks to generate one of the best security configurations, although not necessarily that which is optimum, with priority being given to time and cost saving rather than precision, although guaranteeing that the results obtained are of a sufficiently high quality. In this way, and through the use of the information obtained after implementation at various companies, we have developed an information security system management and maturity methodology and its associated model (see Figure 2). This methodology consists of three principal sub-processes:  
* _SMScG--Security Management Scheme Generation_: The principal objective of this sub-process is the construction of'schemas', which are the structures needed to build ISMSs, and which are created for a possible set of companies in the same category. These schemas are reusable and allow the time needed to create the ISMS to be reduced, along with its maintenance costs, thus making them suitable for the dimension of an SME [45]. The use of schemas is of particular interest in the case of SMEs since their special characteristics signify that they tend to have simple information systems that are very similar to each other. This sub-process is formed of the following activities and tasks:
* _Activity A1.1--Generating master tables:_ T1.1.1--Establishing the roles in the schema, T1.1.2--Establishing the business sectors, T1.1.3: Establishing the maturity levels. * _Activity A1.2--Generating maturity level tables:_ T1.2.1--Establishing maturity rules, T1.2.2--Establishing controls. * _Activity A1.3--Generating risk analysis tables:_ T1.3.1--Selecting types of assets, T1.3.2--Selecting threats, T1.3.3--Selecting vulnerabilities, T1.3.4--Selecting risk criteria, T1.3.5--Establishing relationships between types of assets and vulnerabilities, T1.3.6--Establishing relationships between threats and vulnerabilities, T1.3.7--Establishing relationships between threats and controls, T1.3.8--Establishing relationships among types of assets, vulnerabilities and risk criteria.