## 1 Introduction  
Companies in the globalised competitive business environment are increasingly more dependent on information systems, since they have proved to have an enormous influence as regards raising their level of competitiveness [1]. However, if these information systems do not have appropriate security management, then they have no real value since they cannot provide companies with sufficient guarantees of continuity [2; 3]. Companies are therefore becoming conscious of just how important appropriate information security systems and their correct management really are [4]. This signifies that although many businesses take the risk of doing without adequate protection, many others have understood that information systems are useless without security management systems and their associated protection measures. Security has existed in the world of computing for more than 30 years [5; 6], but although a multitude of globally accepted security solutions has come into being (e.g., the subject/object access matrix model [7], access control lists [8], multilevel information flow security [9], public key cryptology [10; 11] or the role-based access control model [12], to name but a few), the millions of users connected by networks are still generally highly mistrustful of their security. An Information Security Management System (ISMS) can be defined as a management system that is used to establish and maintain a secure environment for information. The principal objective of ISMSs is to tackle the putting into practice and maintenance of the processes and procedures needed to manage the security of information technologies [1; 4; 13; 14; 15]. [PERSON] [16] states that ISMSs are concerned not only with the security of information but also include the management of that information's formal and informal aspects [3]. These actions include the identification of the information's security needs and the putting into practice of strategies to satisfy those needs, measure results, and improve protection strategies [2; 6]. At the present time, which is considered to be the era of the Internet, security has become a generalised and increasing concern in all areas of society: business, domestic, financial, individual, etc. [17]. Society increasingly depends on a wide range of critical mission software systems, such as air traffic control systems, financial systems, or public health systems. Given the potential losses that those companies that trust in these hardware and software systems may have to confront, it is critical to appropriately ensure the security of information systems from the beginning of their lifecycles [18; 19]. The author of [20], moreover, analysed the SMEs in Europe and the United States, and reached the conclusion that the Internet has led to a series of changes within the framework of global collaboration. This makes it necessary for these companies to protect their information systems, which are becoming the neural centre of their growth and changing the way in which they communicate, do business, and attain objectives. All of this has led to an increase in delinquency and threats to security, such as spam, phishing, and viruses, thus destroying users' confidence in the Internet [21]. The information security problem is characterised by its complexity and interdependence. Security management consists of several important factors and elements that are interrelated. This situation is complicated further still by the human factor, since human beings have free will and always act in their own interests [22]. Furthermore, the fact that most business activities are beginning to depend on the Internet makes security one of the principal concerns as regards creating a sustainable business fabric [23]. The SMEs in developed countries tend to have a weak understanding of information security, security technology, and control measures, and tend to forget about risk analyses or the development of security policies [24; 25; 26; 27].