# MASISCo--Methodological Approach for the Selection of Information Security Controls
## 3 Results  
### Phase 1: Investigation of the Problem  
As a first step of the research, we studied several bibliographic sources to determine which processes are currently applied to manage, select or recommend information security controls. We reviewed the scientific literature through a systematic mapping and proposals from industry practice. To get the look from practice, we reviewed the indications proposed in two standards of the International Organization for Standardization (ISO) ([[https://www.iso.org/](https://www.iso.org/)]([https://www.iso.org/](https://www.iso.org/)) (accessed on 3 November 2022)). The first one is the ISO/IEC 27001:2013 [17] since it is one of the best-known standards for information security management [29]. The second is ISO/IEC 19011:2018 [30], a guide for developing management system audit processes. This standard proposes several steps to carry out an audit, among which is the definition of an improvement plan, which involves the selection process of controls of a standard. ISO/IEC 27001:2013 was developed to propose requirements for designing and implementing an Information Security Management System (ISMS). According to this standard, Section 6.1.3, \"Information security risk treatment\", in point (b) indicates that the organization must determine the controls necessary to implement the information security risk treatment. However, as can be seen, this indication does not provide detailed guidelines on how to make this selection; it only implies that this selection should be consistent with the risk levels identified by the organization. Therefore, it is left to the assessor's discretion to decide how to discriminate from the entire set of controls that allow risk mitigation, those that will allow him to comply with the organization's resource restrictions. On the other hand, ISO/IEC 19011:2018 is a non-certifiable international standard that establishes guidelines for the audit of a management system. Therefore, this standard does not establish requirements. However, it is a guide that orients the management of an audit program that allows the improvement of the implemented management system, stimulating the incorporation of practices associated with the evaluated management system. According to Note 2 of point 3.4 of the standard, \"Audit findings may lead to identifying opportunities for improvement or recording best practices\". Similarly, in point 6.4.8, it is stated that \"If the audit plan so specifies, audit findings may lead to recommendations for improvement or future audit activities\". From these points, it is clear that the guide states that the audit team, as part of the audit report, may recommend a series of actions that the organization can take to improve the management system. However, given the generality of the standard, it does not establish a procedure or methodology to guide the audit team on how to determine or select the set of improvements or actions the organization should implement in its management system. Thus, this process, as in the previous case, is left to the discretion and experience of the audit team. As has been seen, none of the standards reviewed provide guidelines on how to proceed to make recommendations for improvements through implementing security controls. In other words, although both standards recognize the need to move towards improvement by implementing best practices in the work of the ISMS, neither provides formal guidelines on how to select the best actions to implement, leaving this process to expert judgment. To evidence the proposals in the literature regarding the application of methods or techniques to select and schedule the optimal set of information security controls, we analyze the results of a systematic mapping performed in [31].