## 6 Conclusions  
In this paper we have presented how the application of the action research (AR) method allowed us to make improvements to one methodology and to obtain another new methodology for the more efficient installation of Security Management Systems in companies. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Cycle**} & **Internal Effort** & **Failure** & **Customer Personnel** & **Total Cost to** \\  & **Hours/Month** & **Rate** & **Time Cost (\&)** & **Customer (\&)** \\ \hline
**M1** & 150 & 80 & 20 & 3000 \\
**M2** & 135 & 75 & 20 & 2700 \\
**M3** & 105 & 60 & 20 & 2100 \\
**M4** & 68 & 30 & 20 & 1350 \\
**M5** & 45 & 20 & 20 & 900 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Description of the costs in resources for the monthly maintenance of the company’s ISMS. The analysis of the AR cycles has enabled us to show how the cost and effort needed to install an ISMS have been reduced to a level that companies consider acceptable and how knowledge reuse allowed us to reduce resources by almost 75%. The characteristics provided by the methodology and its orientation towards SMEs have been very well received, and its application is proving to be very positive. This is because it allows this type of company to use information security management systems at a cost that is considered acceptable in terms of both the money invested and human resources, which has, until now, been possible only for large businesses. This research method has also allowed us to make improvements to the methodology, obtain short-term results, and reduce the costs that the use of other methodologies implies, thus satisfying the company to a greater extent. It is currently possible to consider that the version obtained fulfils the necessary requirements for it to be valid for both SMEs and large companies, but we shall continue to apply the AR method with the objective of identifying ways in which the methodology could be improved, and although these improvements will not have the same impact as the first cycles, they will suppose appreciable changes without implying an increase in costs. In summary, the results obtained after applying the method were:  
* A suitable method with which to manage security and its level of maturity in SMEs' information systems. * A security maturity and management model based on the methodology developed and denominated as the base schema, which is appropriate for the resources of SMEs. The result was accepted by the critical reference group. * Benefits for the participants: scientific benefits for the researcher and practical benefits for the beneficiaries. * The knowledge obtained can be applied immediately. The research has been developed in a typically cyclical and iterative process, combining theory and practice. All future improvements to the methodology and the model are oriented towards improving their precision whilst always respecting the principle of costs of resources, i.e., we seek to improve the model without incurring costs associated with generating and maintaining the ISMS. In conclusion, we can state that we have demonstrated the enormous value provided by qualitative research methods when improving processes such as security management as regards both obtaining a valid methodology and applying a continuous improvement process to it. The research is currently continuing with a refinement process and continuous improvements to the methodology. It is being validated in the original companies in Spain, and also through its incorporation into new companies in other countries such as Colombia, Ecuador, and Peru. This research has been partially co-funded by the ERABAC (1315 ITA227) and ESACC (1315 ITA225) projects, financed by the \"D.G.