# MASISCo--Methodological Approach for the Selection of Information Security Controls
## 3 Results
### Descriptive Statistics
\begin{table}
\begin{tabular}{l l l} \hline \hline \multirow{3}{*}{Usefulness} & Mean & 77. 8 \\ \cline{2-3}  & 95\% Confidence interval for the mean & Lower limit & 69.31 \\ \cline{2-3}  & & Upper limit & 84.86 \\ \cline{2-3}  & Median & 78.50 \\ \cline{2-3}  & Minimum & 56 \\ \cline{2-3}  & Maximum & 94 \\ \hline \multirow{3}{*}{Ease of use} & Mean & 65.42 \\ \cline{2-3}  & 95\% Confidence interval for the mean & Lower limit & 56.49 \\ \cline{2-3}  & Upper limit & 74.45 \\ \cline{2-3}  & Median & 60.50 \\ \cline{2-3}  & Minimum & 47 \\ \cline{2-3}  & Maximum & 91 \\ \hline \multirow{3}{*}{Compatibility} & Mean & 68.92 \\ \cline{2-3}  & 95\% Confidence interval for the mean & Lower limit & 57.02 \\ \cline{2-3}  & Upper limit & 80.81 \\ \cline{2-3}  & Median & 71.50 \\ \cline{2-3}  & Minimum & 34 \\ \cline{2-3}  & Maximum & 91 \\ \hline \multirow{3}{*}{Subjective Norm} & Mean & 58.67 \\ \cline{2-3}  & 95\% Confidence interval for the mean & Lower limit & 50.15 \\ \cline{2-3}  & Upper limit & 67.18 \\ \cline{2-3}  & Median & 57.50 \\ \cline{2-3}  & Minimum & 35 \\ \cline{2-3}  & Maximum & 83 \\ \hline \multirow{3}{*}{Intention to Adopt} & Mean & 34.67 \\ \cline{2-3}  & 95\% Confidence interval for the mean & Lower limit & 29.05 \\ \cline{2-3}  & Upper limit & 40.28 \\ \cline{2-3}  & Median & 35.00 \\ \cline{2-3}  & Minimum & 17 \\ \cline{2-3}  & Maximum & 49 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Descriptives of UMMM dimensions. These values indicate that the students perceive that the main strength of the proposal is that it contributes to greater effectiveness and efficiency in the work of the security consultant (U). In addition, they highlight its generality and structuring qualities (C). On the other hand, only 14% of the comments indicate that the proposal is not complex to learn and use (FU). Finally, the NS dimension is not mentioned in any of the comments. Table 7 summarizes the percentage of negative responses related to each model dimension. Of these opposing opinions, only 18.75% refer to U and only 6.25% to C. However, 75% of the comments point directly to FU as the main problem with the proposal. Again, NS does not appear in the comments, adding weight to the initial hypothesis that, being a methodological framework dealing with a problem for which there are no standardized alternatives, it is not an aspect to which the subjects give greater importance concerning the other domains. \begin{table}
\begin{tabular}{c c c} \hline
**Dimension** & **Answers** & **Percentages** \\ \hline U & 10 & 47.6\% \\ EU & 3 & 14.3\% \\ C & 8 & 38.1\% \\ NS & 0 & 0\% \\ \hline \end{tabular}
\end{table} 
Table 6: Summary answers—Positive aspects. Figure 7: Descriptive Statistical Graphs. These percentages show that students perceive the proposal as challenging to use and learn, that it requires previous knowledge, and that if they do not have it, it takes a considerable time to obtain it. To a lesser extent, they think they need to model the problem may slow down their work under certain conditions. Finally, one opinion refers to the fact that this is not the usual way they are used to programming, which causes them some difficulties related to C.  
Faced with these results, we hypothesize that the high percentage of negative responses in the Ease of Use domain is mainly due to the inadequate training of Computer Science students regarding OR, especially in modeling and solving optimization problems, which hinders the use of the proposal. As can be observed, the qualitative opinions of the students are consistent with the scores obtained through the UMM-Q instrument. Therefore, we conclude that the proposed methodological framework is a helpful tool to support the decision-making process in selecting controls for a proposed improvement in the progress of compliance with a standard. Furthermore, it is an instrument compatible with the assessor's practices. However, it is not easy to use since it requires previous knowledge in modeling optimization problems and presents a marked learning curve.