## 5 Applying the Action-Research Method
### Applying the Action-Research Method during the ISMS Development Phase  
A description of how the cycles evolved, from the installation of the classic 'Security Management Plan' model to that of the current model in which the framework of MARISMA is applied, is shown as follows. * _Cycle I1\({}^{\circ}\)_: Installing an ISMS using a classic process. * _Objective:_ To install an ISMS in the SME. * _Characteristics:_ An ISMS was installed and the whole process was developed to the customer's specifications. The following were carried out: a checklist by means of controls, a maximum level risk analysis and libraries of regulations and procedures, were carried out from scratch and were totally adapted. The greatest possible number of managers was involved in the development processes. * _Principal problems detected:_ (i) It was impossible to organise work-related meetings without first reaching an agreement with all the managers involved; (ii) It was impossible to carry out a risk analysis owing to its detail and complexity; (iii) The users are against working with procedures on paper owing the huge amount of time needed to learn to do so; (iv) Difficulty involved in maintaining system updated and establishing corrective plans. * _Result:_ The customer's general dissatisfaction with the result. The result obtained is complex and costly to maintain and is not aligned with the company's management. The customer does not believe that it is possible to attain an acceptable ROI. * _Duration:_ 48 Weeks. Since it was impossible to undertake the project because of its complexity for SMEs, a series of corrective cycles was initiated with the objective of resolving the various problems detected. * _Cycle I2\({}^{\circ}\)_: Resolving aspects related to the risk analysis. * _Objective:_ To simplify the risk analysis. * _Characteristics:_ We sought to simplify the carrying out of the risk analysis by: (i) Selecting course-grained activities, i.e., activities that were as general as possible as opposed to being detailed; (ii) Simplifying the risk analysis. * _Principal problems detected:_ The managers of the departments were more than ready to collaborate when asked to use few words to define between 2 and 5 groups of assets that
were of value to their departments. The problem of calculating and reviewing the risks was simplified to those risks related to the assets. _Solution:_ The simplification of the assets of which the information system is composed. _Result:_ The managers of the departments were more than ready to collaborate when asked to use few words to define between two and five groups of assets that were of value to their departments, rather than having to fill in a complex form in order to select assets and evaluations. This signified that the meeting and the asset selection processes were speeded up. Time was saved as regards calculating the risks and the risk reports, and the adaptations that have to be made when changing the value of assets. _Associated with:_ Activity A1.3 (T1.3.1-T1.3.4) and A2.4 (T2.3.1). _Duration:_ 44 Weeks. * _Cycle I3\({}^{\circ}\)_: Resolution of aspects related to evaluating the level of security. _Objective:_ To simplify and increase the precision of the mechanism used to evaluate the level of security. _Characteristics:_ We sought to simplify and increase the precision of the activity that allows the company's current level of security to be determined. _Principal problems detected:_ When an auditor carries out an audit regarding the level to which the security controls are fulfilled, the results obtained tend to vary considerably when compared with those obtained by other auditors, thus making the evaluation of these controls very imprecise. _Solution:_ The establishment of a verification list at sub-control rather than control level. _Result:_ The controls were divided into more detailed questionnaires, thus reducing the margin of variation among the different auditors.