# MASISCo--Methodological Approach for the Selection of Information Security Controls
## 3 Results
### Phase 1: Investigation of the Problem
Table 1 summarizes the proposed control recommendation methods classified according to, on the one hand, the complexity of the problem addressed: (i) Prioritization, as an ordered list of security controls but without selecting a subset of these; (ii) Selection of controls, where the models recommend a specific set of controls to implement; (iii) Programming, where in addition to selecting controls, the model proposes a plan for the implementation of these controls. On the other hand, the methods are classified between (a) quantitative solutions, i.e., mathematical models where at least one objective function exists and some known optimization algorithm is executed, and (b) qualitative solutions. As a result of the literature review, we found 43 articles between 2007 and 2022. Of these, 37 articles (86%) correspond to qualitative proposals, where 9 articles (21%) are at the prioritization level and 28 (65%) at the control selection level. In addition, only 6 articles \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Category**} & \multicolumn{2}{c}{**Solution Type**} \\ \cline{2-3}  & **Quantitative Solutions** & **Qualitative Solutions** \\ \hline Prioritization & & 9 papers—[32; 33; 34; 35; 36; 37; 38; 39; 40] \\ Selection & 6 papers—[41; 42; 43; 44; 45; 46] & 28 papers—[47; 48; 49; 50; 51; 52; 53; 54; 55; 56; 57; 58; 59; 60; 61; 62; 63; 64; 65; 66; 67; 68; 69; 70; 71; 72; 73; 74] \\ Programming & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Classification of proposals according to the complexity of the problem and the use of quantitative techniques. (14%) propose quantitative methods for selecting security controls. These results indicate that the vast majority of the proposals are concerned with the problem of security control selection, but only a few resort to quantitative methods from Operations Research to solve them. However, these proposals do not define a methodical process that completely covers the definition of the best set of controls to recommend but rather propose quantitative techniques to be used at some point in the process. It is then up to the expert's judgment as to how to apply the methods recommended by each proposal. On the other hand, from the literature review, it is evident that there are no proposals that address the problem of scheduling the implementation of the selected controls, unlike our proposal, which defines a set of methods to support this process. Figure 2 shows the distribution, over the years, of the articles found. In this image, we observe that the most significant number of articles is concentrated between 2011 and 2018, with 26 (60.4%) proposals focused on the \"selection\" level. We also note that, although the number of articles has decreased in the recent years, proposals continue to be developed, so we consider it a problem of interest to the community. From the above, we conclude that the recommendation of improvement actions is a desirable stage in operation and evaluation of an ISMS. However, both the different standards that regulate the implementation and operation of the management system, as well as the practices identified in the industry, do not provide a methodological framework to support the process of identification and selection of improvements, leaving the application of the selection techniques to the expert's discretion.