Plan de Gestión de Seguridad de la Información bajo la norma ISO/IEC 27001:2013, en una Institución Financiera Ecuatoriana

Abstract

This paper has the objective of developing an Information Security Management Plan based on the ISO/IEC 27001:2013 standard. For which, we make a detailed study of the main services at a financial institution as well as the evaluation of the technological infrastructure capable to support the mentioned services, with the goal of establishing a security level based on both risk analysis and applicable security criteria; also considering the law and regulations governing them. Based on the Risk Methodology NIST SP 800-30 plus the information previously obtained and analyzed, we define an Applicability Statement that contains control objectives as well as standard applicable controls, whereby we establish the Information Security Management Plan.