Evaluación del sistema de gestión de la seguridad de la información de la Empresa Eléctrica Quito utilizando la norma ISO 27002

Abstract

The following project Evaluation of the Information Security Management System from Empresa Electrica Quito using the ISO 27002 standard was developed as a result of the need to evaluate the implementation of the ISO / IEC 27002 controls for Information Security in Empresa Electrica Quito S.A. It was developed in order to serve as support staff Empresa Electrica Quito S.A, to identify levels of compliance in the implementation of ISO / IEC 27002 controls, as well as the application of guidelines from the Government Scheme Information Security (GSIS) established by the National Secretariat of Public Administration. It uses a methodological evaluation proposal based on the criteria by the author, itself uses a table relationship between the domain selected from ISO 27002, guidelines from GSIS and Critical Security Controls (CSCs) SANS INSTITUTE, to measure the level of compliance with the implementation of that provision in the EEQ. The aforementioned methodological proposal is to review each of the guidelines GSIS, compared with the corresponding controls of ISO 27002 and based on the results of the review and comparison, obtaining compliance levels of each control and control target of ISO 27002. In addition, by using the CSCs of the SANS Institute, proposed improvements in the asset management process. The results of the evaluation showed that levels of compliance with procedural level, the implementation of GSIS in Empresa Electrica Quito level Asset Management, are partial and go according to their plan of continuous improvement.