Implementación de un Sistema de Gestión de Seguridad de la Información (SGSI), Bajo la Norma ISO/IEC 27001:2013, en una Empresa de Servicios

Abstract

This Titling Project presents the development of qualifications and guidelines for the implementation of a Management System Information Security (ISMS), for a service of "Census of Commercial Information" provided by a service company "XYZ" to a power distributor. The ISMS will be designed and implemented under the ISO / IEC 27001:2013. To achieve this recognition a detailed panorama of the development of the service in terms of its component processes and information assets involved is performed. ISMS development also includes the recognition and management of all threats, vulnerabilities and risks to which is exposed the service using a methodology of risk management; An analysis was also conducted to identify the controls necessary to effectively mitigate the risks that information is exposed, these controls will be adapted to the reality of the service through the formal creation of policies and procedures necessary to set the tone for the work done by company employees. Finally a model for the implementation of each of the selected controls will be developed to ensure service information to administrative, operational and technical level according to the needs, this model will include the current level of compliance controls, policies and procedures developed and the deadline for implementing them.