Diseño de un SGSI bajo norma ISO/IEC 27001:2013 aplicado a un caso de estudio

Abstract

The main objective of this dissertation is to design an ISMS for the H.E-1 which follows international standards and is tailored to effectively minimize its current security risks through adequate procedures. Besides, we strived to achieve appropriate management of information assets as the organization makes use of new information and communication technologies to digitalize and automate its information to improve the quality of service to its users. The applied methodology is composed of three phases: (1) diagnostic assessment, (2) determination of the feasibility, and (3) design of an ISMS based on the guidelines indicated in the ISO / IEC 27001: 2013 standard and the Magerit methodology for risk management according to the organization's requirements. This document includes five chapters, by the end of the execution of this project, the critical assets of the organization had been identified, along with threats and vulnerabilities on which the domains, controls, and selected objectives of Annex A of the ISO 27001 standard are based, and as a result, obtaining the risk mitigation plan which details the appropriate actions to be taken by the organization to minimize the identified risks.