Diseño de un Sistema de Gestión de Seguridad de la Información, basado en la norma ISO/IEC 27001:2013, para una fábrica de cuero y calzado

Abstract

The leather and footwear company Curtiembre Quisapincha seeks to grow in the digital market, providing confidentiality and data transparency to all its customers and suppliers. With this purpose in mind, this degree work is developed, which aims to design an ISMS (Information Security Management System). This Degree Project is made up of 4 chapters and 9 Annexes. The first chapter covers the introduction, objectives and scope of the project; compiles the theoretical foundation and tools of the ISO / IEC 27000, 27001, 27002 and 27005 standards, as well as the MAGERIT v.3 methodology. The second chapter exposes the methodology of this project, which is composed of three clauses as indicated in the ISO / IEC 27001: 2013 standard. The context of the organization is the first clause, the second clause is the Leadership that establishes the commitment of the Senior Management of the company with the ISMS, and the third clause is Planning, which approach allows determining the evaluation criteria and establishment of a methodology for the ISMS, the latter based on MAGERIT v.3 and ISO / IEC27001: 2013. The third chapter contains the analysis of the results and the information security policies developed for the company, which are defined for the implementation of the ISMS. The fourth chapter includes the conclusions based on the development and results obtained, as well as the pertinent recommendations for the development and implementation of the ISMS. As a result of the development of the project, a total of 36 information assets were obtained, as well as 395 risks associated with the company's assets and to counteract these information security risks, 64 controls were selected that will reduce the risk in the future. The Annexes contain the tables and matrices obtained from the risk analysis and management, as well as the treatment of risks; The interview with the Head of the Information Technology Area is also included, which allows to determine the current situation of the company