Diseño de un Sistema de gestión de seguridad de la información basado en la norma ISO 27001 para la empresa EMMAIPC-EP

Abstract

The Cañar Canton Municipal Public Enterprise for Comprehensive Sanitation (EMMAIPC-EP) manages administrative, operational, and financial information without a formal security framework to protect the confidentiality, integrity, and availability of its assets. This research aimed to design an Information Security Management System (ISMS) for the institution based on the ISO/IEC 27001:2022 standard. A mixed approach was applied, with a descriptive level and a proposal-oriented scope, along with the ISO/IEC 27005:2022 risk management methodology. The assessment identified 91 technological assets, of which 59.3% had exceeded their useful life, with a maturity level of 1.5 out of 5, and 16 risks, five of them at a very high level and eight at a high level; the most serious finding relates to the cloud-based billing and collection system hosted under the provider’s administrative account. The proposal includes a valued inventory of 21 information assets, a risk treatment plan, a Statement of Applicability with 86 applicable controls from Annex A, a general policy, eight specific policies, seven roles, ten indicators, and twelve-month implementation model based on the PDCA cycle. The validation revealed 100% risk-control coverage and showed that 14 of the 16 risks reached an acceptable residual risk level. It was concluded that the main gaps are organizational rather than technological and that the standard is applicable to a small public enterprise when the design is adapted to its actual structure.

Keywords: information security, ISMS, ISO/IEC 27001:2022, risk management, public sector.