Plan de continuidad de negocios basada en la norma ISO 22301 para los servicios digitales del GADIC Suscal

Abstract

ABSTRACT The Decentralized, Intercultural, and Participatory Autonomous Government of the Suscal Canton (GADIPCS) provides digital services for tax collection, cadastras management, property registration, its website, and internal systems that rely on a technological infrastructure lacking formal procedures for recovery in the event of disruptions. The study aimed to design a Business Continuity Plan based on the ISO 22301:2019 standard for these services. A qualitative approach was adopted, using a single-case study design with a descriptive level and diagnostic orientation, applying a checklist of 66 controls from ISO/IEC 27002:2022, documentary review, and an inventory and risk analysis of technological assets using the MAGERIT version 3 methodology. The assessment revealed an overall compliance rate of 60.6 %, with technical capabilities in place but 20% compliance with the continuity of institutional activities and zero compliance with incident management. Of the 36 assets inventoried, 15 were identified as critical; unauthorized access to the perimeter firewall reached a critical level, and reliance on a single connectivity provider reached a high level. The proposal (PCN-GADIPCS-001) defines safeguards that reduce the average risk from 14.3 to 6.4, service-specific recovery parameters, with tax collection as the top priority (8-hour RTO, 4-hour RPO), continuity strategies, a team with designated roles and alternates, severity levels and activation criteria, a five-phase response procedure, an annual testing program, and operational forms, all traceability to clauses 4 through 10 of the standard. Keywords: business continuity, ISO 22301, digital services, decentralized autonomous government, risk analysis