Propuesta para la Implementación de Sistemas de Gestión de Riesgos de TI para la Cooperativa Yuyay Ltda

Abstract

This thesis proposes the implementation of an IT Risk Management System in the YUYAY Ltda. savings and loan union to strengthen information security and ensure the operational continuity of the cooperative in an increasingly digitized environment. Through a solid theoretical framework, the critical concepts of IT risk management are identified, and the current state of the information systems and the technological infrastructure of the cooperative is also diagnosed. The methodology used in this research follows a mixed approach, combining both qualitative and quantitative analysis. Information is collected through key personnel interviews, and risk analysis matrices are used to assess vulnerabilities and threats affecting critical assets. Subsequently, mitigation strategies are designed based on the principles of the ISO 31000 standard, proposing security controls, incident response plans, and recommendations for continuous risk monitoring. The thesis aims to provide a comprehensive solution that allows the cooperative to efficiently manage its technological risks, guaranteeing the protection of its information assets and maintaining alignment with its strategic objectives. It ensures the integrity, confidentiality, and availability of the systems, strengthening the ability to face security incidents and safeguard the operation.

Keywords: assets, ISO 31000, risk management, threats