Análisis de riesgos y vulnerabilidades de TI para GAD El Tambo, manuales y políticas, en base a la norma ISO 27002

Abstract

This research work entitled "IT Risk and Vulnerability Analysis for the Information Technology Department of GAD El Tambo" aims to develop a comprehensive proposal for risk and vulnerability management in the IT department, ensuring the protection of technological assets and the continuity of municipal operations. This proposal is based on implementing a framework based on the ISO 27001 standard to improve information security and align IT practices with international standards. The starting point was a detailed analysis of the current situation of GAD El Tambo's IT department, including identifying critical assets and assessing the associated risks. In addition, an exhaustive review of the best practices and controls suggested by ISO 27001 and ISO 27002 was conducted, adapting these regulations to the specific needs of the municipality. Based on this analysis, a risk management model was developed to mitigate the identified threats and strengthen the department's resilience to potential security incidents.

Key words: risk analysis, information management, IT vulnerability.