The information security management system under the NTE ISO / IEC 27001 standard in Institutions of Higher Education (Ecuador). (Original)

Abstract

With the objective of describing a methodology for an Information Security Management System (ISMS) for higher education institutions in Ecuador, under the NTE INEN-ISO / IEC 27001 standard, which will be useful at the time of its application and will facilitate the development of the phases of the PHVA cycle (to Plan, to Do, to Verify and to Act) at the institutional level. It was taken as a reference to the State Technical University of Quevedo (STUQ), the key processes of the case study university were identified, the information assets and controls that allowed contextualizing the scope of the ISMS according to ISO 27001 and that will allow STUQ to organize, to design and to manage systematically its ISMS, propose strategies for change and improvement, value and insure its assets from possible risks and vulnerabilities. Finally, the contribution of this study is a proposal for the implementation of the Information Security Management System in the STUQ, which includes a series of policies and procedures taking into account the identified findings, such as the procedures for the organization of the structure, an awareness and training plan, specific policies of information of the security and a business continuity plan; which must be implemented in order to contribute to the improvement of the levels of confidentiality, integrity and availability of the STUQ information.