Information Security Policies regarding to Statal Polytechnic of Carchi University

Abstract

This work is framed in the development of information security policies for the Carchi State Polytechnic University (UPEC), as a requirement for the establishment of the Government Information Security Scheme (EGSI) based on the Ecuadorian technical standard INEN ISO/IEC 27001. The purpose of the elaboration of the information security policies for this institution is to have the necessary documentation to define the procedures to safeguard the information and modify the continuity in the operations of the institutional computer services. The methodology proposed by the EGSI and the ISO/IEC 27001 standard that establishes the requirements and controls for the necessary objectives for adequate management of security information were used.

Information was collected from the team work of the IT department of the UPEC University to know in detail the portfolio information of the technological services offered to the university community. With the obtained information, a study of the controls established in the EGSI was carried out and each of them was related to the way of knowing the level of compliance and maturity of the Institution.

The security Information policies were elaborated and evaluated taking as a starting point the EGSI sections that correspond to: asset security, secure software development, access control to computer systems, data network security, risk management and continuity of operations; actions that allow promoting continuous improvement in the continuity and incident management processes.