METODOLOGÍA PARA LA IMPLEMENTACIÓN DE UN SISTEMA DE GESTIÓN DE SEGURIDAD DE LA INFORMACIÓN ISO/IEC 27001: PARA SOPORTE DE ÁREAS DE ADMISIÓN Y ATENCIÓN DE UN HOSPITAL PÚBLICO

Abstract

The present study analyzes the way to obtain and to propose a methodology that is applicable locally, in a pragmatic way, and dynamic, when implementing an Information Security Management System (ISMS), based on ISO / IEC 27001 for public in Ecuador, by studying similar projects in the health area, in other countries, and even in other industry verticals. Therefore, the importance of ICTs for the internal processes that hospitals have was analyzed and discussed. Once, the level of the importance of the ICTs was understand and determined, the need for information security in each process was analyzed to protect financial resources, information, legal situation and other goods, tangible and intangible, that also allow the internal management of all areas to be safeguarded. Finally, an adequate methodology is proposed for the implementation of a management system based on: 1) maintaining the inventory of information assets, 2) cataloging the processes of the organization, 3) manage the catalog of threats and vulnerabilities, 4) calculate the appraisal of information assets, 5) record and maintain the identification of risks, 6) manage the risk assessment, 7) manage the assignment of responsible for monitoring and actions for the treatment of risks, 8) record the association of documentary evidence, 9) generate reports and queries of monitoring for the management of controls of the Standard and 10) generate the declaration of applicability.