EVALUACIÓN DE RIESGOS INFORMÁTICOS Y DISEÑO DE UN PLAN DE CONTINGENCIA PARA EL ÁREA DE TECNOLOGÍA DE LA EMPRESA IMPORTADORA ALVARADO VÁSCONEZ CIA. LTDA., UBICADA EN LA CIUDAD DE AMBATO.

Abstract

Companies every day are growing their information and assets which have the need to safeguard the integrity of their information against potential risks, these risks if not detected and controlled in time can cause great damage and economic losses, to mitigate these risks it is necessary to have a methodology for analysis and risk management. For this reason we have seen the need to implement the methodology MAGERIT version 3.0, which helps us to effectively manage the risks to which our most critical assets are exposed to the technology area of the company Importadora Alvarado Vásconez Cía, based on the ISO 31000 standard, which will allow us to prevent and detect incidents that may occur, obtaining information about the vulnerabilities to which they are exposed, determine the impact that can generate and the threats if they materialize in the information systems, establishing processes to identify and reduce the risks that threaten the stability of the company, IT infrastructure and most importantly the information. After the risk analysis, a contingency plan will be developed based on ISO/IEC 27001:2013, which will consist of 4 stages, which will help us to ensure that the company's critical processes continue to function in the event of a failure in the technological systems and allow them to continue operating, even at the minimum level of their activities. The results obtained will help to identify the risk level of the company's most critical assets, the current security maturity level, as well as the threats or vulnerabilities to which they are exposed, their risk levels including the impact and probability of occurrence, and their respective contingency plan for the company's most critical processes.