Diseño y desarrollo plan implementación sistema integrado gestión basado normas NTC-ISO 9001:2015 e ISO/IEC 27001:2022 para fortalecer procesos y aseguramiento información Berruit SAS

Abstract

This graduate work, developed under a consulting modality, aimed to design and develop an implementation plan for an Integrated Management System (IMS) based on the NTC-ISO 9001:2015 (Quality Management) and ISO/IEC 27001:2022 (Information Security) standards for Berruit SAS, a company specializing in the provision of information technology and cybersecurity services. The initial diagnosis revealed a compliance level of 15% against both standards, exposing critical gaps in process management, strategic planning, and information security controls. To address these challenges, the technical specification PAS 99:2012 was adopted, supported by the ISO Harmonized Structure (clauses 4 to 8), structuring the intervention in four phases aligned with the PDCA cycle: diagnosis and gap analysis, work plan construction, IMS design and structuring, and implementation. The methodology integrated qualitative techniques such as document review, semi-structured interviews, SWOT-PESTLE analysis, risk management matrices, and the development of the Statement of Applicability (SoA). As a result, a compliance level of 97.5% was achieved in the operational clauses, 90.3% in the Annex A controls of ISO/IEC 27001:2022, and an overall IMS average of 82.7%, exceeding the established target of 80%. More than 80 coded documents were generated, establishing the organizational, procedural, and normative foundations that prepare Berruit SAS to advance toward the performance evaluation, internal audit, and formal certification phases during 2026.