Implementación de un sistema de gestión de seguridad de la información bajo los lineamientos de la norma NTC ISO/IEC 27001:2022 integrada con NTC ISO 9001:2015 y NTC ISO 14001:2015 para el área TI de la empresa Extrucol S.A.

Abstract

In this study, we can see the growth that Extrucol S.A. has experienced. In its 35 years of existence, the organization has undergone exponential growth. Understanding the dynamics of the current context and in pursuit of its strategic objectives, it decided to implement the quality management system eighteen years ago, followed by the environmental management system. These systems have been maintained and are currently certified under NTC ISO 9001:2015 and NTC 14001:2015 standards. Today, there are various management systems, each with different improvement purposes and objectives. The great advantage is that all of them follow a high-level structure, making it easier to potentially integrate multiple systems if the organization chooses to do so. Currently, organizations are digitizing their information, not only to reduce environmental impact but also to ensure information availability in the post-pandemic era. Having accessible information is essential to operate smoothly and without disruptions. This project aimed to design and implement an integrated information security management system based on the NTC ISO/IEC 27001:2022 standards. This integration was achieved with the previously implemented management systems within the organization, following the common requirements methodology. The process began with a preliminary diagnosis through gap analysis, designing the system in accordance with the Deming cycle methodology, and implementing it through documentation and the SIG (Security Information Management System). The verification was validated through an audit exercise, with a report as evidence. The project concluded by fully aligning the management systems with the requirements of all three standards, undeniably increasing the company's confidence and information security.