Propuesta De Un Sistema De Gestión De La Seguridad De La Información (SGSI) Para La Universidad Particular Internacional SEK

Abstract

This thesis proposes the design and implementation of an Information Security Management System (ISMS) for Universidad Particular Internacional SEK (UISEK), grounded in the ISO/IEC 27001:2022 standard, the NIST Cybersecurity Framework 2.0, and ITIL v4 best practices. The proposal addresses a critical challenge in the Ecuadorian context. Pilatuña and Ángeles (2025) indicate that Ecuador leads Latin America in ransomware infection rates (22%) and phishing-affected organizations (20.9%), positioning the country as one of the most cybersecurity-vulnerable in the region. Within this regulatory framework, the Personal Data Protection Superintendency (SPDP, 2025) has begun enforcing penalties for LOPDP violations exceeding USD 259,000, evidencing the concrete economic and reputational risk faced by higher education institutions lacking a formalized ISMS. The research adopted a mixed applied approach with a sequential explanatory design, integrating institutional document analysis, compliance checklists to assess ISO/IEC 27001:2022 control fulfillment, and direct participant observation given the researcher's role as a member of the institution's IT team. Risk assessment was conducted using the MAGERIT v3 methodology across five institutional asset categories: physical, digital, communication networks, cloud services, and personnel and internal processes. The system's main deliverables include: (1) a three-tier governance framework (Process Owner, Information Owner, and Custodian) aligned with the CIA principles of the standard; (2) a comprehensive set of eleven security policies referencing the 93 controls of ISO/IEC 27002:2022; (3) a three-level documentary architecture comprising a strategic tier (POL-SGSI), an operational tier (PRO-SGSI), and an evidence tier, with instruments POL-SGSI-001, POL-SGSI-002, POL-SGSI-003, PRO-SGSI-001, and PRO-SGSI-002; (4) a risk matrix with quantitative CIA valuation (scale 1–10) and full traceability between assets, threats, and controls; and (5) a five-phase contingency plan incorporating the six functions of NIST CSF 2.0. The technological support of the ISMS was built as a web system using Angular 19, Node.js, and PostgreSQL, implementing three user roles (IT Supervisor, Process Owner, Asset Owner), two-stage approval workflows, automated PDF certificate generation, and QR code asset labeling. The proposal ensures compliance with Ministerial Agreement MINTEL-2024-0003, the LOPDP, and the Budapest Convention ratified through Executive Decree No. 332 in 2024. The resulting model serves as a replicable framework for Ecuadorian higher education institutions seeking to strengthen their information security management maturity and align their processes with SENESCYT accreditation requirements.