An Information Security Management System – ISMS is focused on managing and protecting sensitive information within an organization. Its main objective is to establish a structured framework that allows the organization to identify, manage, control and minimize risks related to information security.
At CINTEL we develop the implementation of the ISMS aligned to the business model and the security requirements of your organization, based on the experience acquired after supporting more than 100 organizations in the construction of this type of Systems.
Some of the advantages of implementing an ISMS in your organization are the following:
- Protection of critical and sensitive information.
- Compliance with regulations and standards.
- Reduction of security risks.
- Business continuity and disaster recovery.
- Increased customer and business partner confidence.
- Operational efficiency and process standardization.
- Effective security incident management.
- Promotion of safety awareness among employees.
- Long-term cost reduction.
- Competitive advantage through information security.
Why develop this Management System hand in hand with CINTEL?
In the process our group of experts accompanies the client in the phases of the PHVA cycle of the Information Security Management System – ISMS, according to the ISO/IEC 27001 standard and aligned with the best international practices, in order to meet the requirements that allow the client to achieve the certification in this standard.
On the other hand, at CINTEL we support organizations in the generation of all compliance documents for the implementation of the ISMS, aimed at complying with the Colombian Technical Standard ISO27001:2022.
Likewise, personnel training is a key point that we carry out in coordination with the organization for the generation of its own capabilities.
This is how we developed this Management System at the Center:
In the Planning phase:
- We develop an information security diagnosis that will allow us to identify the gaps in the organization’s security controls with respect to those required by ISO/IEC 27001 and national regulations.
- We perform an evaluation of the risks present in the information assets in accordance with a risk analysis methodology.
- We propose a mitigation plan for the risks not accepted by the organization, which is aligned with the client’s business model, in order to directly impact the security controls required by ISO/IEC 27001.
- An Information Security Plan is developed that includes the definition of an applicability statement, the ISMS policy, the risk matrix and the action plan with the formulation of information security projects.
- We execute penetration tests according to OSSTMM and OWASP methodologies.
In the Implementation phase:
- We accompany the client in the implementation of the projects defined in the action plan of the previous phase.
- We assist in the process of defining the RFP for the procurement of goods and services.
- We assist in the supplier evaluation and selection process.
- We provide advisory services in the supervision or auditing of contracted projects.
In the Verification phase:
- We test the effective operation of the security controls implemented in the previous phase, in accordance with ISO/IEC 27001, through measurement, aggregation, evaluation and presentation techniques.
- We conducted a Pre-audit to the implemented ISMS.
In the Performance phase:
- We consolidated the evaluation of audited controls.
- We propose the implementation of corrective actions, based on a continuous learning process.
- We provide support in the ISMS certification activities according to the 27001 standard.
