Propuesta de un plan de gestión de riesgos y gestión ética para el departamento de tecnologías en el sector educativo

Abstract

Information technology (IT) infrastructure in Ecuadorian Universities is in constant evolution in response to the growing number of students and the offer of new IT services. One of the most relevant challenges of IT infrastructure management is to properly address technological risks such as cyber attacks and virus. The purpose of the present research is to develop a risk management plan for the IT department of higher education institutions. Furthermore, the relevance of ethics for the IT staff and management was analyzed. The scope of the study include the typical three IT units: Information services, Information systems, and Networking & Infrastructure. The developed risk management plan is based on recommendations of the standards: ISO/IEC 31000:2011 for risk management and ISO 37001:2016, ISO 26000 for the management of ethics. The analysis of these recommendations and the formulation of safeguards were developed based on the MAGERIT methodology and with the aid of the software tool PILAR and surveys to IT engineers.