Modelo de buenas prácticas de seguridad de la información para proveedores críticos en TI

Abstract

In the current digital landscape, information security has emerged as a critical pillar for organizational resilience and operational continuity. This research addresses the challenge of ensuring that third-party IT providers managing critical functions comply with established security standards while fostering an organizational security culture. The primary objective is to propose a comprehensive information security best-practice model within an integrated risk management framework for critical IT providers. This model is built upon the synthesis of the Awareness, Education, and Training (AET) and the Behavior Compliance (BC) models. Adopting a mixed-methods approach, the study utilized a non-experimental, cross-sectional design guided by the principles of Design Science Research (DSR). Data collection and analysis involved bibliographic record sheets and comparative analysis matrices to contrast the components of the AET and BC models against the control frameworks of NIST and ISO/IEC 27001/27002. The findings confirm that the predominant vulnerability in critical IT vendor management is not limited to technical controls; rather, it lies in the cultural gaps that hinder the translation of security awareness into sustainable practices. The resulting integrated model (AET+BC) provides a structured path to bridge these gaps through systematic awareness, education, and behavioral compliance programs.