Modelo integrado de gestión de seguridad de la información para pymes que procesan datos de tarjeta de crédito en Colombia, con enfoque PMI

Abstract

This project proposes an Integrated Information Security Management System (ISMS) for small and medium-sized Colombian businesses that store, process, or transfer card data. The proposal is based on the PCI DSS v4.0.1 standard, along with international standards related to information security, including ISO/IEC 27001:2022 and ISO/IEC 27005:2022, as well as current Colombian regulations on data protection and information security. The development of this model began with an analysis that identified gaps in governance, organizational culture, technical controls, and the organizations' capacity to respond to information security incidents. Based on these findings, a conceptual model was defined, comprised of five dimensions: governance and strategic direction, risk management, implementation of security controls, incident management, and continuous improvement. The model addresses the need for PYMEs to manage information security in accordance with regulatory requirements, while also considering their actual operating conditions, resources, capabilities, and limitations. In this way, the model aims to contribute to information security management that is applicable, sustainable, and aligned with the needs of Colombian companies.