Proposal for IT security in the organizational aspects of an IT system, applying ISO 27002 and CSF

Abstract

The article proposes a comprehensive approach to address computer security in the organizational aspects of a computer system. To achieve this, a combined framework of ISO 27002 (International Information Security Standard) and the CSF (Cybersecurity Framework) is used. ISO 27002 establishes standards and guidelines for managing information security in an organization. Its implementation involves the identification of information assets, risk assessment, application of security controls and continuous improvement of the information security management system. On the other hand, the CSF provides a specific framework for cybersecurity, addressing the prevention, detection and response to cyber threats. This framework can be tailored to the specific needs of the organization, allowing for greater flexibility in the implementation of security measures. The cyber security approach focuses on integrating these two frameworks to address both general aspects of information security and specific cyber threats. It highlights the importance of interdepartmental collaboration and staff awareness to ensure effective implementation.