Abstract

Currently, the support processes for administrative and technological management within organizations require clear policies that allow achieving high levels of security. This work presents a proposal for designing information security (IS) policies in the ICT department of a regional company. The methodology is based on obtaining information from the domains associated with the ISO 27.002 standard within the company. The results show an improvement in the company’s IS, considering the elaboration of procedures and controls to restrict access to data and some dependencies of the Company, mainly the ICT department.